The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains instructions for the agent to "silently" download a Python script from https://raw.githubusercontent.com/leeguooooo/chatgpt-imagegen/main/chatgpt-imagegen and execute it using chmod +x. This allows for unverified code execution without user intervention.\n- [REMOTE_CODE_EXECUTION]: The documentation provides an installation workflow for chrome-use that involves piping a remote shell script from https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh directly into sh, a high-risk pattern for executing untrusted remote code.\n- [DATA_EXFILTRATION]: The skill is designed to read the sensitive local file ~/.codex/auth.json, which stores ChatGPT OAuth access and refresh tokens. While used for legitimate authentication, this access exposes user credentials to the agent environment.\n- [COMMAND_EXECUTION]: The skill's primary functionality relies on executing shell commands via subprocess.run(), as seen in drafts/gemini_probe.py and the SKILL.md workflow, to drive browser automation tools and image processing utilities like magick and img2webp.\n- [PRIVILEGE_ESCALATION]: The README.md file suggests using sudo install to move the CLI tool into /usr/local/bin, requiring the user to grant administrative privileges to the installation process.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompt data and interpolates it into instructions for external models and browser automation commands, creating an attack surface for indirect prompt injection.\n
Ingestion points: The prompt argument provided to the chatgpt-imagegen command in SKILL.md.\n
Boundary markers: The skill does not implement explicit boundary markers or "ignore embedded instructions" warnings for the user-supplied prompts.\n
Capability inventory: The skill can perform network operations via urllib, write files using the -o flag, and execute shell commands through subprocess.\n
Sanitization: No sanitization or escaping of the user-provided prompt is performed before it is used in the model instruction wrappers.

chatgpt-imagegen