claude-use-gemini-acp

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the @google/gemini-cli package from Google's official registry using pnpm dlx at runtime.\n- [COMMAND_EXECUTION]: Spawns a subprocess to execute the Gemini CLI tool within the gemini-delegate.mjs script.\n- [REMOTE_CODE_EXECUTION]: Uses the pnpm dlx command to dynamically download and run external code from a well-known vendor.\n- [PROMPT_INJECTION]: The skill processes untrusted prompt data and passes it to an external model with autonomous capabilities, representing an indirect prompt injection surface.\n
  • Ingestion points: Prompt text is ingested via command-line arguments in gemini-delegate.mjs.\n
  • Boundary markers: None; the prompt is passed to the subprocess without delimiters or isolation instructions.\n
  • Capability inventory: The Gemini CLI is invoked with the --yolo flag, which enables autonomous tool-execution (such as filesystem access) within the session.\n
  • Sanitization: The skill performs no validation, escaping, or filtering of the prompt content before delegation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 06:16 AM
Security Audit — agent-trust-hub — claude-use-gemini-acp