The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/align_encode.py and scripts/package.py to execute system utilities such as ffmpeg, ffprobe, and zip. These calls use array-based arguments rather than shell strings, providing protection against shell injection while handling media encoding and file packaging.
[INDIRECT_PROMPT_INJECTION]: The skill processes character and pose descriptions provided by the user in work/chars.json and interpolates them into image generation prompts within scripts/gen_grids.py. This creates an attack surface where a user could potentially influence the image generator's behavior.
Ingestion points: Character and pose strings read from work/chars.json in scripts/gen_grids.py.
Boundary markers: None implemented in the prompt construction.
Capability inventory: Local file system read/write, network requests to OpenRouter API, and execution of media processing tools.
Sanitization: No specific sanitization or filtering of the input strings was detected.
[DATA_EXFILTRATION]: The script scripts/check_openrouter.sh reads sensitive local shell configuration files (e.g., ~/.zshrc, ~/.bashrc) to verify the setup of the OPENROUTER_API_KEY. This is a local-only environment check designed to assist the user with configuration; the script does not log or transmit the contents of these files.

cameo-image-loop