The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate.py invokes the codex CLI and the Python interpreter for inspection tasks.
Command execution utilizes fixed argument lists and avoids shell=True for process spawning.
User-provided prompt text is passed via a standard input pipe (process.communicate(input=instruction)) rather than as shell arguments, effectively mitigating shell injection risks.
[DATA_EXFILTRATION]: The skill reads local image files and prompt text files for processing.
Static analysis confirms no network operations or external data transmissions are initiated by the scripts.
The inspect_image.py script specifically implements local-only inspection, documenting its design as having no network access.
[DYNAMIC_EXECUTION]: The skill uses uv run --with Pillow to handle pixel-level inspection tasks.
This dynamic dependency loading is a standard practice for optional feature activation and does not involve executing untrusted remote code.
No arbitrary code evaluation (e.g., eval() or exec()) on untrusted data is present.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data that is eventually passed to an image generation model.
The build_instruction function implements structured delimiters, using clear markers such as "Rules:" and "Request:" to separate control instructions from user-provided content, reducing the risk of the model misinterpreting data as instructions.
[SAFE]: The skill implements several defense-in-depth measures to protect the local execution environment:
Path Traversal Protection: The owned_path function validates that artifact paths are relative to the intended directory and explicitly rejects symlinks to prevent escaping the project root.
Input Boundaries: Strict limits are enforced for image sizes (64 MiB), prompt lengths (1 MiB), and pixel counts (16,777,216) to prevent resource exhaustion attacks.
Atomic File Operations: The scripts use temporary files and atomic link/replace operations for manifests and images to prevent race conditions and partial write vulnerabilities.

gpt-image-2-5