The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses unquoted Bash heredocs (cat << JSONEOF) to construct JSON payloads. This configuration allows for shell variable expansion and command substitution. If the EDIT_PROMPT variable contains characters like backticks or $(...), the shell will execute those commands on the host machine during file creation.
[COMMAND_EXECUTION]: The skill uses python3 -c to execute dynamically generated Python code snippets for processing JSON responses and writing files.
[CREDENTIALS_UNSAFE]: The setup instructions direct the user to export the GEMINI_API_KEY in shell profiles such as ~/.bashrc or ~/.zshrc. This practice places long-lived credentials in plaintext files that are common targets for credential harvesting.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of several external packages (google-genai, pillow, and @google/genai) from public package registries and makes network requests to generativelanguage.googleapis.com.

image-generator