The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill encourages the agent to ingest tasks from project-specific documents like image manifests or prompt lists. These documents serve as an untrusted input surface. An attacker could craft a manifest containing malicious file paths for the --input-image argument, leading the agent to use the provided script to read and transmit sensitive local data.\n
Ingestion points: The agent is instructed in SKILL.md to check "prompts document or image manifest" files within the project for pending work.\n
Boundary markers: The skill does not provide delimiters or instructions for the agent to ignore potentially malicious directives embedded within these project files.\n
Capability inventory: The generate_image.py script is capable of reading any file accessible to the process and uploading its base64-encoded content to the Google Gemini API.\n
Sanitization: The script performs no validation or sanitization on the file paths passed to the --input-image parameter.\n- [DATA_EXFILTRATION]: The generate_image.py script implements a broad search pattern for the GEMINI_API_KEY credential, reading .env files in multiple locations, including the user's home directory (~/.env) and all ancestor directories of both the script and the current working directory. While this is designed for ease of setup in symlinked environments, it grants the script wide-reaching access to potentially sensitive environment configurations without strict path limitations.

nano-banana