The Agent Skills Directory

Data Exfiltration (HIGH): The script scripts/generate_image.py contains a function upload_image_to_replicate that accepts arbitrary file paths via the --image-input argument. It reads the contents of these files using open(image_path, "rb") and immediately uploads them to Replicate's servers using client.files.create(f). This allows for the exfiltration of sensitive files (e.g., SSH keys, credentials, or configuration files) from the environment where the agent is running.
External Downloads (LOW): The scripts/generate_image.py script uses the requests library to download content from arbitrary, user-supplied URLs in both the upload_image_to_replicate and generate_image functions. While intended for image processing, this can be used for Server-Side Request Forgery (SSRF) or downloading malicious payloads.
Indirect Prompt Injection (LOW): The skill possesses a surface for indirect prompt injection (Category 8).
Ingestion points: User-provided text prompts and image URLs processed in scripts/generate_image.py.
Boundary markers: None identified; input is passed directly to the model API.
Capability inventory: The script has the capability to read local files and perform network operations (upload/download).
Sanitization: No sanitization or validation of input paths or URLs is performed before processing.

nanobanana-image-gen