The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web using tools like read_url_content and browser_subagent to learn about technologies. It lacks boundary markers or instructions to ignore embedded commands within the scraped documentation, making it susceptible to malicious instructions that could influence the generated skill's behavior. Ingestion points include any URL identified during web search. Capability inventory includes the ability to write executable scripts to the filesystem. Sanitization is limited to filtering for relevant documentation sections, which does not prevent prompt injection attacks.
[DYNAMIC_EXECUTION]: The skill generates new code for the scripts/ directory of the created skill based on synthesized information from the web. This results in the creation of executable Python or Bash scripts derived from potentially untrusted external sources, intended for later execution.
[PERSISTENCE]: The skill saves generated output to .agent/skills/ or ~/.gemini/antigravity/skills/. As noted in the documentation, these skills 'auto-trigger' in future sessions, providing a way for potentially malicious generated content to persist on the host system and influence future agent behavior.
[COMMAND_EXECUTION]: The skill uses the write_to_file tool to save generated scripts to executable paths on the local filesystem.

self-learning