The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the user and agent to store API keys in plain text at ~/.genimg/config.json during the setup process described in SKILL.md.\n- [DATA_EXFILTRATION]: The script scripts/generate.py reads sensitive configuration data, including API keys, from the local file system at ~/.genimg/config.json.\n- [EXTERNAL_DOWNLOADS]: The script scripts/generate.py uses urllib.request.urlretrieve to download generated files from remote URLs provided by the API provider directly to a local file path.\n- [PROMPT_INJECTION]: The skill ingests untrusted prompts and image paths that are passed directly to external AI models without sanitization or boundary markers.\n
Ingestion points: The --prompt and --image arguments in scripts/generate.py accept data from the agent context which may be derived from untrusted sources.\n
Boundary markers: No delimiters or warning instructions are used to wrap the prompt data before transmission.\n
Capability inventory: The skill calls external APIs (network) and writes downloaded files to the local file system (file write).\n
Sanitization: No input validation, escaping, or filtering is implemented for the provided prompt string.

genimg