The Agent Skills Directory

[DATA_EXFILTRATION]: The script "scripts/generate_image.py" accesses ".env" files to retrieve the "OPENROUTER_API_KEY" for authentication. It searches the current directory and all parent directories for a ".env" file to extract the required API key. While this is a standard configuration pattern for local tools, searching parent directories can lead to unintentional access of sensitive files if the skill is executed within a nested project structure.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to the OpenRouter API. It makes HTTP POST requests to "https://openrouter.ai/api/v1/chat/completions" to send prompts and receive generated image data. OpenRouter is a well-known service for accessing various AI models, and this behavior aligns with the skill's stated purpose.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface due to its data processing flow. Ingestion points: User-provided text prompts and optional input image files (converted to base64) are processed by "scripts/generate_image.py" in the "generate_image" function. Boundary markers: There are no explicit delimiters or instructions provided to the model to ignore potential injection attempts within the prompt or image content. Capability inventory: The skill has the capability to write files to the local file system and perform network requests via the "requests" library. Sanitization: Input prompts and image data are sent directly to the API without prior validation or sanitization for malicious instructions.

generate-image