The Agent Skills Directory

[PERSISTENCE]: The instructions in SKILL.md and README.md suggest that users or agents can add the GOOGLE_API_KEY to shell profiles such as ~/.bashrc or ~/.zshrc. While this is a standard method for persisting environment variables in development environments, it involves modifying system configuration files.
[EXTERNAL_DOWNLOADS]: The script scripts/scrape-insights-images.mjs is designed to download a curated set of reference images from the orbitant.com domain. These downloads are directed to the vendor's own infrastructure to support the skill's primary purpose of visual style calibration.
[COMMAND_EXECUTION]: The skill relies on the execution of bundled Node.js scripts (generate-image.mjs and scrape-insights-images.mjs) to perform its tasks. These scripts interact with the filesystem to read/write images and configurations, and use the network to call the Gemini API.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted user input (article topics and descriptions) which is then interpolated into prompts for the image generation model and subsequently used in shell command arguments.
Ingestion points: User-provided article content or image descriptions processed in SKILL.md.
Boundary markers: None explicitly defined in the prompt construction logic.
Capability inventory: File system writes (writeFile), directory creation (mkdir), and network requests via the Google GenAI SDK and fetch.
Sanitization: Relies on the agent to correctly format shell arguments and the API's internal safety filters to block malicious content.

orbitant-image-creation