The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The skill provides numerous shell command examples using gemini, jq, echo, and cat. All commands are consistent with the stated purpose of token optimization and cost tracking. They operate on local files provided by the user (e.g., src/*.ts) or process JSON output from the Gemini CLI.
[DATA_EXPOSURE & EXFILTRATION] (SAFE): No sensitive file paths are accessed. The skill correctly identifies that API keys are used for authentication but does not attempt to extract them. Network operations are limited to the intended use of the gemini CLI tool.
[PROMPT_INJECTION] (SAFE): The 'MANDATORY' instruction at the beginning is a steering mechanism for the AI to use a specific documentation skill (gemini-cli-docs) to ensure accuracy. It does not attempt to bypass safety filters or override system constraints in a malicious way.
[INDIRECT PROMPT INJECTION] (LOW): The skill processes external files (e.g., cat src/*.ts | gemini ...). While this is a data ingestion surface, it is the primary purpose of the tool. The risk is inherent to any tool analyzing untrusted code, and the skill itself does not introduce new vulnerabilities.

gemini-token-optimization