The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest data from external project context files, which constitutes a potential attack surface for indirect instructions.
Ingestion points: Reads configuration and context from .agents/product-marketing.md, .claude/product-marketing.md, and product-marketing-context.md if they exist.
Boundary markers: There are no instructions provided to use delimiters or to disregard potential instructions found within these context files.
Capability inventory: The skill utilizes subprocess calls for image optimization tools (cwebp, mogrify, jpegoptim) and performs network operations using curl.
Sanitization: No sanitization or validation logic is specified for the content read from the context files.
[COMMAND_EXECUTION]: The skill provides examples of shell commands for the agent or user to execute for image manipulation and site inspection.
Evidence: Examples include cwebp for conversion, mogrify for batch processing, jpegoptim for compression, and curl for fetching HTML to identify image sources.
[EXTERNAL_DOWNLOADS]: The skill references several external APIs and libraries for its primary functionality.
Evidence: Mentions official APIs for Google Gemini, Flux (Black Forest Labs), Ideogram, OpenAI, and Recraft, as well as the @vercel/og library for dynamic image generation. These are recognized as well-known technology services.

image