Gemini Sub-Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:38 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it needs review because it installs global tools and encourages Gemini to edit files and run shell commands without approval.

Review before installing. Use this only in a disposable or tightly scoped workspace, avoid sending secrets or private code to Gemini unless you have approved that data flow, remove or avoid the -y examples unless you truly want unattended file and shell changes, and prefer user-local, pinned installs over global system changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:16
• Finding: Unpinned Global Installation of Gemini CLI<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 16-19 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash info "Checking gemini-cli..." if ! command -v gemini >/dev/null 2>&1; then info "Installing @google/gemini-cli..." npm install -g @google/gemini-cli || fail "Failed to install gemini-cli" fi ``` ### Technical Analysis The setup script installs `@google/gemini-cli` without specifying an exact version or validating package integrity. Consequently, each fresh installation retrieves and installs whichever version is currently associated with the package's default npm distribution tag. Although the package name and namespace are consistent with the declared functionality, the installation is not reproducible and implicitly trusts all future upstream releases. npm package installation can execute lifecycle scripts, and the `-g` option installs the package into a system-wide location. If setup is run with elevated privileges—as may be necessary for later operations that write to `/usr/share`, `/etc`, and `/usr/local/bin`—package lifecycle code may execute with those same privileges. ### Attack Path 1. An upstream package release, maintainer account, or package distribution channel is compromised, or a future release introduces malicious installation behavior. 2. A user runs `scripts/setup.sh` on a fresh system where the `gemini` command is absent. 3. The script resolves the current default version of `@google/gemini-cli` rather than a previously reviewed version. 4. npm downloads the changed package and executes any applicable lifecycle scripts with the privileges of the setup process. 5. Malicious package code can modify files, read accessible credentials, install additional software, or establish persistence within those privileges. ### Impact Assessment Successful exploitation provides code execution with the privileges of the account running ...[truncated 340 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, for example: ```bash npm install -g @google/gemini-cli@<reviewed-exact-version> ``` 2. Verify the package archive against an independently maintained integrity hash or approved artifact manifest before installation. 3. Implement a controlled update process that reviews release notes, package contents, dependency changes, and lifecycle scripts before changing the pinned version. 4. Avoid running npm installation as root. Install the CLI into a dedicated unprivileged account or a user-local prefix. 5. Prefer a lockfile-based local installation or a verified, immutable container image over mutable global installation. 6. Disable npm lifecycle scripts where operationally possible and explicitly install only artifacts that do not depend on them. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:48
• Finding: Unrestricted Model-Directed Shell Commands and File Writes Through Yolo Mode<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48-54 **Vulnerability Type**: Automatic approval of model-generated commands and file modifications **Risk Level**: High ### Vulnerable Instructions ```bash ### 3. Agentic coding (replaces Swift/Sonnet for 30-200 line tasks) ```bash cd /path/to/project GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "write a script that..." ``` `-y` = yolo mode (auto-approves all file writes and shell commands). Gemini reads/writes files autonomously. ``` ### Technical Analysis The Skill explicitly recommends Gemini CLI's `-y` mode, which automatically approves all model-selected file writes and shell commands. This removes the human authorization boundary between untrusted model output and local code execution. The model may process attacker-controlled repository files, issue descriptions, documents, pasted text, or other prompt context. Content within those inputs can contain indirect prompt-injection instructions that attempt to induce destructive commands, secret collection, or unauthorized modifications. In automatic-approval mode, such commands can execute without the user reviewing their purpose, destination, or side effects. The setup documentation does not require isolation, a restricted service account, filesystem boundaries, network controls, or credential removal before using this mode. Execution therefore inherits the invoking user's access to the repository, home directory, environment variables, credentials, network services, and local tools. ### Attack Path 1. An attacker places malicious instructions in content that Gemini is asked to process, such as a source file, dependency documentation, issue text, generated artifact, or pasted task description. 2. The user invokes Gemini with the documented `-y` option from a project directory. 3. The model interprets the malicious content as actionable instructions or generates an unsafe command because of task ambiguity. 4. Gemini ...[truncated 1177 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `-y` from the recommended default workflow and require explicit user approval for every shell command and file modification. 2. Treat repository files, documents, issue text, and pasted content as untrusted input that cannot authorize tool execution. 3. Run agentic coding tasks inside a disposable container or virtual machine with: - A non-root user. - No host home-directory mount. - No SSH, cloud, package-registry, or gcloud credentials. - A narrowly scoped writable worktree. - Restricted or disabled outbound network access. 4. Use command and path allowlists so the model cannot access files outside the task workspace or invoke unrelated system utilities. 5. Present the exact command, working directory, environment changes, and affected paths for human review before execution. 6. Use a temporary branch or isolated worktree, inspect all changes, and run security checks before merging generated modifications. 7. If unattended operation is essential, use a dedicated low-privilege account and an ephemeral environment that is destroyed after each task. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### 1. Simple text task (exec)
```bash
ask-gemini "your prompt here"
ask-gemini -m gemini-2.5-pro "your prompt"
```

### 2. Pipe large content (long-context)

• Confidence: 90% confidence
• Finding: This skill routes prompts to an external model provider, which creates a data-sharing boundary outside the primary platform. Even for simple text tasks, sending prompts to a third-party model can expose sensitive inputs, proprietary code, or internal context if users invoke it broadly as described.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### 3. Agentic coding (replaces Swift/Sonnet for 30-200 line tasks)
```bash
cd /path/to/project
GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "write a script that..."
```
`-y` = yolo mode (auto-approves all file writes and shell commands). Gemini reads/writes files autonomously.

• Confidence: 95% confidence
• Finding: This example combines external model delegation with autonomous execution mode for coding tasks. That combination is particularly dangerous because untrusted or sensitive project context may be sent to a third party, which then proposes and auto-executes file writes and shell commands locally without approval.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation explicitly recommends a 'yolo mode' that auto-approves all file writes and shell commands, yet provides no meaningful safety warning, guardrails, or approval checkpoint. This is dangerous because it normalizes autonomous execution of arbitrary modifications and commands by an external model, creating a direct path to destructive changes, data exfiltration, or unsafe system actions.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### 4. Pipe files directly into agentic session
```bash
cat existing_script.py | GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "refactor this to add error handling"
```

## Routing Rules (when to use Gemini vs others)

• Confidence: 96% confidence
• Finding: Piping local source files directly into an external provider and pairing that with auto-approved agentic execution creates both confidentiality and integrity risk. Sensitive code can be transmitted off-platform, and the resulting autonomous session can immediately alter files or run commands based on that external analysis without verification.

Credential Access

High

• Category: Privilege Escalation

Content

info "Checking gcloud..."
if ! command -v gcloud >/dev/null 2>&1; then
  info "Installing google-cloud-cli via apt..."
  curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
  echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee /etc/apt/sources.list.d/google-cloud-sdk.list
  apt-get update -q && apt-get install -y google-cloud-cli || fail "Failed to install gcloud"
fi

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

info "Checking gcloud..."
if ! command -v gcloud >/dev/null 2>&1; then
  info "Installing google-cloud-cli via apt..."
  curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
  echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee /etc/apt/sources.list.d/google-cloud-sdk.list
  apt-get update -q && apt-get install -y google-cloud-cli || fail "Failed to install gcloud"
fi

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

cat > "$WRAPPER_PATH" << 'WRAPPER'
#!/bin/bash
# ask-gemini — Gemini via Google subscription (no API cost)
# Usage: ask-gemini "prompt" | ask-gemini -m gemini-2.5-pro "prompt" | echo "text" | ask-gemini "instruction"
# Agentic coding: cd /project && GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "task"
MODEL=""
while [[ $# -gt 0 ]]; do

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

#!/bin/bash
# ask-gemini — Gemini via Google subscription (no API cost)
# Usage: ask-gemini "prompt" | ask-gemini -m gemini-2.5-pro "prompt" | echo "text" | ask-gemini "instruction"
# Agentic coding: cd /project && GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "task"
MODEL=""
while [[ $# -gt 0 ]]; do
  case "$1" in

• Confidence: 90% confidence
• Finding: The wrapper documentation explicitly promotes agentic coding with gemini -y, indicating autonomous execution mode against a project directory. In the context of an agent skill, encouraging autonomous coding via an external model materially increases the risk of unsafe code changes, prompt-injection-driven actions, or unintended execution when users adopt the suggested pattern.

Credential Access

High

• Category: Privilege Escalation

Content

chmod +x "$WRAPPER_PATH"
ok "ask-gemini installed at $WRAPPER_PATH"

CREDS="$HOME/.config/gcloud/application_default_credentials.json"
echo ""
if [ -f "$CREDS" ]; then
  ok "GCA credentials found. You're ready to go!"

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

chmod +x "$WRAPPER_PATH"
ok "ask-gemini installed at $WRAPPER_PATH"

CREDS="$HOME/.config/gcloud/application_default_credentials.json"
echo ""
if [ -f "$CREDS" ]; then
  ok "GCA credentials found. You're ready to go!"

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

chmod +x "$WRAPPER_PATH"
ok "ask-gemini installed at $WRAPPER_PATH"

CREDS="$HOME/.config/gcloud/application_default_credentials.json"
echo ""
if [ -f "$CREDS" ]; then
  ok "GCA credentials found. You're ready to go!"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill exposes and documents shell-capable behavior but does not declare any explicit tool scope or allowed-tools boundary. That omission weakens policy enforcement and makes it easier for the skill to be invoked in contexts where shell execution or installation steps were not expected, increasing the risk of unauthorized command execution.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation guidance is extremely broad, covering generic analysis, summarization, coding, and long-context tasks, so the skill could trigger for many ordinary requests. In combination with shell-backed and autonomous agent behavior, overbroad routing increases the chance that sensitive data or risky tasks are sent to this external sub-agent when a safer local or more constrained path would be preferable.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

cd /path/to/project
GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "write a script that..."
```
`-y` = yolo mode (auto-approves all file writes and shell commands). Gemini reads/writes files autonomously.

### 4. Pipe files directly into agentic session
```bash

• Confidence: 97% confidence
• Finding: The skill endorses autonomous decision-making by stating that file writes and shell commands are auto-approved and performed autonomously. In a coding skill, this materially raises risk because the model can decide both what to change and what to execute without human review, enabling accidental or maliciously induced harmful actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script automatically adds a new APT repository, imports a signing key, and installs google-cloud-cli using apt-get without any explicit warning, privilege check, or user confirmation. In a setup script for an agent skill, this is risky because it causes privileged system-wide changes and expands the host's trust boundary to an external package source, which could surprise users or be abused if they run the script blindly as root.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes an executable wrapper to /usr/local/bin, altering the system PATH for all users, without warning or confirmation. This is a real safety issue because users may not expect a setup script to create globally accessible executables that proxy prompts and stdin to an external model provider.

Static analysis

No suspicious patterns detected.