The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted content from various search providers, including text snippets and image metadata. This information is merged into the agent's context, creating a potential surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters via curl search responses in SKILL.md (Step 5) and metadata processed in scripts/generate_nano_banana.py.
Boundary markers: The skill structures the search output into a search_results.json file, which helps separate data from instructions.
Capability inventory: The skill possesses extensive capabilities, including executing shell commands (curl, python3), writing/editing files, and performing network requests.
Sanitization: The skill mitigates risks by stripping HTML tags from snippets in Step 6a and truncating them. It also uses Python's urllib.parse.quote and json.dumps to ensure user input is safely encoded before being used in shell commands.
[DYNAMIC_EXECUTION]: The skill uses a bash script (documented in providers.md) to locate and source .env files from the project tree. While this is a standard method for loading API keys and configuration, the source command executes any shell code present in the file.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to download results and images from established services such as Google (via Serper/SerpAPI), Tavily, and Brave Search. These operations are required for the skill's core functionality.
[COMMAND_EXECUTION]: The skill executes shell commands using curl and python3. It demonstrates good security posture by explicitly sanitizing user-provided query strings using dedicated Python encoding functions to prevent command injection.

web-search