The Agent Skills Directory

[DATA_EXPOSURE]: The scripts/generate.js script allows reading any local file provided via the --image command-line argument using node:fs/promises.readFile. This data is encoded to base64 and transmitted to an external API without validating the file path or ensuring the file is an image. While intended for multimodal processing, this creates a vector for an agent to read sensitive local files if tricked by a prompt.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill accepts untrusted user input via the prompt argument and --system flag in scripts/generate.js.
Boundary markers: There are no delimiters or specific instructions provided to the agent to prevent it from obeying instructions embedded within the processed text or image content.
Capability inventory: The skill possesses file-read capabilities (node:fs/promises) and network access to Google's API endpoints.
Sanitization: Input data is interpolated directly into the model request without any form of escaping or validation.
[METADATA_POISONING]: Both SKILL.md and references/models.md contain references to Gemini 3 and a January 2026 knowledge cutoff. These are misleading claims regarding current model availability and capabilities, which could lead to misjudgment of the tool's behavior or safety.

gemini-text