The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions specifically designed to override the agent's internal knowledge and training. In SKILL.md, it explicitly commands the AI to ignore models like Gemini 1.5 or 2.0 as 'legacy' and treat its own internal training as 'outdated' in favor of fabricated Gemini 3.x models. This is a targeted knowledge-override injection.
[METADATA_POISONING]: The skill provides false information about Google Cloud's branding and model roadmap. It identifies 'Vertex AI' as a legacy name for a non-existent 'Gemini Enterprise Agent Platform' and lists fictitious models such as 'Nano Banana Pro' and 'Gemini 3.6'. This misinformation is designed to deceive the agent during code generation and planning.
[EXTERNAL_DOWNLOADS]: In references/advanced_features.md, the skill provides a code example that downloads and executes a third-party MCP server from the npm registry using 'npx -y @philschmid/weather-mcp'. This bypasses manual review of the package source.
[DYNAMIC_EXECUTION]: The skill documentation encourages the use of dynamic execution environments. This includes loading local MCP servers via StdioServerParameters in references/advanced_features.md and enabling the ToolCodeExecution feature in references/structured_and_tools.md, which allows the model to generate and run arbitrary Python code.
[INDIRECT_PROMPT_INJECTION]: The skill enables an extensive attack surface for indirect prompt injection by demonstrating features that ingest untrusted data, such as URL Context, YouTube video processing, and Google Cloud Storage bucket reads. These ingestion points lack instructions for sanitization or boundary markers to prevent the agent from obeying embedded malicious instructions.
[COMMAND_EXECUTION]: Examples in references/structured_and_tools.md promote the ToolCodeExecution capability, enabling the AI to perform complex operations via an internal Python interpreter, which effectively allows for the execution of model-generated logic at runtime.

gemini-api