The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The main documentation in SKILL.md provides instructions for installing the Genkit CLI using a piped shell script (curl -sL cli.genkit.dev | bash). While this targets an official Google Genkit domain, the pattern of executing remote scripts directly in the shell is a high-risk installation method.
[COMMAND_EXECUTION]: The Model Context Protocol (MCP) documentation in references/genkit_mcp.md describes how to configure and run external servers and tools using shell commands (e.g., npx). This capability allows the agent to spawn arbitrary processes if configured to do so.
[DATA_EXFILTRATION]: The references/genkit_middleware.md file documents a FilesystemPlugin that provides the agent with tools to list_files, read_file, write_file, and search_and_replace within a specified directory. These tools grant the agent extensive file system access.
[PROMPT_INJECTION]: The skill documentation establishes a broad surface area for indirect prompt injection by demonstrating how to ingest and process data from various external sources (tools, flows, and MCP servers) without explicit sanitization guidelines.
Ingestion points: Untrusted data enters the agent context via ai.generate prompts, flow inputs, and responses from external tools as described in references/genkit.md.
Boundary markers: The provided code snippets do not include instructions for using delimiters or boundary markers to isolate untrusted content from system instructions.
Capability inventory: The skill leverages high-privilege capabilities including filesystem manipulation (references/genkit_middleware.md), network requests to remote flow endpoints (references/genkit.md), and process execution through MCP (references/genkit_mcp.md).
Sanitization: There is no evidence of input validation or output escaping in the documented implementation patterns.

developing-genkit-dart