The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied scientific background text to construct prompts for image generation.
Ingestion points: Untrusted data enters the context through the background positional argument or --background-file in scripts/build_materials_figure_prompt.py, scripts/generate_image.py, and scripts/generate_image.js.
Boundary markers: The skill utilizes structured templates (e.g., in references/materials-science-figure-templates.json) to wrap user content, but it lacks explicit instructions for the model to ignore potential malicious directives embedded within the scientific text.
Capability inventory: The skill has the capability to execute subprocesses (via the provided scripts) and perform network operations to model provider endpoints.
Sanitization: There is no evidence of sanitization or escaping of the user-provided text before it is formatted into the prompt templates.
[DATA_EXFILTRATION]: The skill transmits prompt data and API keys to external endpoints.
Evidence: Both scripts/generate_image.py and scripts/generate_image.js perform network POST requests to the configured NANOBANANA_BASE_URL.
Controls: The scripts include a security mechanism (assert_endpoint_allowed) that prevents transmission to any host other than the official Google Gemini endpoint (generativelanguage.googleapis.com) unless the user explicitly enables third-party support via the NANOBANANA_ALLOW_THIRD_PARTY environment variable or the --allow-third-party CLI flag.
[COMMAND_EXECUTION]: The skill relies on the execution of multiple bundled Python and Node.js scripts to perform its core functions, including plotting and image generation.
Evidence: scripts/plot_publication_figure.py uses matplotlib and numpy to render plots from local JSON specifications, and scripts/generate_image.py interacts with remote APIs using urllib.

nanobanana-image-generation