The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides complex shell scripts in SKILL.md (Step 4 and Step 5) to automate image generation and processing. These scripts use curl for network requests, jq for JSON manipulation, base64 for decoding, and image utilities like magick, convert, or sips for resizing. While the scripts include safety checks, they perform file system operations and network calls based on user-defined parameters.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from external sources. It communicates with the OpenAI API (or a user-specified proxy) to generate images and allows downloading reference images from arbitrary URLs provided in the REF_IMAGE variable.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by interpolating user-controlled book titles and author names into model prompts without sanitization. \n- Ingestion points: User-provided inputs for book titles, author names, and style preferences in Step 1. \n- Boundary markers: Absent; variables are directly embedded in strings like 'Title text {书名}' without delimiters. \n- Capability inventory: Includes network access via curl, file system writes, and local command execution via utilities. \n- Sanitization: None detected; user inputs are used directly to construct the API request body.

story-cover