Gemini Sub-Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:38 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it needs review because it installs global tools and encourages Gemini to edit files and run shell commands without approval.

Review before installing. Use this only in a disposable or tightly scoped workspace, avoid sending secrets or private code to Gemini unless you have approved that data flow, remove or avoid the -y examples unless you truly want unattended file and shell changes, and prefer user-local, pinned installs over global system changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:16

Finding

Unpinned Global Installation of Gemini CLI

Content

View full analysis

/dev/null 2>&1; then info "Installing @google/gemini-cli..." npm install -g @google/gemini-cli || fail "Failed to install gemini-cli" fi ``` ### Technical Analysis The setup script installs `@google/gemini-cli` without specifying an exact version or validating package integrity. Consequently, each fresh installation retrieves and installs whichever version is currently associated with the package's default npm distribution tag. Although the package name and namespace are consistent with the declared functionality, the installation is not reproducible and implicitly trusts all future upstream releases. npm package installation can execute lifecycle scripts, and the `-g` option installs the package into a system-wide location. If setup is run with elevated privileges—as may be necessary for later operations that write to `/usr/share`, `/etc`, and `/usr/local/bin`—package lifecycle code may execute with those same privileges. ### Attack Path 1. An upstream package release, maintainer account, or package distribution channel is compromised, or a future release introduces malicious installation behavior. 2. A user runs `scripts/setup.sh` on a fresh system where the `gemini` command is absent. 3. The script resolves the current default version of `@google/gemini-cli` rather than a previously reviewed version. 4. npm downloads the changed package and executes any applicable lifecycle scripts with the privileges of the setup process. 5. Malicious package code can modify files, read accessible credentials, install additional software, or establish persistence within those privileges. ### Impact Assessment Successful exploitation provides code execution with the privileges of the account running ...[truncated 340 chars]

Remediation

View remediation

``` 2. Verify the package archive against an independently maintained integrity hash or approved artifact manifest before installation. 3. Implement a controlled update process that reviews release notes, package contents, dependency changes, and lifecycle scripts before changing the pinned version. 4. Avoid running npm installation as root. Install the CLI into a dedicated unprivileged account or a user-local prefix. 5. Prefer a lockfile-based local installation or a verified, immutable container image over mutable global installation. 6. Disable npm lifecycle scripts where operationally possible and explicitly install only artifacts that do not depend on them. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:48

Finding

Unrestricted Model-Directed Shell Commands and File Writes Through Yolo Mode

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

This skill routes prompts to an external model provider, which creates a data-sharing boundary outside the primary platform. Even for simple text tasks, sending prompts to a third-party model can expose sensitive inputs, proprietary code, or internal context if users invoke it broadly as described.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

1. Simple text task (exec)

bash

ask-gemini "your prompt here"
ask-gemini -m gemini-2.5-pro "your prompt"

2. Pipe large content (long-context)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

This example combines external model delegation with autonomous execution mode for coding tasks. That combination is particularly dangerous because untrusted or sensitive project context may be sent to a third party, which then proposes and auto-executes file writes and shell commands locally without approval.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

3. Agentic coding (replaces Swift/Sonnet for 30-200 line tasks)

bash

cd /path/to/project
GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "write a script that..."

-y = yolo mode (auto-approves all file writes and shell commands). Gemini reads/writes files autonomously.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly recommends a 'yolo mode' that auto-approves all file writes and shell commands, yet provides no meaningful safety warning, guardrails, or approval checkpoint. This is dangerous because it normalizes autonomous execution of arbitrary modifications and commands by an external model, creating a direct path to destructive changes, data exfiltration, or unsafe system actions.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

Piping local source files directly into an external provider and pairing that with auto-approved agentic execution creates both confidentiality and integrity risk. Sensitive code can be transmitted off-platform, and the resulting autonomous session can immediately alter files or run commands based on that external analysis without verification.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

4. Pipe files directly into agentic session

bash

cat existing_script.py | GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "refactor this to add error handling"

Routing Rules (when to use Gemini vs others)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 24)May include surrounding context.

sh

info "Checking gcloud..."
if ! command -v gcloud >/dev/null 2>&1; then
  info "Installing google-cloud-cli via apt..."
  curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
  echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee /etc/apt/sources.list.d/google-cloud-sdk.list
  apt-get update -q && apt-get install -y google-cloud-cli || fail "Failed to install gcloud"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 25)May include surrounding context.

sh

info "Checking gcloud..."
if ! command -v gcloud >/dev/null 2>&1; then
  info "Installing google-cloud-cli via apt..."
  curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
  echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee /etc/apt/sources.list.d/google-cloud-sdk.list
  apt-get update -q && apt-get install -y google-cloud-cli || fail "Failed to install gcloud"
fi

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/setup.sh (reported line 35)May include surrounding context.

sh

cat > "$WRAPPER_PATH" << 'WRAPPER'
#!/bin/bash
# ask-gemini — Gemini via Google subscription (no API cost)
# Usage: ask-gemini "prompt" | ask-gemini -m gemini-2.5-pro "prompt" | echo "text" | ask-gemini "instruction"
# Agentic coding: cd /project && GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "task"
MODEL=""
while [[ $# -gt 0 ]]; do

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The wrapper documentation explicitly promotes agentic coding with gemini -y, indicating autonomous execution mode against a project directory. In the context of an agent skill, encouraging autonomous coding via an external model materially increases the risk of unsafe code changes, prompt-injection-driven actions, or unintended execution when users adopt the suggested pattern.

Content

Scanner excerpt · scripts/setup.sh (reported line 36)May include surrounding context.

sh

#!/bin/bash
# ask-gemini — Gemini via Google subscription (no API cost)
# Usage: ask-gemini "prompt" | ask-gemini -m gemini-2.5-pro "prompt" | echo "text" | ask-gemini "instruction"
# Agentic coding: cd /project && GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "task"
MODEL=""
while [[ $# -gt 0 ]]; do
  case "$1" in

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 57)May include surrounding context.

sh

chmod +x "$WRAPPER_PATH"
ok "ask-gemini installed at $WRAPPER_PATH"

CREDS="$HOME/.config/gcloud/application_default_credentials.json"
echo ""
if [ -f "$CREDS" ]; then
  ok "GCA credentials found. You're ready to go!"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 57)May include surrounding context.

sh

chmod +x "$WRAPPER_PATH"
ok "ask-gemini installed at $WRAPPER_PATH"

CREDS="$HOME/.config/gcloud/application_default_credentials.json"
echo ""
if [ -f "$CREDS" ]; then
  ok "GCA credentials found. You're ready to go!"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 57)May include surrounding context.

sh

chmod +x "$WRAPPER_PATH"
ok "ask-gemini installed at $WRAPPER_PATH"

CREDS="$HOME/.config/gcloud/application_default_credentials.json"
echo ""
if [ -f "$CREDS" ]; then
  ok "GCA credentials found. You're ready to go!"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes and documents shell-capable behavior but does not declare any explicit tool scope or allowed-tools boundary. That omission weakens policy enforcement and makes it easier for the skill to be invoked in contexts where shell execution or installation steps were not expected, increasing the risk of unauthorized command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation guidance is extremely broad, covering generic analysis, summarization, coding, and long-context tasks, so the skill could trigger for many ordinary requests. In combination with shell-backed and autonomous agent behavior, overbroad routing increases the chance that sensitive data or risky tasks are sent to this external sub-agent when a safer local or more constrained path would be preferable.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The skill endorses autonomous decision-making by stating that file writes and shell commands are auto-approved and performed autonomously. In a coding skill, this materially raises risk because the model can decide both what to change and what to execute without human review, enabling accidental or maliciously induced harmful actions.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

cd /path/to/project GOOGLE_GENAI_USE_GCA=true gemini -m gemini-2.5-pro -y -p "write a script that..."

text

`-y` = yolo mode (auto-approves all file writes and shell commands). Gemini reads/writes files autonomously.

### 4. Pipe files directly into agentic session
```bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script automatically adds a new APT repository, imports a signing key, and installs google-cloud-cli using apt-get without any explicit warning, privilege check, or user confirmation. In a setup script for an agent skill, this is risky because it causes privileged system-wide changes and expands the host's trust boundary to an external package source, which could surprise users or be abused if they run the script blindly as root.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes an executable wrapper to /usr/local/bin, altering the system PATH for all users, without warning or confirmation. This is a real safety issue because users may not expect a setup script to create globally accessible executables that proxy prompts and stdin to an external model provider.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.