ask-gemini
Fail
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill constructs shell commands by directly interpolating user input into strings, such as
gemini -p "{{ARGUMENTS}}"andrcs ask gemini "{{ARGUMENTS}}". This constitutes a command injection vulnerability where a user can break out of the intended command context by including shell metacharacters like semicolons, backticks, or pipes to execute arbitrary system commands.\n- [INDIRECT_PROMPT_INJECTION]: The skill exposes a significant attack surface by ingesting untrusted data and using it to drive powerful local capabilities.\n - Ingestion points: User input provided via the
{{ARGUMENTS}}placeholder inSKILL.mdis the primary entry point.\n - Boundary markers: The skill lacks any boundary markers or instructions to the agent to treat the input as literal text rather than executable shell content.\n
- Capability inventory: The skill utilizes local shell execution via the
geminiCLI tool and transitional wrappers likenpm run ask:gemini.\n - Sanitization: There is no logic present to escape shell characters, perform validation, or otherwise sanitize the input before it is passed to the shell.
Recommendations
- AI detected serious security threats
Audit Metadata