The Agent Skills Directory

[Secure Credential Handling]: The script follows standard security practices by retrieving the API key from the environment variable GEMINI_API_KEY rather than hardcoding sensitive credentials.
[Workspace Directory Restriction]: File operations are confined to a path determined by the --workspace argument, which helps prevent unauthorized file system access by scoping writes to an intended directory.
[Network Operation Context]: The skill performs network requests to the official Google Generative AI API (google-genai). These operations are consistent with the skill's primary function of generating music via an external model.
[Limited Capability Scope]: The skill uses a set of predefined prompts for music generation and does not interpolate untrusted user input into the generation prompt, reducing the surface for prompt injection or unexpected model behavior.

music-generation