gemini-files-api
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the macOS
securitycommand to fetch API keys from the system keychain if they are not provided via environment variables. This is a local operation for secure credential management.\n- [EXTERNAL_DOWNLOADS]: Thescripts/bootstrap.shscript installs the@google/genailibrary from the npm registry usingnpm ci --ignore-scripts, which prevents the execution of potentially malicious scripts packaged with dependencies.\n- [DATA_EXFILTRATION]: The skill transmits local files to Google's Gemini API for processing. This behavior is the primary intended function of the tool and targets a well-known service provider.\n- [PROMPT_INJECTION]: The skill provides an interface for processing untrusted multimodal data which represents an indirect prompt injection surface.\n - Ingestion points:
scripts/gemini-mm.mjsaccepts local file paths via the--fileargument.\n - Boundary markers: The skill uses the official Google SDK's
createUserContentandcreatePartFromUrifunctions to structure the request, which helps separate the user prompt from the file content.\n - Capability inventory: Network access to Google Gemini API endpoints.\n
- Sanitization: No content filtering is performed by the skill; it relies on the downstream LLM's safety filters to manage malicious content within processed files.
Audit Metadata