The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to build and run shell commands (gemini -p "...") that include raw content from the local repository (such as git diff results) and user-supplied text. This practice creates a command injection vulnerability where malicious content within the diff or user query containing shell metacharacters (e.g., backticks, semicolons) could lead to unintended command execution on the host system.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local files and user queries to be reviewed by the Gemini AI. This creates an attack surface where malicious instructions embedded in file changes could influence the AI model's behavior.\n
Ingestion points: Project files via git diff and user input strings in SKILL.md.\n
Boundary markers: Simple text headers (e.g., CONTEXT:, CHANGE TYPE:) are used as delimiters in the prompt sent to Gemini, which are not robust against adversarial content.\n
Capability inventory: Execution of git and gemini CLI tools via the shell.\n
Sanitization: There is no logic provided to sanitize or escape the content before it is interpolated into shell commands or prompt contexts.\n- [EXTERNAL_DOWNLOADS]: The skill directs users to install a specific external package (@google/gemini-cli) globally via NPM to enable its features.\n- [COMMAND_EXECUTION]: The skill uses shell commands to check for the existence of the Gemini CLI and to extract version control information from the local environment using git rev-parse and git diff.

gemini