gemini-cli
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions for the agent to use 'forceful language' like 'Apply now', 'Start immediately', and 'Do this without asking for confirmation'. These prompts are intended to bypass the agent's internal planning and user-confirmation checkpoints when executing actions through the CLI tool's auto-approval mode.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external content through Google Search and URL fetching, creating a surface for embedded instructions. Ingestion points: Web search results and fetched URL content are read into the agent's context (SKILL.md, tools.md). Boundary markers: None present to delimit or isolate untrusted external content. Capability inventory: The skill uses the Bash tool to execute the Gemini CLI, which has file-writing capabilities on the local system. Sanitization: No input validation or content filtering is specified for data retrieved from external sources.
- [EXTERNAL_DOWNLOADS]: The skill guides users to install the official Gemini CLI package from a trusted organization's repository.
- [COMMAND_EXECUTION]: The skill relies on shell commands via the Bash tool to interact with the Gemini CLI, passing user prompts and file paths as arguments to the tool.
Audit Metadata