The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is configured with a restricted environment via the allowed-tools frontmatter, limiting shell execution specifically to the belt command (Bash(belt *)). This follows the principle of least privilege by preventing the execution of arbitrary system commands.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external components, specifically the belt-sh/cli and inference-sh/skills packages using the npx skills add command. It also references installation documentation and image assets hosted on official inference.sh domains and their associated GitHub repository.
[INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it ingests user-provided text prompts and external image URLs (e.g., in image editing workflows) which are then processed by the Gemini models.
Ingestion points: The prompt and images parameters within the JSON payloads passed to the belt CLI.
Boundary markers: No explicit delimiters are used in the instruction set to separate user data from system instructions.
Capability inventory: The skill can execute the belt CLI tool to interact with remote AI models and potentially fetch external images via URL.
Sanitization: Input validation and safety filtering are handled by the underlying inference.sh platform and Google Gemini models rather than the skill's local instructions.

nano-banana