The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external images (which can be sourced from URLs) and convert their content into functional code and assets. This creates a surface where malicious instructions embedded within an image could influence the agent's output or tool usage.
Ingestion points: The skill accepts image references via attachment, local path, or URL (README.md, SKILL.md).
Boundary markers: There are no specific instructions or delimiters provided to the agent to distinguish between legitimate UI content and potentially malicious instructions embedded in the image text.
Capability inventory: The skill has the capability to write files (index.html, styles.css) and execute shell commands via uv run (SKILL.md).
Sanitization: The instructions lack explicit requirements for the agent to sanitize identifiers (like slug or id) derived from external filenames or image content before using them in generated code or shell scripts.
[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands (uv run, open) using variables derived from the input data.
Evidence: The skill uses uv run ~/.agents/skills/openrouter-img/scripts/generate_image.py with parameters like --filename design-systems/<slug>/assets/{id}.png. If the <slug> (derived from the filename) or {id} (derived from the wireframe processing of the image) contains shell metacharacters, it could lead to arbitrary command execution.
[EXTERNAL_DOWNLOADS]: The skill integrates with well-known external services to fulfill its primary purpose.
Evidence: It fetches configuration or assets via the OpenRouter API for image generation and references Google Fonts for typography in the generated HTML files.

img-to-html