The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bash script to perform its core functions, including calling curl for API requests, jq for JSON manipulation, and base64 for image decoding. These are standard operations for a command-line utility.
[CREDENTIALS_UNSAFE]: The skill manages a Google Gemini API key. It employs best practices for local secret management by storing the key in a configuration file, providing a dedicated CLI for setting the key, and implementing masking logic to prevent the key from being displayed in plain text. Furthermore, the instructions explicitly forbid the AI agent from attempting to read or reveal the key.
[DATA_EXFILTRATION]: The skill transmits the configured API key and user-provided prompts to the official Google Gemini API endpoint (generativelanguage.googleapis.com). As this is a well-known and trusted service, this behavior is considered safe and functional.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text as input for image generation. * Ingestion points: User-provided prompts passed via the --prompt argument in acestep-thumbnail.sh. * Boundary markers: The prompt is safely encapsulated within a JSON payload using jq's argument escaping. * Capability inventory: File writes for the generated image, network access to Google APIs via curl. * Sanitization: The script uses jq to ensure the prompt is properly escaped for the API request, preventing command injection into the shell or malformed JSON payloads.
[DYNAMIC_EXECUTION]: The script contains a static Python one-liner used as a fallback for base64 decoding. This is a common utility pattern and does not pose a security risk as it does not execute untrusted or dynamically generated code.

acestep-thumbnail