The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected in the skill's instructions or scripts.
[DATA_EXPOSURE]: The script uses the OPENAI_API_KEY for authentication. This key is transmitted to the official OpenAI API endpoint or a user-defined proxy endpoint (OPENAI_BASE_URL), which is standard behavior for OpenAI-compatible tools.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for users to supply text that is directly interpolated into prompts for a downstream image generation model. While this creates a surface for prompt injection, it is the primary intended purpose of the tool and is managed by standard CLI argument parsing.
Ingestion points: CLI arguments handled by argparse in scripts/generate.py.
Boundary markers: Input strings are joined with periods to form sentences; no explicit delimiters are used to separate user input from system-defined prompt fragments.
Capability inventory: The script is capable of writing images (.png), data (.json), and a gallery (.html) to a local directory (defaulting to ~/Projects/tmp), and making outbound HTTPS POST requests to the OpenAI API.
Sanitization: Filenames derived from character names are sanitized using a regex-based slugification function.

game-character-gen