The Agent Skills Directory

[COMMAND_EXECUTION]: Path Traversal Vulnerability. The scripts/generate_image.py script takes a --filename argument and uses it to create directories and write the output PNG file using output_path.parent.mkdir(parents=True, exist_ok=True) and image.save(). Since the script does not validate or sanitize this path, an attacker can provide relative paths (e.g., ../../.ssh/authorized_keys) to overwrite sensitive files the agent has permission to access.
[DATA_EXFILTRATION]: Arbitrary File Read and Exposure. The --input-image argument in scripts/generate_image.py allows the script to open any local file using PILImage.open(). The content of the file is then sent to the external Google Gemini API as part of the contents list. This can be exploited to exfiltrate sensitive data if the model is prompted to extract or describe the content of the provided file.
[CREDENTIALS_UNSAFE]: Insecure API Key Management. The skill documentation and the script allow providing the Gemini API key as a command-line argument (--api-key). This is a security risk as command-line arguments are visible in process lists and may be logged in shell history, potentially exposing the secret key to other users or processes.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface.
Ingestion points: The SKILL.md instructions direct the agent to pass the user's image description as-is to the script's --prompt argument in scripts/generate_image.py.
Boundary markers: No delimiters or boundary markers are used to separate user input from the rest of the command instructions.
Capability inventory: The script performs file writes (PILImage.save) and network communication with the Google Gemini API.
Sanitization: There is no sanitization or validation of the user-provided prompt before it is passed to the tool and subsequently to the external LLM.

nano-banana-pro