The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and documentation specify the execution of a local Python script (scripts/generate_image.py) to process prompts and generate images. This is a primary intended function of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input by interpolating it into structured JSON templates located in references/templates/ to form final image generation prompts.
Ingestion points: User-provided variables such as product descriptions, materials, and scene settings are directly inserted into template fields.
Boundary markers: The templates lack programmatic escaping or strict delimiters for user input, relying instead on natural language instructions for the agent.
Capability inventory: The skill possesses the ability to execute Python scripts, read/write to the local filesystem, and perform network requests to external APIs.
Sanitization: No explicit input sanitization or validation is performed on the user-provided data before it is used in prompt construction.
[DATA_EXFILTRATION]: The provided Python script scripts/generate_image.py initiates network requests to external domains including api.apimart.ai and others to transmit API keys and user prompts. While these operations are functional requirements, they target domains outside the standard whitelist.

ecom-details-image