The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly mandates the use of the --yolo flag for all tool invocations (e.g., gemini --yolo "/generate 'prompt'"). As documented in the skill's instructions, this flag is designed to "Auto-approve all tool actions (no confirmation prompts)," effectively removing the user from the decision-making loop and allowing the agent to execute commands without oversight.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to download and install the nanobanana extension from an external, untrusted GitHub repository (https://github.com/gemini-cli-extensions/nanobanana) if it is not already present on the system.
[REMOTE_CODE_EXECUTION]: By combining the installation of external extensions from untrusted sources with the mandatory bypass of user confirmation prompts (--yolo), the skill creates a high-risk environment where unverified third-party code can be executed with minimal friction or visibility to the user.
[INDIRECT_PROMPT_INJECTION]: The skill accepts natural language prompts from the user and interpolates them directly into shell commands for the gemini tool (e.g., /generate 'prompt'). While single quotes are used as delimiters, there is no explicit instruction for the agent to sanitize or escape these inputs, potentially allowing for command injection if the underlying tool does not handle special characters safely.
Ingestion points: User-provided image descriptions and instructions in SKILL.md.
Boundary markers: Prompts are enclosed in single quotes within the bash commands.
Capability inventory: The skill uses Bash(gemini:*) to execute code, generate files, and interact with the filesystem.
Sanitization: No sanitization or validation logic is defined within the skill instructions.

nano-banana