The Agent Skills Directory

[SAFE]: The skill uses the official @google/genai SDK to interact with Google's Gemini File API, which is a well-known and trusted service for multimodal file processing.
[SAFE]: Sensitive credentials like API keys are managed through environment variables using the dotenv package, following industry-standard best practices for secret management.
[SAFE]: File system operations in scripts/upload.js are restricted to reading the specific file path provided as a command-line argument for the purpose of uploading, with no evidence of directory traversal or unauthorized access to sensitive system files.
[INDIRECT_PROMPT_INJECTION]: As the skill handles various file types (PDFs, documents, images) which may contain untrusted data, there is a theoretical surface for indirect prompt injection if the content is later processed by an LLM. However, the skill acts primarily as a transport layer and includes no instructions to bypass safety filters.

gemini-files