The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_gemini.py utilizes subprocess.run to execute the local gemini CLI and other runner scripts during fallback operations. While the script avoids direct shell injection by passing command arguments as a list, it executes the model with the --yolo flag by default, which enables auto-approval for model-generated actions and increases the impact of potential manipulation.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8).
Ingestion points: Untrusted data is ingested via the positional prompt argument, and the --prompt-file and --session-file parameters in scripts/run_gemini.py.
Boundary markers: The build_prompt function assembles the final prompt by concatenating roles, metadata, session context, and the prompt body using simple string formatting. It lacks robust boundary markers or explicit instructions for the model to ignore instructions embedded within the data segments.
Capability inventory: The skill facilitates the execution of model-generated commands via the Gemini CLI, with auto-approval enabled by default.
Sanitization: There is no validation or sanitization of input strings before they are interpolated into the prompt and passed to the CLI.

gemini-runner