The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run.py uses os.execv for process replacement. This is a standard architectural pattern used to ensure the skill runs within its designated virtual environment (.runners-venv). It re-executes the current script with the discovered Python interpreter and original arguments, presenting no security risk.
[DYNAMIC_EXECUTION]: The entry point script scripts/run.py dynamically modifies the system path to import modules from a relative common directory. This is consistent with monorepo structures and used for internal logic delegation to common.runners.cli.thumbnail.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data as it accepts user-provided titles and photo references (URLs or paths) which are then interpolated into image generation prompts.
Ingestion points: SKILL.md (via --title and --photo arguments).
Boundary markers: Not explicitly defined in the prompt fragments, though the skill provides structured templates for layout.
Capability inventory: The skill has file system write access for saving generated PNGs and manifest files, and Bash access for running the generation script.
Sanitization: The skill relies on the underlying image model's safety filters for the generated content.

thumbnail-maker