The Agent Skills Directory

[PERSISTENCE]: The references/integration-guide.md file contains instructions for users to persist their GEMINI_API_KEY by appending export statements to shell profile files such as ~/.zshrc and ~/.bashrc. Instructing an agent or user to modify startup scripts to maintain credentials across sessions is a recognized persistence pattern.
[INDIRECT_PROMPT_INJECTION]: The skill implements a context mining feature in SKILL.md (Phase 1) that reads data from various project files to inform its prompt enhancement logic. This creates a potential surface where malicious content within those files could influence the agent's behavior during image generation.
Ingestion points: Phase 1 reads README.md, package.json, pyproject.toml, and searches for patterns in *.css, *.ts, and *.json files.
Boundary markers: Absent; project content is interpolated directly into the prompt enhancement process.
Capability inventory: The skill uses the Bash tool for local analysis and performs network requests to the Gemini API through the generate.py script, which also writes output files to the filesystem.
Sanitization: No explicit sanitization or filtering of the mined context data is mentioned.
[COMMAND_EXECUTION]: The SKILL.md instructions utilize the Bash tool to perform environment validation (checking for API keys and tooling versions) and project structure analysis (using ls, head, find, and grep).
[EXTERNAL_DOWNLOADS]: The skill's integration guide and generation script reference the google-genai Python library and official Google API endpoints (generativelanguage.googleapis.com). These references target a well-known and trusted service provider.

nanobanana