claude-use-gemini-acp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The script intentionally spawns a third‑party Gemini CLI with the --yolo flag (auto-approves tool calls), runs it in a user-specified working directory while passing the full environment through, and downloads/executes a possibly-nightly npm package — this combination creates a high risk of data exfiltration, credential exposure, and remote code execution if the CLI or model uses tools or is replaced by a malicious package.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path scripts/gemini-delegate.mjs ingests user-supplied promptText (from process.argv) and streams the resulting agent_message_chunk text to stdout, so outsider-authored free text is directly provided to the model.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill spawns pnpm dlx @google/gemini-cli (see @google/gemini-cli@${version} / @google/gemini-cli@<version>), which fetches and executes remote code at runtime (the gemini-cli package) and is required for the skill to operate.