The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to openrouter.ai to interact with AI models for image generation, text research, and quality assessment. This uses a well-known service to provide the skill's primary functionality.
[COMMAND_EXECUTION]: The main wrapper script uses the subprocess module to execute a secondary local Python script within the skill directory. The command is constructed as a list and executed without a shell, which is a secure implementation that prevents command injection.
[DATA_EXFILTRATION]: User-provided prompts and data gathered during the optional research phase are sent to the OpenRouter API. This is the intended behavior of the skill and is required for the AI to process the request.
[CREDENTIALS_UNSAFE]: The skill uses an OpenRouter API key, which it safely retrieves from the environment or a configuration file. It follows best practices by not hardcoding credentials and instructing users on how to manage their secrets securely.
[PROMPT_INJECTION]: The skill processes external data from web research and user prompts, which are interpolated into a final generation prompt. While this creates an indirect prompt injection surface, the skill uses clear boundary labels to distinguish between instructions and data.

infographics