The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses sensitive information by reading API keys (OPENAI_API_KEY, GOOGLE_API_KEY) from environment variables and local configuration files. It specifically searches for .env files in the user's home directory (~/.baoyu-skills/.env) and the current working directory (.baoyu-skills/.env).
[EXTERNAL_DOWNLOADS]: The skill performs network requests to well-known service providers. It sends prompt and authentication data to api.openai.com and generativelanguage.googleapis.com. In the case of OpenAI, the skill may also perform a secondary fetch to download the generated image from a temporary URL provided by the API response.
[COMMAND_EXECUTION]: The skill's documentation and implementation involve executing local TypeScript scripts using the npx -y bun command to process generation tasks.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests data from external files specified by the user.
Ingestion points: The scripts/main.ts script reads the content of one or more files provided via the --promptfiles argument.
Boundary markers: Absent. The content of the files is concatenated and directly used as the input prompt for the AI model.
Capability inventory: The skill has the ability to perform network requests (fetch), create directories (mkdir), and write files to the disk (writeFile).
Sanitization: No sanitization, filtering, or validation is performed on the content read from the prompt files before it is sent to the image generation APIs.

baoyu-image-gen