The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run within scripts/sync_cases.py and scripts/check_updates.py to invoke Git commands such as git pull, git ls-remote, and git rev-parse. These commands are used to manage and update the local prompt library. The implementation uses list-based arguments rather than shell strings, which is a secure practice that mitigates command injection risks.
[EXTERNAL_DOWNLOADS]: To maintain its reference library, the skill is designed to fetch data from external community-maintained repositories on GitHub (specifically the EvoLinkAI and Anil-matcha prompt collections). This data retrieval is a documented core function necessary for the skill's operation.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection because it ingests and processes text prompts authored by third parties in external repositories.
Ingestion points: Untrusted prompt text is parsed from external README files and stored in references/case-library.md.
Boundary markers: The skill does not currently employ specific delimiters or "ignore" instructions when the agent processes these ingested skeletons during prompt synthesis.
Capability inventory: The skill has the ability to synthesize final prompts and directly call the internal image_gen tool.
Sanitization: While metadata tags are validated against a predefined whitelist in scripts/tag-vocabulary.yaml, the primary prompt content used for image generation is used as a template without extensive sanitization.

gpt-image-prompt-lib