gemini-cli

SUSPICIOUS: the core Gemini CLI use is broadly consistent with the stated purpose and appears to rely on official Google tooling, but the skill expands trust to GitHub-installed extensions, a community `npx` viewer, and local hook scripts while encouraging `--yolo` auto-approved execution. This is not confirmed malware, but it is a medium-risk orchestration skill with notable supply-chain and autonomy concerns.