The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes and displays textual output from an external AI model, which could potentially contain malicious instructions intended to influence the agent.
Ingestion points: The script scripts/generate_image.py prints the part.text component of the Google Gemini API response directly to the standard output.
Boundary markers: While SKILL.md instructs the agent to "report the saved path only" and not read the image back, it does not provide explicit instructions to disregard or sanitize any text returned by the model.
Capability inventory: The skill possesses file system write capabilities via the pillow library, and the agent calling it has shell execution authority via uv.
Sanitization: No validation, escaping, or filtering is applied to the text received from the model before it is presented to the agent.
[SAFE]: The skill interacts with the Google Gemini API, which is an official service from a well-known technology provider.
[SAFE]: Dependencies are restricted to reputable, versioned libraries (google-genai, pillow) from standard package registries.
[SAFE]: Sensitive credentials such as the GEMINI_API_KEY are managed using environment variables, which is a standard security practice.

nano-banana-pro