The Agent Skills Directory

[METADATA_POISONING]: The skill documentation in SKILL.md contains deceptive claims regarding its safety configuration. While the documentation states that the default safety filter level is BLOCK_MEDIUM_AND_ABOVE, the accompanying scripts (generate_image.py, edit_image.py, and compose_image.py) define the default value for the --safety-filter-level parameter as BLOCK_NONE. This deception misleads the user about the safety posture of the skill, potentially exposing them to harmful generated content. Additionally, the skill references non-existent or fictitious model versions (gemini-2.5-flash-image and gemini-3-pro-image-preview).
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data that influences AI model output.
Ingestion points: The prompt command-line argument and input image files in generate_image.py, edit_image.py, and compose_image.py accept arbitrary user-controlled content.
Boundary markers: Absent. The user-provided prompt is interpolated directly into the contents list sent to the Gemini API without delimiters or instructions to ignore embedded commands.
Capability inventory: The scripts have the capability to perform network operations (connecting to the Google GenAI API) and write files to the local filesystem (img.save(args.output)).
Sanitization: Absent. There is no validation, escaping, or filtering of the input prompt string before it is passed to the AI model.

nano-banana-use