The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for executing multiple shell commands including the gemini CLI, ps, pkill, kill, and timeout utility. These are used for model interaction and process management.
[INDIRECT_PROMPT_INJECTION]: The skill is specifically designed to ingest and analyze large amounts of untrusted external data, such as entire codebases or documentation sets.
Ingestion points: Untrusted data enters the context through the --include-directories flag and prompts directed at the Gemini model in SKILL.md and README.md.
Boundary markers: There are no boundary markers or instructions provided to the Gemini model to ignore embedded instructions within the codebase files.
Capability inventory: The skill encourages the use of the yolo approval mode, which allows the Gemini model to autonomously execute tools on the host system. The skill itself also utilizes pkill, kill, and ps for process management.
Sanitization: No sanitization or validation of the codebase content is performed before it is sent to the Gemini CLI for processing. This creates a risk where a malicious file in a repository could instruct the Gemini model to execute harmful tools without user confirmation.
[METADATA_POISONING]: The skill claims capabilities for 'Gemini 3 Pro' and performance metrics (e.g., 76.2% on SWE-bench) that may be deceptive or unverifiable relative to currently public model versions. This could lead users or agents to over-rely on the safety or reasoning capabilities of the underlying model.

gemini