The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages a Google AI API key for image generation. It implements robust security measures for secret management, including writing to a user-private configuration file with restricted permissions (chmod 0600). The setup script also verifies if the configuration target is tracked by Git before writing the key, preventing accidental exposure in repositories.
[EXTERNAL_DOWNLOADS]: The skill supports an optional MCP server configuration using npx to fetch the @ycse/nanobanana-mcp package. The package is pinned to version 1.1.1 to ensure consistency and mitigate supply chain risks. The skill includes clear warnings that this optional package uses deprecated model IDs.
[COMMAND_EXECUTION]: The skill executes local Python scripts (generate_hero.py, setup_image_mcp.py, and validate_image_setup.py) to handle core functionality. These scripts include security checks for environment variables and file paths, such as rejecting relative paths for sensitive directories.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied topics and instructions to generate image prompts. It mitigates injection risks by instructing the agent to never pass raw user text directly to the API, instead requiring the agent to interpret and reconstruct the prompt using a structured 'Reasoning Brief' framework.

blog-image