The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the belt CLI tool for image generation and application management. The allowed-tools configuration in the frontmatter correctly limits the agent to the belt command, which adheres to the principle of least privilege.
[EXTERNAL_DOWNLOADS]: The skill references the inference.sh platform and its associated tooling, including the belt-sh/cli package and the inferencesh Python SDK. These are legitimate dependencies required for the skill to communicate with the image generation service.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and image URLs, which represents a standard surface for indirect prompt injection.
Ingestion points: User input is interpolated into the --input JSON payload of the belt app run command (file: SKILL.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided within the command templates.
Capability inventory: The agent is restricted to executing the belt CLI tool.
Sanitization: The skill uses a structured JSON format to pass user input to the CLI, which helps separate data from the command execution context.

nano-banana-2