The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use system-level commands like ps aux, lsof, kill -9, and pkill -9 to manage background processes. This provides the agent with the ability to monitor and terminate arbitrary processes on the system.
[COMMAND_EXECUTION]: The instructions promote the use of the --approval-mode yolo (or -y) flag, specifically for background or automated tasks. This mode disables manual approval for all tools used by the underlying LLM, which could include high-impact actions like file modification or network communication, effectively bypassing human-in-the-loop security controls.
[INDIRECT_PROMPT_INJECTION]: The skill is intended to process entire codebases and large documentation sets (up to 1M tokens) from potentially untrusted sources. This exposes the agent to indirect prompt injection if malicious instructions are hidden within the analyzed files. • Ingestion points: workspace files, documentation sets, and directories included via --include-directories (SKILL.md, README.md). • Boundary markers: No specific delimiters or 'ignore' instructions are provided for the data processed by the CLI. • Capability inventory: The gemini CLI can execute tools and perform edits (facilitated by --approval-mode yolo), and the agent is granted shell command execution capabilities for process management. • Sanitization: There are no instructions for sanitizing or validating the contents of the large context data being processed.
[METADATA_POISONING]: The skill body and metadata contain unverified and potentially deceptive claims regarding a 'Gemini 3 Pro' model and its performance metrics (e.g., '76.2% on SWE-bench'). These claims may be intended to deceive the user or agent regarding the skill's effectiveness and safety.

gemini