The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The assets/imagegen.py script accepts a user-provided prompt as a command-line argument and includes it in the JSON payload sent to a remote API. If the input source is untrusted, this could be used to attempt to influence the agent or the downstream API. * Ingestion points: The prompt argument in the main function of assets/imagegen.py. * Boundary markers: The script does not utilize delimiters or specific instructions to isolate the user-provided prompt content within the API request. * Capability inventory: The script has the capability to make network requests (POST/GET) and write files to the local file system (image downloads). * Sanitization: No sanitization or escaping is performed on the prompt input before it is transmitted to the remote service.
[EXTERNAL_DOWNLOADS]: The skill downloads generated image files from the vendor's official domain (redfox.hk) and saves them to the local ~/Downloads/QoderImages directory. These downloads are part of the core functionality.
[COMMAND_EXECUTION]: The SKILL.md documentation provides instructions for the agent to execute the local Python script assets/imagegen.py with various arguments to manage image generation tasks.

image-gen