The Agent Skills Directory

[COMMAND_EXECUTION]: The Bash script examples provided in SKILL.md (Step 2 and the Complete Example) utilize unquoted shell variables, specifically $EDIT_PROMPT, inside a heredoc block (cat > /tmp/gemini_request.json << JSONEOF). Because the JSONEOF delimiter is not quoted, the shell performs parameter expansion and command substitution on the content before writing it to the file. This allows for arbitrary shell command execution if the input prompt contains subshell syntax such as $(...) or backticks.
[PROMPT_INJECTION]: The skill displays a vulnerability to indirect prompt injection by processing external user input and interpolating it directly into system-level shell commands.
Ingestion points: User-supplied text in the EDIT_PROMPT variable and file paths in IMG_PATH within the documentation's code snippets.
Boundary markers: Although the data is placed into a JSON structure, it is processed via shell interpolation first, which lacks markers to prevent command injection.
Capability inventory: The workflow utilizes the Bash, Write, and WebFetch tools to execute the generated logic.
Sanitization: There is no evidence of escaping, validation, or sanitization of the user-provided variables before they are expanded in the shell environment.
[EXTERNAL_DOWNLOADS]: The skill documentation references and utilizes the official Google Gemini API at generativelanguage.googleapis.com and recommends standard libraries including google-genai, pillow, and @google/genai.
[DATA_EXFILTRATION]: The skill instructions describe a workflow that reads local image files, converts them to base64, and transmits them along with user prompts to Google's official API endpoints for image processing.

image-generator