gemini-unwatermark

This module is a runtime bootstrapper that can globally install and then execute an external CLI (`gwr`). It contains no obvious in-file malware logic, but it presents a significant supply-chain/execution risk: the install target is controlled by an environment variable and is not pinned or integrity-verified, and the executed binary depends on PATH at runtime. In trusted environments it may be benign; in attacker-influenced environments it can become a powerful execution vector.