The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install a global NPM package named vibedgames. This package is not from a well-known service or a trusted vendor, posing a supply chain risk.
[COMMAND_EXECUTION]: The skill relies on executing the vg CLI tool for image generation and account management. Executing unverified third-party binaries can lead to arbitrary code execution.
[CREDENTIALS_UNSAFE]: The skill references a vg login command for authentication. While it claims the API key is handled server-side, this process involves external authentication through an unverified third-party service.
[PROMPT_INJECTION]: The skill provides instructions to the agent based on a non-existent OpenAI model (gpt-image-1.5) and provides fabricated documentation links. This deceptive metadata can mislead the agent's behavior and understanding of its environment.
[PROMPT_INJECTION]: The skill processes untrusted user input to construct prompts for image generation without boundary markers or sanitization, creating a surface for indirect prompt injection. 1. Ingestion points: User requests for image generation in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: vg image generate and vg image edit in SKILL.md. 4. Sanitization: Absent.

gpt-image