The Agent Skills Directory

COMMAND_EXECUTION (MEDIUM): The skill executes the gemini CLI using a shell pipe: echo "$ARGUMENTS" | gemini. This pattern is vulnerable to shell command injection if the $ARGUMENTS variable contains characters such as backticks, semicolons, or subshell expansions, allowing an attacker to execute arbitrary commands on the host system.
COMMAND_EXECUTION (MEDIUM): The instruction includes the -y flag for the Gemini CLI, which auto-approves all tool executions. This bypasses human-in-the-loop safety checks, allowing potentially dangerous MCP tools (e.g., file system access or network operations) to be executed without confirmation when triggered by malicious input.
PROMPT_INJECTION (LOW): The skill is vulnerable to indirect prompt injection because it interpolates untrusted data directly into the model's input stream without sanitization or boundary markers.
Ingestion points: The $ARGUMENTS variable in SKILL.md is piped directly into the gemini CLI.
Boundary markers: Absent. There are no delimiters or instructions provided to the CLI to distinguish between user data and system instructions.
Capability inventory: The CLI has the capability to execute any tools exposed by the configured MCP servers, which could include file modification, command execution, or network access.
Sanitization: None. The skill lacks any logic to escape shell characters or filter malicious prompt content.
COMMAND_EXECUTION (MEDIUM): The fallback logic suggests using an mcp-builder skill to 'fix' scripts of the mcp-management skill. This establishes a dynamic execution pattern where scripts are modified and run at runtime, which can be leveraged by an attacker to achieve persistence or escalate privileges within the agent's environment.

use-mcp