The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs automated tasks by executing local commands and scripts.
Repository hooks: The skill identifies and runs existing UI test suites, Fastlane snapshot commands, or Maestro flows within the target repository to capture screenshots (documented in references/capture.md).
Custom adapters: scripts/generate_image.py supports a custom command mode that executes external CLI tools as defined in a JSON configuration file. It uses subprocess.run with an argument list, which is a secure practice to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The skill interacts with external providers for asset generation and retrieval.
Official APIs: Communication is limited to well-known services: Google Gemini (generativelanguage.googleapis.com), OpenAI (api.openai.com), and xAI (api.x.ai).
Image downloads: Assets generated by remote providers are downloaded over HTTPS. The skill explicitly isolates API credentials, ensuring they are not forwarded to the image hosting domains.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted repositories to influence asset creation, presenting a potential attack surface.
Ingestion points: The agent extracts content from README.md, marketing documentation, and source code metadata to determine "core benefits" for headlines (SKILL.md Section 2).
Boundary markers: Absent. There are no explicit delimiters or instructions for the agent to ignore embedded commands when processing repository documentation.
Capability inventory: Capabilities include network requests to AI providers via scripts/generate_image.py, file system writes for saved images in scripts/layout.py, and execution of local repository scripts.
Sanitization: Absent. Discovered benefit text is used directly in image prompts and rendered as graphical text on the screenshots without specific filtering.

appstore-screenshots