gemini-research
Warn
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill's 'Library-First Protocol' mandates that the agent check 'D:\Projects*' for existing code to 'EXTRACT and adapt'. This represents an overly broad file access instruction that could lead to the unauthorized exposure of sensitive source code, configuration files, or credentials stored in unrelated project directories on the local machine.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests research output from Gemini, which is explicitly grounded in external Google Search data. This untrusted content is stored in Memory-MCP and later retrieved by other agents to 'inform implementation'. The absence of boundary markers or sanitization logic in the handoff process creates a risk where malicious content embedded in web search results could influence the agent's code implementation phase. (Ingestion: Gemini search results; Boundaries: None; Capabilities: Bash, Read, Write, WebFetch; Sanitization: None).
- [COMMAND_EXECUTION]: The skill executes a local shell script ('scripts/multi-model/gemini-research.sh') using a user-supplied query string as a direct argument. This pattern creates a risk of command injection if the script does not properly sanitize the input variable before execution.
- [PROMPT_INJECTION]: The skill uses high-pressure imperative language ('LIBRARY-FIRST PROTOCOL (MANDATORY)', 'YOU MUST') to define a behavioral override, compelling the agent to perform specific local file system operations before completing the requested task.
Audit Metadata