The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/look_at.sh script passes the entire parent directory of a target file to several analysis backends using flags like --add-dir and -C. This behavior grants the underlying AI models and tools access to all files within that directory, creating a risk of sensitive data exposure if the target file is stored in a location containing private information.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media content that could contain instructions designed to hijack the agent.
Ingestion points: Media files and goal strings passed via the command line in scripts/look_at.sh and scripts/look_at.py.
Boundary markers: Prompts lack robust delimiters to separate instructions from untrusted file content.
Capability inventory: The skill can execute shell commands, read from the file system, and enable model-side code execution.
Sanitization: No input validation or content filtering is implemented for processed files.
[DYNAMIC_EXECUTION]: The --agentic option in scripts/look_at.py enables the code_execution tool for the Gemini API. This allows the model to run code to process images and documents, which could be exploited by malicious payloads embedded in the media files to perform unauthorized logic within the model's environment.
[METADATA_POISONING]: The skill contains deceptive documentation regarding model versions (e.g., 'GPT-5.4') and claims to bypass standard service billing using 'pooled accounts'. It specifically uses the LOOK_AT_NESTED=1 environment variable to disable platform security guards (like image-read-guard.ts), which is an intentional bypass of safety mechanisms.

look-at