The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command: gemini -m gemini-2.5-flash -p "...your search prompt...". The inclusion of a dynamically generated search prompt directly into a shell string without explicit sanitization instructions creates a risk of command injection. If the search prompt is influenced by user input or malicious external content, it could contain shell metacharacters (e.g., ;, &&, |, $()) that would execute unintended commands on the host system.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as its primary function is to ingest and synthesize information from untrusted external sources like web search results and GitHub repositories.
Ingestion points: Data enters the agent's context through the output of the gemini command, the WebSearch tool, and the docs-seeker skill (which reads GitHub READMEs).
Boundary markers: The instructions do not define delimiters or specific markers to isolate untrusted external content from the agent's internal logic.
Capability inventory: The agent has the ability to execute shell commands (gemini) and write files to the local file system (under ./plans/).
Sanitization: There are no instructions for sanitizing, escaping, or validating the external content before it is processed or written to reports, allowing malicious instructions embedded in web pages or repositories to potentially influence the agent's synthesis or subsequent actions.

research