The Agent Skills Directory

[DATA_EXPOSURE]: The skill manages API keys by storing them in a local configuration file at ~/.ai-hive/config.json. The implementation includes a security best practice by calling os.chmod(..., 0o600) to ensure the file is accessible only by the current user, mitigating the risk of local credential theft.
[COMMAND_EXECUTION]: The Python script scripts/imagegen.py handles media uploads, task polling, and results retrieval. These operations are performed via standard library calls and the requests package, and are restricted to the functionality described in the skill's documentation.
[EXTERNAL_DOWNLOADS]: The skill retrieves generated image and video content from the AI Hive service infrastructure (ai-hive.iclip.cn). These downloads are the intended outcome of user-initiated tasks and originate from the service's official API.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a pass-through for user-supplied prompts and reference images to an external AI model.
Ingestion points: The --prompt and --image arguments in scripts/imagegen.py receive external data.
Boundary markers: None are implemented; user input is transmitted directly within the JSON request body.
Capability inventory: The script possesses file system access (read/write) and network capabilities to facilitate uploads and downloads.
Sanitization: The skill does not sanitize or filter the content of the prompt, relying on the downstream API's safety filters.

nano-banana-pro-livestream-image