The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents multiple ingestion points for untrusted external data which could contain malicious instructions.
Ingestion points: Network fetches using requests.get() in SKILL.md, large file uploads via client.files.upload() in references/files-and-media.md, and managed RAG indexing through file_search_stores.upload_to_file_search_store() in references/embeddings-and-rag.md.
Capability inventory: The skill facilitates network access (fetching URLs), file system interaction (reading/writing media), and browser automation (clicks, keystrokes) through the "Computer Use" feature. It also documents "Deep Research" agents capable of background autonomous tasks.
Boundary markers: Code examples demonstrate passing raw external content (image bytes, PDF parts) directly to the model without explicit delimiters or instructions to ignore embedded commands.
Sanitization: There is no documentation regarding the sanitization or verification of external files or URL content before processing.
[COMMAND_EXECUTION]: The skill describes the "Computer Use" tool which allows an agent to generate browser actions such as click_at, type_text_at, and key_press. This capability allows model-driven interaction with the user's environment, which is a high-impact surface if the model is influenced by malicious injected content.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various SDKs and libraries (e.g., google-genai, crewai, langchain-google-genai). These appear to be official vendor resources or established ecosystem libraries associated with the documented services.

gemini-api-2026