gemini-use-claude-acp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The script intentionally disables permission prompts and launches a remotely-fetched Claude ACP adapter, which grants the model automated access to filesystem/shell tools and therefore creates a strong risk of data exfiltration and remote execution (high-risk, deliberate behavior).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime path claude-delegate.mjs takes user-supplied free text from process.argv (promptText = args.join(' ')) and sends it into the ACP session as the prompt, so outsider-authored text is directly ingested by the agent without any restriction to a trusted item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill spawns "pnpm dlx @zed-industries/claude-code-acp" at runtime (scripts/claude-delegate.mjs), which fetches and executes remote package code that controls the Claude ACP adapter and therefore the agent’s prompt execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The script sets CLAUDE_CODE_SKIP_PERMISSIONS=1 (auto-approves all tool calls) and explicitly allows Claude to use filesystem/shell tools and edit files by absolute paths, enabling unmediated modifications to system files or privileged operations.