The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions explicitly direct the agent to read config/secrets.md to retrieve an API Key, which is a sensitive file path used for credential storage.
[DATA_EXFILTRATION]: The retrieved credentials are sent to an external, non-whitelisted domain (https://api.apicore.ai/v1/images/generations) via a POST request. This pattern of reading a local secret and transmitting it over the network is a primary indicator of data exfiltration.
[COMMAND_EXECUTION]: The skill utilizes the curl shell command to perform its primary function, which introduces risks if user-controlled variables are included in the command string.
[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface through the following evidence chain:
Ingestion points: User-provided text prompts and image URLs are ingested at runtime (file: SKILL.md).
Boundary markers: There are no delimiters or 'ignore' instructions used to wrap the untrusted user data.
Capability inventory: The skill uses curl to execute network operations.
Sanitization: There is no evidence of validation or escaping for the user-provided data before it is interpolated into the JSON payload of the curl command.

space-gemini-image