The Agent Skills Directory

[SAFE]: The skill operates strictly as a code-generation assistant, producing Python scripts and documentation rather than executing live API calls or shell commands. This design inherently mitigates risks associated with direct resource access.
[CREDENTIALS_UNSAFE]: Security best practices are followed for authentication. The skill explicitly instructs users to load API keys via environment variables (e.g., os.environ["GEMINI_API_KEY"]) and provides guidance on using .env files combined with .gitignore to prevent secret leakage. No hardcoded credentials or placeholders that could lead to exposure were found.
[COMMAND_EXECUTION]: While the skill generates Python code and shell command examples for user execution (e.g., pip install google-genai), these are delivered as static text for documentation purposes. The skill does not use dynamic execution tools or attempt to run shell commands autonomously.
[PROMPT_INJECTION]: The instructions include robust safety guardrails, warning the agent against bypassing content safety filters or generating copyrighted characters. No patterns indicative of system prompt extraction or safety override attempts were detected.
[EXTERNAL_DOWNLOADS]: Dependencies mentioned in the documentation (such as google-genai, pillow, and realesrgan) are standard, well-known libraries for AI development and image processing. There are no instructions for downloading or executing untrusted remote scripts.
[DATA_EXFILTRATION]: The skill does not contain logic to access sensitive local files or transmit data to external domains. Its behavior is consistent with its stated purpose of assisting in API integration.

sketch