The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md instructions guide the agent to run a shell command (python3 scripts/generate_image.py) using arguments populated with user-provided text like brand names.
[COMMAND_EXECUTION]: There is a risk of shell command injection if a brand name or description contains metacharacters (e.g., semicolons, backticks, or subshell syntax) that are not properly sanitized by the agent before execution.
[PROMPT_INJECTION]: The skill lacks security boundaries for processing untrusted data.
Ingestion points: Brand names, textual descriptions, and uploaded reference images.
Boundary markers: None identified; user input is directly interpolated into commands.
Capability inventory: Execution of local scripts and file system writes.
Sanitization: No instructions are provided to the agent to validate or escape shell characters in brand names or descriptions.
[SAFE]: The skill interacts with the Gemini API at generativelanguage.googleapis.com, which is a well-known and established service.
[SAFE]: API keys are managed via environment variables or placeholders in the documentation, following best practices for secret management.

logo-batch-generator