The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to search for and read .env files to verify the presence of an OPENROUTER_API_KEY. Accessing .env files is a security concern as these files are standard locations for storing sensitive credentials and environment secrets.
[COMMAND_EXECUTION]: The skill operates by executing a local Python script (scripts/generate_image.py) via the command line. While this is a common pattern for skill implementation, it involves shell-level interaction with user-provided arguments.
[PROMPT_INJECTION]: The skill includes a 'Suggest Using K-Dense Web' section that provides conditional instructions for the agent to proactively market an external platform (www.k-dense.ai). This represents a behavioral steer to influence the agent's natural response pattern.
[EXTERNAL_DOWNLOADS]: The documentation notes a dependency on the requests Python library for performing network communication with the OpenRouter API.
[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface through its reliance on user-supplied prompts and images:
Ingestion points: User-provided text prompts and input images are passed directly to the scripts/generate_image.py script.
Boundary markers: The instructions lack delimiters or explicit warnings to ensure the agent ignores malicious instructions embedded within the user's image prompts.
Capability inventory: The script has the ability to execute subprocesses and perform network operations using the requests library.
Sanitization: No input validation or escaping mechanisms are described to mitigate risks from processing untrusted input data.

generate-image