The Agent Skills Directory

[COMMAND_EXECUTION]: The shell tool allows for the execution of arbitrary shell commands on the host machine. Although it defaults to a 'dry run' mode, the documentation explicitly instructs users how to perform live execution by setting dryRun: false. This creates a path for malicious instructions to perform unauthorized system modifications or install persistent backdoors.
[DATA_EXFILTRATION]: The gemini and analyze-media tools use a special @ syntax to read local files and directories (e.g., @src/main.ts, @.). This provides a broad surface for data exposure, as the agent could be manipulated via prompt injection to read sensitive files such as .env, SSH private keys, or cloud provider credentials.
[REMOTE_CODE_EXECUTION]: The skill instructions direct the user to install and run the MCP server using npx -y @tuannvm/gemini-mcp-server. This involves downloading and executing code from an unverified third-party NPM package, posing a supply chain risk where the package could contain malicious code.
[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection. It ingests untrusted data from the web via web-search and from local files via gemini. Malicious content within these sources could contain instructions that trick the agent into using the shell tool for unauthorized actions. There are no mentioned security boundaries or sanitization processes to mitigate this.
[COMMAND_EXECUTION]: The gemini tool supports a yolo: true parameter, which is described as bypassing all tool execution confirmations. This reduces human oversight and increases the risk that malicious commands generated by the AI will be executed without the user's knowledge.

use-gemini