The Agent Skills Directory

[SAFE]: The skill implements strong security boundaries for its image generation task.
[COMMAND_EXECUTION]: The skill uses a local Python script scripts/generate_image.py. Analysis shows this script only uses Python standard libraries (urllib, base64, json) and does not utilize subprocess, os.system, or eval for dynamic execution.
[DATA_EXFILTRATION]: Network activity is restricted to the official Google Gemini API endpoint (generativelanguage.googleapis.com). The implementation includes a custom HTTPRedirectHandler that explicitly rejects redirects, preventing potential data-leakage or SSRF attacks. Prompt sizes are capped at 32KiB and response sizes at 64MiB.
[CREDENTIALS_UNSAFE]: The skill correctly manages credentials by requiring the GEMINI_API_KEY to be provided via environment variables. It includes explicit warnings against pasting keys into shell history or logs.
[FILE_SYSTEM_ACCESS]: File operations use secure flags (os.O_EXCL, os.O_NOFOLLOW) and restrictive permissions (0o600). The script refuses to overwrite existing files or write to symlinks, and it strictly validates that output filenames end in .png and contain valid PNG headers before saving.

imagen