The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/generate.py script reads the contents of files specified in command-line arguments and transmits them to generativelanguage.googleapis.com. This creates a risk for exfiltration of sensitive local data if the agent is directed to use system files or credentials as prompt inputs or reference images.
[COMMAND_EXECUTION]: The skill fails to validate the --output-file path, allowing the script to write or overwrite files at arbitrary locations on the filesystem. This could be exploited to disrupt system stability or establish persistence by overwriting shell profiles or other configuration files.
[PROMPT_INJECTION]: Directives such as 'Do NOT read the python file' and 'You don't need to check the folder under /mnt/user-data' function as concealment patterns that discourage the agent from inspecting its implementation and local environment, potentially masking unauthorized activities.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion points: User requests and reference image file paths. 2. Boundary markers: None. 3. Capability inventory: File read, file write, and network POST operations within scripts/generate.py. 4. Sanitization: No sanitization or validation of input content before processing and transmission to an external LLM.

image-generation