The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs shell commands by interpolating variables like $FILES, $RANGE, and $REFS directly into strings executed via the bash tool. For example, the command construction gemini "... $REFS" relies on a file list generated by git diff. If a malicious actor introduces a file with shell metacharacters in its name (e.g., ; touch EXPLOITED ;), these could be executed when the agent processes the file list during a review or delegation task.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: Local file contents, git diffs, and git logs are ingested as context for the model via CLI arguments and the @./ reference syntax.
Boundary markers: The skill does not employ boundary markers or specific instructions to the model to treat the ingested data as untrusted or separate from valid user instructions.
Capability inventory: The gemini CLI is explicitly invoked with the --yolo flag for delegation tasks, which authorizes the model to write files and execute tools autonomously. This significantly increases the potential impact of successful prompt injection from the codebase.
Sanitization: No sanitization or validation of the ingested codebase content is performed before it is sent to the model.
[DATA_EXFILTRATION]: The skill transmits local project information—including source code, commit history, and directory structures—to Google's Gemini API as part of its analysis workflow. This behavior is consistent with the skill's stated purpose of utilizing external models for codebase tasks and targets a well-known service provider.

gemini-cli