The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides a 'Probing recipe' that explicitly instructs the agent to source credentials from the ~/.api_tokens file. While presented as a security best practice to avoid command-line exposure of keys, it involves the agent accessing sensitive files containing API tokens.
[DATA_EXFILTRATION]: The debugging instructions describe a pattern using Bash and curl to send the retrieved API key to a variable URL ($URL). If the agent is instructed to perform this probe with an untrusted destination, it could lead to the exfiltration of the Gemini API key.
[INDIRECT_PROMPT_INJECTION]: The skill describes a mechanism where delivery directives (tts_style) and inline speech tags (e.g., [whispers], [excited]) are interpolated into the planner's prompt and interpreted by the model. This represents an indirect prompt injection surface if untrusted data is included in the speech queue.
Ingestion points: User-provided utterances, persona-specific tts_style directives, and inline delivery tags described in SKILL.md.
Boundary markers: The skill notes that style directives are prefixed as "<style>: <text>".
Capability inventory: The skill allows the use of Bash and WebFetch for API calls and debugging probes; it also describes the underlying C-based TTS processing pipeline.
Sanitization: The skill identifies a whitelist filter (SPEECH_TAG_ALLOWED) used to restrict allowed speech tags, which helps mitigate the risk of the model reading out unintended stage directions.

gemini-tts-voice