The Agent Skills Directory

[DATA_EXFILTRATION]: The resolve_image_ref function in scripts/gen.py reads the content of local files provided via the --image, --image2, or --image3 arguments and encodes them into base64 data URIs. These encoded file contents are then sent via a POST request to the Alibaba Cloud DashScope API. The script lacks path restrictions or sanitization to prevent reading sensitive files like SSH keys or environment configuration if their paths are provided as inputs.\n- [EXTERNAL_DOWNLOADS]: The skill uses urllib.request to fetch generated images from Alibaba Cloud's MaaS (Model-as-a-Service) endpoints (cn-beijing.maas.aliyuncs.com). These are well-known infrastructure domains associated with Alibaba Cloud's multimodal generation API.\n- [COMMAND_EXECUTION]: The awk-img-gen.sh shell wrapper invokes the Python interpreter using exec python3. This is a standard execution pattern for script wrappers in this environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and reference images that are interpolated into a request for an external AI model.\n
Ingestion points: Command-line arguments --prompt and reference image paths in scripts/gen.py.\n
Boundary markers: None; the prompt and image data are included directly in the JSON payload sent to the API.\n
Capability inventory: Includes the ability to read arbitrary local files (via image references), write to the local filesystem (saving images and gallery files), and perform network POST/GET operations.\n
Sanitization: The script performs validation on image dimensions but does not sanitize file paths or prompt content for potentially malicious or deceptive instructions.

awk-img-gen