The Agent Skills Directory

[SAFE]: The skill performs legitimate image generation and editing tasks by communicating with OpenRouter. No malicious behaviors such as unauthorized data exfiltration, system persistence, or privilege escalation were identified.
[EXTERNAL_DOWNLOADS]: The script 'scripts/generate_image.py' makes API calls to 'https://openrouter.ai'. This is a recognized and well-known service for accessing various AI models, and its use here is consistent with the skill's stated purpose.
[DATA_EXPOSURE]: The skill includes functionality to locate an API key by searching for '.env' files in the current and parent directories. This is a standard and documented practice for local credential management and does not constitute an unsafe credential exposure.
[PROMPT_INJECTION]: The skill processes user-supplied text prompts and image files, which represents a potential surface for indirect prompt injection. This is a common characteristic of multimodal AI tools and is documented here as a risk factor.
Ingestion points: User-provided 'prompt' argument and 'input_image' file contents processed in 'scripts/generate_image.py'.
Boundary markers: No specific delimiters or safety instructions are used to isolate user input within the API request payload.
Capability inventory: The skill has the capability to perform network requests via the 'requests' library and write files to the local system.
Sanitization: There is no evidence of input validation or sanitization for the prompt or image data before they are sent to the model.

generate-image