The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to interact with a local CLI tool named flow (Labflow) and a Python script make.py. It provides extensive instructions for running various subcommands (image, images, batch, generate, upsample) and managing process PIDs.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external files including markdown prompt files (--prompt-file), JSON manifests (flow batch), and image ingredients. While it relies on external Google safety filters (UNSAFE_GENERATION) to catch malicious content, the ingestion of untrusted local file data into command arguments is a known vector.
Ingestion points: Prompt files (.md), manifest files (.json), and image reference files.
Boundary markers: None explicitly defined for file content boundaries.
Capability inventory: Execution of shell commands (flow, make.py) and local file system reads/writes.
Sanitization: Relies on the underlying Google Flow engine's safety filtering and prompt rejection logic.
[SAFE]: The skill contains explicit negative constraints preventing the agent from performing high-risk actions. Specifically, it instructs the agent to never expose or request session tokens, cookies, passwords, recovery data, or vault credentials, which mitigates potential data exfiltration of sensitive session information.

flow