The Agent Skills Directory

Command Execution: The skill provides standard command-line examples for setting up the Google Cloud environment.
It uses gcloud for authentication (gcloud auth application-default login) and enabling services (gcloud services enable aiplatform.googleapis.com).
It includes instructions for telemetry attribution using the CLOUDSDK_METRICS_REQUEST_ATTRIBUTION environment variable, which is a common practice for identifying skill usage without collecting user data.
External Downloads: The skill references official Google libraries for Python and JavaScript.
It recommends using google-genai and @google/genai (version 2.3.0 or higher), which are official SDKs provided by the vendor.
Indirect Prompt Injection: As a tool for facilitating LLM interactions, the skill handles untrusted data which presents a minor surface for indirect instructions.
Ingestion points: Data enters the flow via the input parameter in interactions.create calls within SKILL.md.
Boundary markers: The instructions do not specify explicit delimiters for user input, though standard SDK usage is documented.
Capability inventory: The skill documentation focuses on API communication and does not include scripts that perform local file system operations or execute arbitrary subprocesses based on API responses.
Sanitization: Standard API handling is used; specific input sanitization for prompts is left to the developer implementing the SDK.
Credential Handling: The skill uses safe practices for secret management.
It demonstrates the use of placeholders like YOUR_API_KEY and recommends the use of environment variables for project configuration, which is consistent with security best practices.

gemini-interactions-api