gemini
Warn
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions direct the agent to utilize '--approval-mode yolo' for background and automated tasks. This mode is designed to auto-approve all tool calls, which instructs the agent to bypass standard safety protocols and human oversight. Additionally, the skill facilitates indirect prompt injection by processing extensive untrusted codebase data without boundary markers or sanitization while operating in this high-privilege auto-approval mode.
- Ingestion points: Full codebase scanning and documentation ingestion via '--include-directories' flags in SKILL.md.
- Boundary markers: Absent; the skill provides no instructions to isolate or ignore instructions embedded in the input code.
- Capability inventory: Full tool-calling capabilities via the gemini CLI (when in YOLO mode) and system process management utilities.
- Sanitization: No content validation or sanitization is performed on codebase data before model processing.
- [COMMAND_EXECUTION]: The skill executes the gemini CLI and various system utilities for process management and troubleshooting, including ps, pkill, kill, and lsof.
- [DATA_EXFILTRATION]: The skill's core functionality involves reading and transmitting large volumes of local data (up to 1,000,000 tokens of source code and plans) to external Google Gemini API endpoints.
Audit Metadata