The Agent Skills Directory

**Category 2
Data Exposure & Arbitrary File Write (HIGH):** The skill provides unrestricted access to the local filesystem.
Evidence: In scripts/generate_image.py, the --input-image argument is passed directly to PILImage.open(args.input_image). An attacker could trick the agent into reading sensitive files (e.g., ~/.ssh/id_rsa) and sending them to the external API.
Evidence: The --filename argument is used in output_path.parent.mkdir(parents=True, exist_ok=True) and image.save(str(output_path), 'PNG') without path validation or sandboxing. This allows an attacker to overwrite critical files like ~/.bashrc or ~/.ssh/authorized_keys with image data, leading to denial of service or potential persistence.
**Category 8
Indirect Prompt Injection (HIGH):** The skill creates a high-privilege attack surface by combining external data ingestion with file-system write capabilities.
Ingestion points: Untrusted data enters via args.input_image (local file content) and args.prompt (external text instructions) in scripts/generate_image.py.
Boundary markers: None. There are no delimiters or instructions to the model to ignore embedded commands in the input data.
Capability inventory: The skill possesses file-read (via PIL), file-write (via image save), and directory-creation capabilities.
Sanitization: No sanitization or path normalization is performed on any user-provided arguments before they are used in filesystem operations.
**Category 7
Metadata Poisoning (MEDIUM):** The skill uses misleading names like "Nano Banana Pro" and "Gemini 3 Pro Image" which do not correspond to official Google product names, potentially deceiving users about the nature or safety of the underlying model.

nano-banana-pro