The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uv run python to execute the local script scripts/generate_image.py. This is a standard and expected way to run Python-based skills within this platform and poses no risk as it executes the skill's own distributed code.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their OpenRouter API key via environment variables or a .env file. It includes a fallback mechanism to look for these files in the directory tree, which is a standard pattern for CLI tools and does not hardcode any sensitive secrets.
[EXTERNAL_DOWNLOADS]: The skill communicates with https://openrouter.ai/api/v1/chat/completions to process image generation requests. This is the primary intended purpose of the skill and targets a well-known, legitimate service provider.
[DATA_EXFILTRATION]: While the skill reads local image files provided by the user via the --input argument, it only does so to transmit them to the specified OpenRouter API for the purpose of image editing as requested by the user. There is no evidence of unauthorized data harvesting or transmission to unknown third parties.
[INDIRECT_PROMPT_INJECTION]: The skill takes a user-provided prompt and interpolates it into the API request. While this is an ingestion point for untrusted data, the impact is limited to the context of image generation, and the output is a binary image file, which significantly mitigates the risk of downstream command execution or further injection attacks.

generate-image