The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script scripts/generate_image.py to interact with the OpenAI API. This is the primary intended function of the skill.
[EXTERNAL_DOWNLOADS]: The skill requires the openai Python package, which is a standard and well-known library from a trusted organization. It provides clear instructions for the user to install it manually via pip.
[CREDENTIALS_UNSAFE]: The skill correctly handles sensitive information by requiring the OPENAI_API_KEY to be provided as an environment variable. It explicitly instructs the user NOT to hardcode the key and recommends using a .env file for local management, which is a standard safe practice.
[DATA_EXFILTRATION]: Network operations are restricted to communication with the official OpenAI API endpoints via the authorized SDK. No evidence of unauthorized data transmission or exfiltration was found.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts and images. While this is an ingestion point for untrusted data, the risk is mitigated as the data is passed to a specialized image generation model (gpt-image-2) rather than being used to influence the agent's own logic or command execution. Capability inventory is limited to image file writes and API requests.

generating-images