The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the web and Google Maps, creating a potential surface for indirect prompt injection. This is mitigated via explicit instructions for the agent to verify tool evidence, check citations, and disclose when verification is not possible. The script also requires successful retrieval status for URLs before processing content.\n- [EXTERNAL_DOWNLOADS]: The skill specifies dependencies on 'google-genai' and 'python-dotenv' from the official Python Package Index (PyPI). These are trusted, well-known libraries for interacting with Google APIs and managing environments. The use of 'uv run' provides a controlled execution context for these dependencies.\n- [DATA_EXPOSURE]: The skill implements strong protections for the 'GEMINI_API_KEY', including specific guidance against logging or printing the key. The grounding script includes automated logic to redact the API key from any exception messages sent to stderr to prevent accidental exposure.\n- [SAFE]: The skill implements proactive SSRF protection in the URL validation logic of 'scripts/google_genai_grounding.py'. It strictly enforces that user-provided URLs use http/https schemes, are publicly accessible, and do not target localhost or private IP addresses using the 'ipaddress' library to verify global reachability.

ground-with-google-genai