The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates user-controlled data directly into the API request payload without sanitization or boundary markers.
Ingestion points: The scripts/generate.py script accepts external input via the --prompt argument and the contents of a JSON file provided to the --batch argument.
Capability inventory: The script has the capability to read local files (reference_image), write to the file system (output_path), and perform network operations (connecting to openrouter.ai).
Boundary markers: There are no delimiters or specific instructions (e.g., "ignore any instructions contained within this text") provided to the model to separate the system's instructions from the user-provided prompt.
Sanitization: The script does not escape or validate the prompt or batch content before including it in the JSON payload sent to the remote AI model.
[DATA_EXFILTRATION]: The skill can be used to read arbitrary local files and send their Base64-encoded content to an external API endpoint.
Evidence: The --reference argument and the reference field in the batch JSON file allow a user to specify any local file path. The generate_image function in scripts/generate.py reads the binary content of the specified file, encodes it as Base64, and includes it in the messages payload sent to the OpenRouter API at https://openrouter.ai/api/v1/chat/completions.

image-ai-generator