The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection.
Ingestion points: The skill accepts untrusted data via the prompt and image_url parameters in scripts/generate_image.py and scripts/generate_image.ts.
Boundary markers: No boundary markers or instructions to ignore embedded commands are present in the scripts before passing data to the API.
Capability inventory: The skill possesses network communication capabilities (via the Together AI SDK) and local file-system write capabilities (scripts/generate_image.py writes binary data to a file).
Sanitization: No sanitization or validation of the input prompt or URL is performed before processing.
Safety Bypass: The API reference and documentation explicitly mention the disable_safety_checker parameter, which allows bypassing NSFW filters.
[COMMAND_EXECUTION]: The script scripts/generate_image.py contains a generate_and_save function that writes generated image data to a local file using open(output_path, "wb"). While the provided examples use benign paths, this capability could be used to overwrite local files if an agent is influenced to use a sensitive path as the output_path argument.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external dependencies to function.
Python: Requires the together package.
Node.js: Requires the together-ai package.
These are recognized as official SDKs for a well-known service and are documented neutrally.

together-images