The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate-pack.sh executes external bash utilities (upload.sh and generate-image.sh) located in relative parent directories. User-provided inputs, including --image, --image-url, and --likeness, are passed as arguments to these shell commands. While variables are double-quoted to prevent simple word splitting, this execution pattern relies on the safety of the external platform scripts.
[EXTERNAL_DOWNLOADS]: The skill uses curl to download generated image assets from URLs provided by the generation process. These files are saved to a local media_outputs directory on the user's system.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data via the --likeness and --category parameters, which are interpolated into complex, multi-line prompts for an image generation model.
Ingestion points: User input enters via the --image, --image-url, --category, and --likeness command-line arguments in scripts/generate-pack.sh.
Boundary markers: The skill lacks explicit boundary markers or system instructions to ignore potentially malicious content embedded within the user-provided likeness strings or image metadata.
Capability inventory: The skill possesses the ability to execute subprocesses (bash), perform network downloads (curl), and trigger local file opening (open command on macOS).
Sanitization: While shell arguments are quoted to prevent command injection at the script invocation layer, there is no semantic filtering or validation of the input strings before they are incorporated into the final AI prompts.

muapi-photo-pack-generator