claude-use-gemini-acp

SUSPICIOUS: the skill’s core function is coherent, and its install path appears to use official Google/npm tooling rather than an unknown third-party payload. However, the combination of runtime-fetched execution, default nightly versioning, delegation of local context to an external model, and especially Gemini’s --yolo auto-approval makes the skill materially risky and broader than a simple summarization helper.

This module itself is a thin streaming delegate, and it does not contain direct indicators of classic malware (no obfuscation, eval-like execution, file tampering, persistence, or explicit credential theft). The main risk is supply-chain/runtime integrity: it dynamically downloads and executes `@google/gemini-cli` via `pnpm dlx` using environment-controlled (defaulting to a moving `nightly`) version/tag, and it forwards the entire parent environment to that child process. Additionally, it streams agent output to stdout without redaction, which can leak sensitive content if emitted by the invoked CLI.