The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external sources, specifically article files and X (Twitter) tweets, to generate image generation prompts and plan illustrations.
Ingestion points: article-illustration-planner reads local and provided article text; tweet-style-importer scrapes content directly from X (Twitter) URLs.
Boundary markers: There are no explicit instructions to use delimiters or sanitization routines for the external content before processing.
Capability inventory: The skill can execute Python scripts via the agent, write to the filesystem, and call image generation tools.
Sanitization: The instructions do not define sanitization logic, relying on the agent's summarization capabilities which can be bypassed via crafted input.
[DYNAMIC_EXECUTION]: The skill employs a self-modifying logic where data retrieved from external URLs (via tweet-style-importer) is automatically appended to the skill's internal instruction files (styles_200_reorganized.md) and configuration files (model_capabilities.json). This creates a vector for persistent instruction injection where a malicious style definition from an external source could influence the agent's future behavior.
[COMMAND_EXECUTION]: The agent is instructed to run several local Python scripts to maintain the library. Some of these scripts, such as style_library_import.py and validate_library.py, utilize subprocess.run to execute shell commands. While these appear intended for library management, they represent a significant capability that could be abused if the script arguments are influenced by malicious input.
[PERSISTENCE]: The custom-asset-manager sub-skill establishes persistence by creating and maintaining a global configuration file at ~/.handraw-style/config.json, which resides outside the local workspace and persists across different environments.

handdraw-style-prompter