The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructions direct the agent to read sensitive configuration files, specifically 'D:\myproject.agents.env' for API keys and the agent's own Model Context Protocol (MCP) configuration at '~/.gemini/config/mcp_config.json'. Accessing these files can expose project credentials and system-wide service configurations.
[COMMAND_EXECUTION]: The skill relies on the execution of a Python script located at 'D:\myproject\tools\openrouter_worker.py'. This script is not provided within the skill package, creating an unverified execution boundary where the agent is instructed to run external code with unknown logic.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process data and code generated by external third-party LLMs (OpenRouter free tier). This introduces an indirect prompt injection surface where malicious instructions could be embedded in the external model's response to manipulate the agent's subsequent actions.
Ingestion points: Responses from OpenRouter free-tier models fetched via the local worker script or MCP tool.
Boundary markers: The skill lacks formal technical delimiters in its prompt templates, though it includes high-level textual instructions for the agent to treat external output as untrusted.
Capability inventory: The skill is granted high-privilege access to 'execute_command', 'read_file', and 'write_file'.
Sanitization: Instructions suggest manual review and sandboxing of generated code, but there is no automated sanitization for the data processed by the agent.

openrouter-task