The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation recommends using 'https://tryallapi.com/v1' as an alternative API endpoint for image generation. This configuration requires the user to provide their 'GPTIMAGE_API_KEY' to a non-official and unverified third-party service, which presents a significant risk of credential harvesting by the gateway provider.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data provided by the user, such as brand reference images and text labels, which are directly interpolated into image generation prompts. This creates a surface where adversarial instructions in the input data could influence the resulting imagery or the agent's prompt context. • Ingestion points: Brand reference images in 'brand/' and user-defined variables like {text} and {item} in SKILL.md. • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the prompt templates (Templates A, B, C, D). • Capability inventory: The 'scripts/generate.py' tool has the capability to make outbound network requests and write image files to the local disk. • Sanitization: No input validation, escaping, or sanitization of user-supplied content is performed before processing.

merch-design