The Agent Skills Directory

[PERSISTENCE]: The skill instructions direct the agent to modify the user's shell profile files (~/.zshrc or ~/.bashrc) to store the GEMINI_API_KEY environment variable permanently.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted article content from both pasted text and external URLs to generate prompts for image generation.
Ingestion points: The skill accepts article copy as pasted text or fetches content from a provided URL in SKILL.md (Step 1).
Boundary markers: The instructions do not specify any delimiters or safety markers when interpolating untrusted article data into the internal summary or the image generation prompts.
Capability inventory: The skill allows the agent to create and execute a local Python script (generate_image.py), write image files to the local filesystem (./thumbnails/), and perform network requests to the Gemini API.
Sanitization: There is no mention of sanitizing, validating, or filtering the content fetched from external URLs before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill provides a template for a Python script (generate_image.py) that the agent is expected to write to the local filesystem and execute at runtime with dynamically generated parameters.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to verify the environment, check for script presence, install dependencies, and run the image generation process.
[EXTERNAL_DOWNLOADS]: The skill requests the installation of external Python dependencies, including google-generativeai, Pillow, and requests. These are well-known packages from a trusted vendor context.

thumbnail-creator