The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as magick (ImageMagick) and oxipng to perform image transformations. These tools are used for their intended purpose of resizing, cropping, and compressing images.
[EXTERNAL_DOWNLOADS]: The documentation suggests installing dependencies via Homebrew (brew install imagemagick oxipng). This is a well-known service for package management and does not involve untrusted remote code execution.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from images. Ingestion points: User-provided images (e.g., inbox/photo.jpg in SKILL.md). Boundary markers: The instructions explicitly state 'Never expose local paths to the user' and emphasize a 'fail open' approach. Capability inventory: Uses magick, oxipng, identify, jpegoptim, and cwebp for file manipulation and analysis. Sanitization: Includes commands to strip metadata (-strip and --strip safe) which helps mitigate potential injection via EXIF or other image metadata fields.

hal-image