The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill requires the agent to use the --sandbox danger-full-access flag when executing commands. This configuration is intended to disable platform security sandboxing, granting the agent unrestricted access to both the network and the host filesystem.
[COMMAND_EXECUTION]: The workflow relies on executing several command-line utilities, including codex, sips (macOS scriptable image processing system), cwebp (WebP conversion), and magick (ImageMagick), to perform image generation and post-processing tasks.
[DATA_EXFILTRATION]: The skill accesses files located in the user's home directory at ~/.codex/generated_images/. Accessing application-specific data or configuration directories outside of the project workspace presents a risk of sensitive data exposure.
[DYNAMIC_EXECUTION]: The instructions recommend using python3 heredocs to dynamically generate and execute script blocks for managing complex logic and processing loops. This runtime code generation increases the skill's attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image descriptions to construct prompt files for an internal image generation engine.
Ingestion points: User-provided descriptions of the requested visual assets are written directly into prompt.md.
Boundary markers: The prompt template uses natural language instructions (e.g., "No text", "Do not substitute placeholders") but lacks structured delimiters to isolate user-supplied content from the agent's core instructions.
Capability inventory: The skill has the ability to execute shell commands and make network requests via the Codex generation tool.
Sanitization: There is no evidence of input validation, escaping, or filtering for the user-supplied descriptions before they are processed by the generation engine.
[EXTERNAL_DOWNLOADS]: The skill recommends installing system dependencies such as webp and imagemagick via the Homebrew package manager if they are not already present on the local machine.

imagegen