The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is built around executing a series of bash commands via the camofox CLI to automate complex browser workflows on Google Gemini.
[CREDENTIALS_UNSAFE]: The skill's authentication flow (Step 3.2) explicitly instructs the agent or user to pass sensitive credentials, including Google account passwords, directly as plaintext arguments in CLI commands (e.g., camofox type e2 "password"). This practice exposes credentials to shell history, process monitors, and system logs.
[COMMAND_EXECUTION]: The skill provides a fallback mechanism using camofox eval to execute arbitrary JavaScript code within the browser context. This allows for dynamic code execution that could bypass standard safety boundaries if the input prompt is manipulated.
[DATA_EXFILTRATION]: The skill uses curl to retrieve generated images from a local API endpoint (http://localhost:9377). While targeting localhost, the use of network tools to move data between the automation environment and the local filesystem is a monitored pattern.

gemini-image