The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted user-supplied articles or tutorials to generate storyboards and image generation prompts.
Ingestion points: User input is ingested via pasted text or files (e.g., article.md), which are then analyzed to create the comic's narrative structure.
Boundary markers: The storyboard and prompt generation logic lacks explicit delimiters or instructions to ignore commands that might be embedded within the user's source text.
Capability inventory: The skill possesses capabilities to write files to the project directory, execute TypeScript scripts, and call external image generation tools.
Sanitization: There is no evidence of sanitization or escaping of the user-provided content before it is interpolated into the generation prompts.
[COMMAND_EXECUTION]: The workflow relies on shell command execution via npx -y bun to run a local PDF merging script (scripts/merge-to-pdf.ts) and a script from a sibling skill (../baoyu-image-gen/scripts/main.ts). While these scripts are part of the vendor's own ecosystem and the provided script logic is benign, the pattern involves executing commands that rely on specific local directory structures and environment tools.

baoyu-comic