The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The bootstrap.sh script automates the installation of python3 and gemini-cli if they are not detected. These components are retrieved from trusted repositories, including Homebrew, npm (@google/gemini-cli), and official system package managers like apt, dnf, and yum.
[COMMAND_EXECUTION]: The bootstrap.sh script utilizes sudo -n to perform non-interactive package installations. This allows the skill to set up the required environment efficiently, provided the execution environment permits passwordless sudo for these specific managers.
[COMMAND_EXECUTION]: The process_goldmine.py script executes the gemini-cli tool using subprocess.run with a list of arguments. This method is a secure way to call external processes as it avoids shell interpretation and mitigates the risk of command injection through the prompt string.
[PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted Markdown content from articles.
Ingestion points: External Markdown files are read via the read_article function in process_goldmine.py using input paths provided by the user.
Boundary markers: No explicit delimiters or escaping mechanisms are used to isolate the untrusted article body from the instructions in the final prompt.
Capability inventory: The skill can execute CLI tools (gemini-cli) and perform file-write operations to the local filesystem.
Sanitization: The skill uses resolve_path_in_project to validate that all generated content is written within the project root, effectively preventing directory traversal attacks during the materialization of results.

content-goldmine-gemini