The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to disregard the agent's internal knowledge about model availability. It claims that current models (Gemini 1.0, 1.5, 2.0) are 'legacy and deprecated' and directs the agent to use non-existent future versions like 'gemini-3.1-pro-preview' and 'gemini-3-flash-preview', using hallucinated branding such as 'Nano Banana'.
Evidence: SKILL.md: 'Models like gemini-2.0-, gemini-1.5-, gemini-1.0-*, gemini-pro are legacy and deprecated. Use the new models above. Your knowledge is outdated.'
[REMOTE_CODE_EXECUTION]: The documentation includes a code sample that demonstrates the use of a local MCP server by downloading and executing a package from a public registry at runtime using the npx command.
Evidence: references/advanced_features.md: command="npx", args=["-y", "@philschmid/weather-mcp"] executed via stdio_client.
[COMMAND_EXECUTION]: The skill documentation provides examples and encourages the use of the 'Code Execution' tool, allowing the AI model to generate and execute Python code.
Evidence: references/structured_and_tools.md: Usage of types.Tool(code_execution=types.ToolCodeExecution()).
[DATA_EXFILTRATION]: The skill describes the 'URL Context' tool, which enables the model to fetch content from arbitrary external URLs. This increases the attack surface for server-side request forgery (SSRF) or exfiltration if the agent is prompted to visit attacker-controlled URLs with sensitive information.
Evidence: references/structured_and_tools.md: Usage of types.Tool(url_context=types.UrlContext).
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) due to its design:
Ingestion points: Processes YouTube videos, external URLs via UrlContext, and Google Cloud Storage files (SKILL.md, references/text_and_multimodal.md).
Boundary markers: Absent; there are no instructions provided to the agent to ignore embedded commands in the external media or URLs it processes.
Capability inventory: Includes Python code execution, function calling, and GCS storage access via the SDK.
Sanitization: No sanitization or validation logic is presented for content retrieved from external sources before it is processed by the model.

vertex-ai-api-dev