The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to source a sensitive credentials file located at ~/.api_tokens to obtain the GEMINI_API_KEY. Sourcing private token files is a high-risk activity that exposes secrets to the agent's execution environment.\n- [DATA_EXFILTRATION]: The 'Probing recipe' section describes a sequence of commands that reads a secret key and transmits it as an HTTP header (x-goog-api-key) via curl to a variable $URL. Because the destination URL is not restricted to a trusted domain in the example, this pattern enables the exfiltration of sensitive credentials if the agent is directed to a malicious endpoint.\n- [COMMAND_EXECUTION]: The skill provides functional shell commands for execution via the Bash tool. These commands involve environment variable manipulation and network operations with sensitive authentication tokens, which can be intercepted or logged in insecure environments.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes a mechanism where bracketed tags (e.g., [whispers], [laughs]) are processed directly from generated text. This creates an attack surface where maliciously crafted data could influence agent behavior or speech rendering.\n
Ingestion points: Data enters the context via the model's generated content in gemini_backend.c and is processed in the transcript path.\n
Boundary markers: The skill mentions filtering tags against a specific allow-list (SPEECH_TAG_ALLOWED) in speech_queue_post(), which serves as a partial mitigation.\n
Capability inventory: The skill uses Bash and WebFetch tools to interact with external APIs and local files.\n
Sanitization: Filtering is described to prevent unrecognised bracketed runs from being read aloud by the TTS engine.

gemini-tts-voice