The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates untrusted data from user instructions and text labels directly into the prompt template sent to the Gemini model.
Ingestion points: The instruction and text arguments in scripts/annotate.py accept arbitrary user input.
Boundary markers: The prompt templates in refine_prompt and annotate_image do not use delimiters (e.g., XML tags or triple quotes) to isolate user-supplied instructions from the system's critical instructions.
Capability inventory: The skill possesses capabilities for reading local image files, writing files to the disk, and performing network operations via the Gemini API.
Sanitization: There is no evidence of sanitization, escaping, or validation of the user-provided strings before they are embedded into the prompt.

screenshot-annotator