The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of standard Python packages such as requests, pydantic, and google-generativeai. These are well-known libraries from official registries.
[COMMAND_EXECUTION]: Documentation includes standard shell commands for package management (uv pip install) and local file operations within the /mnt/project and /mnt/user-data directories. These actions are within the expected scope of the skill's functionality.
[DATA_EXFILTRATION]: The skill transmits user prompts and media files to Cloudflare AI Gateway (gateway.ai.cloudflare.com). As Cloudflare is a well-known service provider, this network activity is considered a standard operational requirement for the skill's primary purpose. The skill also manages API credentials by reading them from local configuration files (proxy.env, GOOGLE_API_KEY.txt), which is consistent with standard agent secret management practices.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for processing external data—such as images, PDF text, and CSV files—which are then interpolated into prompts sent to the Gemini API. While this creates a surface for indirect prompt injection, it is the fundamental purpose of a multi-modal AI client.

invoking-gemini