The Agent Skills Directory

[SAFE]: The skill implements image generation and editing by routing requests to the FAL API proxy. It follows best practices for secret management by using the auto-injected MAX_API_KEY environment variable.
[COMMAND_EXECUTION]: The skill runs a JavaScript tool via bun to perform API calls. This is the intended execution model for this agent skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user (prompts and image file paths) which are then sent to the FAL API. While these inputs could contain instructions intended to influence the image model, the capability is limited to image generation and does not pose a threat to the agent's environment. The skill uses AskUserQuestion to ensure user intent is captured correctly.
Ingestion points: CLI arguments --prompt and --input-image in image-gen.js.
Boundary markers: None implemented in the script logic.
Capability inventory: File system access (fs.writeFileSync, fs.mkdirSync), network access (falUploadFile, downloadToFile, falRun, falQueueSubmit).
Sanitization: No specific sanitization or escaping of the prompt or image paths is performed before API transmission.

image-gen