The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to generativelanguage.googleapis.com to access Gemini Text-to-Speech and Veo video generation services. These connections are intended for the skill's primary functionality and target a well-known service.
[COMMAND_EXECUTION]: The manifests tool/provider.json and tool/video-provider.json register local Python scripts (worker.py and video-worker.py) as providers. These scripts are executed locally to handle API interactions via a JSONL protocol.
[DATA_EXPOSURE]: The skill requires a GEMINI_API_KEY provided via the environment. The implementation includes specific logic to redact this key from stderr logs and ensures it is only transmitted in secure x-goog-api-key HTTP headers to the API provider.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and prompts for generation. The scripts implement basic boundary markers (e.g., wrapping instructions in brackets) and strictly validate options like model names, durations, and aspect ratios to limit the attack surface.

narova-google