The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The function seed_user_auth_into_home in scripts/gemini_bridge.py, triggered by the --seed-user-auth flag, copies sensitive files such as oauth_creds.json and google_accounts.json from the user's home directory (~/.gemini) into the local workspace folder (.gemini_cli_home). This creates a risk of exposing private authentication tokens if the workspace is shared, version-controlled, or accessed by other processes.\n- [COMMAND_EXECUTION]: The scripts/gemini_bridge.py script wraps the gemini CLI tool using subprocess.Popen. While it mitigates direct shell injection by using shell=False, the script executes a local binary based on agent-provided prompt content and configuration parameters.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it interpolates data from local workspace files (e.g., topic-brief.md, evidence-matrix.csv) into templates defined in assets/prompt-template.md.\n
Ingestion points: Data from topic-brief.md, evidence-matrix.csv, and contribution-map.yaml is ingested as model context.\n
Boundary markers: The templates use structural headers (e.g., "Input:"), but do not include specific delimiters or instructions to ignore embedded commands.\n
Capability inventory: The skill is capable of reading workspace files and executing the gemini CLI.\n
Sanitization: No validation or escaping logic is present to sanitize the ingested file content before it is processed by the model.

collaborating-with-gemini