The Agent Skills Directory

[PROMPT_INJECTION]: The script scripts/recreate_thumbnails.py directly interpolates user-supplied strings from the --prompt argument into the instructions sent to the Gemini model. The absence of boundary markers or input validation creates a surface where the primary task could be overridden by malicious instruction strings.\n- [EXTERNAL_DOWNLOADS]: The skill fetches image assets from img.youtube.com and user-provided remote URLs using the requests library. These network operations are intrinsic to the tool's documented functionality and target well-known services.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the content of processed images (e.g., text within thumbnails).\n
Ingestion points: scripts/recreate_thumbnails.py via the get_youtube_thumbnail and download_image functions.\n
Boundary markers: None; external images and user prompts are passed as a continuous stream of content to the model.\n
Capability inventory: File system writes to .tmp/thumbnails/ and API requests to the Google GenAI service.\n
Sanitization: No sanitization or content filtering is applied to user prompts or the visual data processed by the vision model.

recreate-thumbnails