The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the vllm package from PyPI and the vllm/vllm-openai image from Docker Hub, which are well-known and established services.
[EXTERNAL_DOWNLOADS]: Fetches pre-trained Vision-Language Model (VLM) weights from HuggingFace, a standard repository for AI models.
[COMMAND_EXECUTION]: Instructs the user to execute the auto_label CLI tool for pipeline processing and provides commands for setting up a vLLM server using docker run or vllm serve.
[CREDENTIALS_UNSAFE]: The skill handles sensitive credentials including GOOGLE_API_KEY and HF_TOKEN. It correctly follows security best practices by advising users to manage these via environment variables rather than hardcoding them in configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input data from input_jsonl (captions) which is then interpolated into prompts for the VLM.
Ingestion points: Captions and image paths are read from a user-supplied JSONL file (SKILL.md).
Boundary markers: The instructions describe Step 0 as 'cleaning' the caption, which may provide some implicit normalization.
Capability inventory: The skill uses auto_label (CLI), docker, and pip for setup and execution (references/vllm_server.md, references/skill_info.yaml).
Sanitization: No explicit sanitization or escaping of the input captions is documented before they are sent to the VLM endpoint.

tao-generate-image-grounding