The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to construct shell commands by interpolating raw user prompts directly into a command string. If a user provides a prompt containing shell metacharacters (e.g., "; touch /tmp/pwned; "), it could lead to arbitrary command execution on the host system depending on the agent's internal shell handling.
Evidence: uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py --prompt "<draft prompt>" and similar templates.
[COMMAND_EXECUTION]: The scripts/generate_image.py script allows for potential arbitrary file writes by using a user-supplied filename to define the output path without validation or sanitization.
Evidence: output_path = Path(args.filename) followed by output_path.parent.mkdir(parents=True, exist_ok=True) and image.save(str(output_path), 'PNG').
Risk: A malicious prompt or manipulated argument could use directory traversal sequences (e.g., ../../.bashrc) to overwrite existing files, although the impact is limited to binary image data corruption.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data to generate images via a remote API, creating a surface for indirect prompt injection attacks.
Ingestion points: User prompts are passed via the --prompt argument in SKILL.md and processed by scripts/generate_image.py.
Boundary markers: The instructions lack explicit safety delimiters or "ignore embedded instructions" warnings for the agent when processing external content.
Capability inventory: The skill possesses file-write capabilities (via pillow) and network access (via google-genai).
Sanitization: There is no sanitization, escaping, or validation performed on the user prompt before it is sent to the Gemini API.

nano-banana-pro