The Agent Skills Directory

[COMMAND_EXECUTION]: The tests/test_validate_plan.py test suite uses subprocess.run to execute the local validation utility scripts/validate_plan.py. This is restricted to the development/testing environment and uses the current Python interpreter with a relative path to the bundled script.
[EXTERNAL_DOWNLOADS]: The gateway_image.py script interacts with established image generation APIs and fetches generated assets from well-known media domains associated with the services:
API Endpoints: https://queue.fal.run, https://api.replicate.com, and https://api.together.ai.
Asset Domains: fal.media and replicate.delivery.
Verification: The script enforces HTTPS, restricts communication to specific approved hosts, and includes checks for response deadlines and size limits.
[INDIRECT_PROMPT_INJECTION]: The skill architecture processes JSON-based 'approval plans' which could theoretically contain malicious instructions.
Ingestion points: Data enters through approval-plan.json handled by scripts/validate_plan.py and environment variables in gateway_image.py.
Boundary markers: The skill uses strict JSON schema validation, rejects unknown keys, and enforces specific data types and ranges.
Capability inventory: The skill possesses network communication (urllib) and file system write (atomic writes) capabilities.
Sanitization: The validate_plan.py script implements comprehensive security checks, including scanning for secret-bearing patterns (e.g., sk-, Authorization:) within the plan content and ensuring pricing estimates exactly match unit calculations.

image-generation-gateways