The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/generate_image.py script allows for the reading and external transmission of arbitrary local files. The upload_image_to_replicate function accepts a file path, opens it in binary mode, and uploads it to Replicate's infrastructure. This provides a direct path for exfiltrating sensitive information such as environment variables (.env), SSH keys (~/.ssh/id_rsa), or cloud provider credentials (~/.aws/credentials) if an attacker can influence the agent's input.
[EXTERNAL_DOWNLOADS]: The skill is vulnerable to Server-Side Request Forgery (SSRF). The generation script uses the requests library to fetch content from user-provided URLs in the image_inputs parameter. This can be abused to make the agent scan internal networks, access metadata services, or retrieve data from restricted endpoints, which is then exfiltrated to the Replicate service.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection.
Ingestion points: User-provided text in the prompt and file paths/URLs in image_inputs within SKILL.md and scripts/generate_image.py.
Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions embedded within the user-supplied data.
Capability inventory: scripts/generate_image.py has the capability to read local files, write to the filesystem, and perform arbitrary network requests.
Sanitization: There is no evidence of sanitization or validation for prompts, URLs, or file paths before they are used in operations.
[COMMAND_EXECUTION]: The skill relies on the agent executing scripts/generate_image.py via the command line with arguments derived from natural language prompts. Without strict argument sanitization, this pattern presents a risk of command injection, where a crafted prompt could cause the agent to execute unintended shell commands alongside or instead of the intended script.

nanobanana-image-gen