The Agent Skills Directory

[SAFE]: The skill uses global commands gemini and codex installed from standard package registries (@google/gemini-cli via npm, codex via Homebrew). All paths, such as package downloads or configuration instructions, point to official ecosystem links (e.g., Google AI Studio, standard npm packages). No unversioned or untrusted third-party dependencies are present.
[SAFE]: Arguments, instruction variables, and code streams are cleanly separated by piping payloads through safe file streams (< "$CODEFILE") rather than passing arbitrary text strings into an shell-evaluator function, mitigating command injection vulnerabilities.
[SAFE]: Temporary files created in the global directory /tmp are locked down directly using chmod 600 immediately following allocation, shielding them from unauthorized local visibility.
[SAFE]: The project follows standard practice by explicitly instructing users to hold credentials in an environmental variable (GEMINI_API_KEY) or via standard configuration file mappings rather than leaking hardcoded access credentials.

ai-review