The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of a third-party CLI tool vibedgames via npm and fetches content from fal.ai endpoints (queue.fal.run and api.fal.ai) during operation.\n- [COMMAND_EXECUTION]: The AI agent is instructed to execute shell commands using the vg CLI tool, such as vg image generate and vg image edit, which include parameters derived from user input.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
Ingestion points: User-provided text prompts and local image reference files processed via command-line arguments.
Boundary markers: No explicit delimiters or instructions are used to separate untrusted prompt content from command parameters.
Capability inventory: The skill executes shell commands with network access to external APIs and file system read/write access for image processing.
Sanitization: No visible sanitization or validation of user-provided prompt strings is performed before they are interpolated into shell commands.\n- [DATA_EXFILTRATION]: The skill accesses local image files to convert them into data URIs (e.g., in scripts/_fal_common.py) for transmission to external image generation models. This behavior is necessary for the skill's primary function of image editing.\n- [CREDENTIALS_UNSAFE]: The maintainer-only scripts utilize environment variables (FAL_KEY or FAL_API_KEY) for API authentication, following standard security practices for local development tools.

fal-image