The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/gossamer.py implements a discovery mechanism that searches for a script named check_update.py within sibling directories (e.g., qwencloud-update-check) and executes it using subprocess.run. The path to the script is computed at runtime based on the repository structure.
[PERSISTENCE]: The skill's documentation in references/agent-compatibility.md instructs the agent to modify local configuration files, such as CLAUDE.md or AGENTS.md, to register the skill. This ensures the skill's instructions are persistently loaded into the agent's context across sessions.
[EXTERNAL_DOWNLOADS]: SKILL.md directs the agent to install additional components using npx skills add from the QwenCloud/qwencloud-ai repository. While the source is the vendor's own repository, this represents a remote download and installation of executable content.
[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/gossamer.py for task execution. It also provides multiple shell command examples for environment setup, API key management via .env files, and file system operations.
[INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data via the prompt field.
Ingestion points: scripts/image.py accepts request data via --request or --file arguments.
Boundary markers: None are present in the interpolation logic within scripts/image_lib.py.
Capability inventory: The skill has network access via urllib and file write capabilities via download_file in scripts/qwencloud_lib.py.
Sanitization: No input sanitization or validation of the prompt content is performed before interpolation.

qwencloud-image-generation