The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to download and install an extension from an unverified GitHub repository: https://github.com/gemini-cli-extensions/code-review.
[REMOTE_CODE_EXECUTION]: The command gemini extensions install [URL] downloads and executes third-party code at runtime from a source that is not recognized as a trusted organization or well-known service.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) by interpolating untrusted data (git diffs) directly into LLM prompts without sanitization or boundary markers.
Ingestion points: Git diff output stored in diff.txt and read via $(cat diff.txt) in the CLI prompt.
Boundary markers: Absent; the diff content is concatenated directly into the prompt string.
Capability inventory: The agent can execute shell commands, perform network operations via the Gemini CLI, and modify repository content.
Sanitization: None; the raw content of the diff is passed directly to the model.
[COMMAND_EXECUTION]: The skill provides instructions to modify shell configuration files (~/.zshrc) to persist environment variables. While intended for authentication, modifying shell profiles is a common persistence mechanism pattern.

gemini-review