The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses uv to manage its environment and dependencies. It specifically requires google-genai and pillow. These are well-known, standard libraries for interacting with Google's AI services and performing image processing, respectively.
[COMMAND_EXECUTION]: The SKILL.md file provides commands to run a local Python script (generate_image.py) using uv run. This is the intended and documented primary function of the skill to facilitate image generation via the command line.
[CREDENTIALS_UNSAFE]: The skill requires a GEMINI_API_KEY. It correctly advises users to provide this via environment variables or a configuration file. The Python script includes a --api-key argument for convenience but does not hardcode any secrets. This is a standard and safe approach for handling API credentials.
[DATA_EXFILTRATION]: The script sends image prompts and optional local input images to Google's Gemini API endpoints (google-genai library). This network activity is necessary for the skill's stated purpose of image generation and uses a well-known service (Google). There is no evidence of data being sent to unauthorized or suspicious third-party domains.
[PROMPT_INJECTION]: The SKILL.md includes a note: '不要读取生成的图像内容，只需报告保存路径即可' (Do not read the generated image content, just report the save path). This is a functional instruction to the agent to manage its output behavior and does not represent a malicious attempt to bypass safety filters or override system instructions.

nano-banana-pro