Deep Research via Gemini CLI Extension

• Outcome: Review
• Latest audit: May 28, 2026 · 3:42 PM UTC
• Version: 1.1.0

Overview

The skill appears to do the advertised Gemini Deep Research workflow, but it deserves review because it runs a third-party auto-updating extension, sends prompts to Gemini, writes files locally, and starts detached background polling.

Install only if you trust the third-party Gemini Deep Research extension and are comfortable with prompts being sent to Gemini, paid API quota being used, and reports/logs being written locally. Prefer reviewing or pinning the extension instead of auto-updating it, choose the output path explicitly, avoid sensitive topics, and keep track of the background polling process so you can stop or clean it up if needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger list contains broad phrases such as 'research X thoroughly' and multilingual variants that can match ordinary user requests, causing the skill to activate in situations where the user did not clearly consent to running external tooling, creating files, or starting background work. In this skill's context, over-broad activation is more dangerous because the workflow launches CLI-based research jobs and persists artifacts automatically.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions direct the agent to create temp directories, write task files, generate a shell script, and save a report into the user's Obsidian vault, but the user-facing confirmation does not clearly warn that filesystem writes and background scripts will be created. This weakens informed consent and can lead to unintended persistence of potentially sensitive research topics and reports on disk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script accepts an arbitrary --output path and causes the MCP tool to write a report there, creating parent directories as needed, with no path restrictions or user-facing guardrails. In an agent setting, untrusted or indirectly influenced input could steer writes to sensitive locations in the user's home or workspace, causing unintended file overwrite or persistence.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script forwards task.input to the research_start tool, which is inherently network-backed, without any explicit privacy warning, consent step, or sensitivity filtering. Because this skill is specifically designed for deep external research, users may provide proprietary, personal, or regulated data that is then transmitted to third-party services, making the context more dangerous rather than less.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cd /tmp/gemini-deep-research/<task-dir>/
nohup bash poll.sh > /dev/null 2>&1 &
echo "Background PID: $!"
```

• Confidence: 95% confidence
• Finding: The skill launches `nohup bash poll.sh ... &`, creating a detached background process that survives the initiating session and continues polling and writing files without ongoing user supervision. Persistent background execution increases the risk of unintended long-running activity, repeated external API use, and silent data accumulation in logs and saved reports.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi
```

### Step 5 — Launch Background Process

```bash
cd /tmp/gemini-deep-research/<task-dir>/

• Confidence: 91% confidence
• Finding: The documented 'Launch Background Process' step explicitly instructs the agent to persist work asynchronously beyond the chat/session lifecycle. In this skill, that persistence is coupled with external research calls and local file writes, making the behavior materially more security-relevant than a harmless status reminder or transient task queue.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/dr-client.js:131

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/poll-research.js:32

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/save-report.js:22

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/start-research.js:21