The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_angles.py executes a local utility using subprocess.run().
Evidence: The script calls gpt-image-2/scripts/generate_image.py by constructing a command list and passing it to subprocess.run. This is a controlled execution pattern using the current Python interpreter (sys.executable) rather than a shell string.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings and interpolates them directly into a natural language prompt, creating a vulnerability surface where malicious data could influence the image generation process.
Ingestion points: User-provided text is accepted via the --subject, --wardrobe, --scene, and --light command-line arguments in scripts/generate_angles.py (or through a JSON --scene-file).
Boundary markers: The prompt template in scripts/_prompt.py does not use delimiters, XML tags, or triple quotes to wrap the user-supplied fields, nor does it include instructions to ignore embedded commands within those fields.
Capability inventory: The skill has the capability to write files (prompts and images) and execute local scripts via subprocess.run as part of the gpt-image-2 integration.
Sanitization: No sanitization, escaping, or validation logic is applied to the descriptive fields before they are interpolated into the prompt template.

avatar-camera-angles