The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash(python3 *) tool to execute Python scripts for image generation and editing. These scripts are dynamically generated by the agent using templates provided in the instructions.
[EXTERNAL_DOWNLOADS]: The skill's Python scripts interact with the Google Gemini API (a well-known service) to generate images. This communication is documented as a neutral operational requirement for the skill's primary function.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates external data (local brand identity files and untrusted user input) into prompts and Python script templates without explicit sanitization or boundary markers.
Ingestion points: The skill reads brand configuration from brand/creative-kit.md, brand/voice-profile.md, brand/positioning.md, and brand/landscape.md. It also collects user-provided text through discovery questions.
Boundary markers: Absent; user-provided text and brand data are inserted directly into prompt strings and Python literals within the generated script.
Capability inventory: The skill possesses the capability to execute arbitrary Python code via the Bash tool, perform file system writes (brand/assets.md, output.png), and make network requests to the Gemini API.
Sanitization: The instructions do not define any specific sanitization, escaping, or validation logic for the processed data before it is interpolated into executable contexts.

image-gen