The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from multiple external sources, which creates a vulnerability surface for indirect prompt injection.
Ingestion points: The skill uses fs.readFileSync for local images and PDFs, ai.files.upload for large media files, and createPartFromUri for external URLs (in examples/multimodal.md), as well as the built-in googleSearch tool (in examples/tools.md).
Boundary markers: Although inputs are structured using SDK-specific objects (Part, Content, inlineData), the examples do not include explicit boundary markers or instructions to the model to ignore embedded commands within the processed data.
Capability inventory: The agent is granted capabilities to perform network searches (googleSearch), execute code via the Gemini API (codeExecution), and manage files, which could be exploited if a malicious payload is processed.
Sanitization: The skill promotes the use of Zod for structured output validation, but lacks equivalent guidance for sanitizing or escaping external inputs before passing them to the model.
[PROMPT_INJECTION]: In examples/advanced.md, the documentation explains how to set safetySettings thresholds to BLOCK_NONE. While this is a legitimate configuration for backend analysis and is accompanied by a caution for user-facing applications, instructions to disable safety filters are a known pattern for overriding AI behavior constraints.
[EXTERNAL_DOWNLOADS]: The skill documentation references several external Node.js packages, including the official @google/genai SDK and data validation libraries like zod. These references are standard for the skill's purpose and involve well-known, trusted organizations.

ai-provider-google-gemini-sdk