mastering-gemini-cli

SUSPICIOUS. The skill's main purpose is coherent and its Gemini CLI references match official Google tooling, so it is not fundamentally deceptive. But it expands trust to unpinned third-party MCP packages that receive tokens, encourages autonomous yolo workflows, and includes an eval-based wrapper with shell-injection risk; together these make it medium-high security risk rather than benign.

The script has a command-injection vulnerability: untrusted prompt text is interpolated into a command string and executed with eval. Avoid eval and invoke gemini with a properly quoted command and argument array.