{
  "skill_name": "gemini",
  "skill_path": "/workspace/skills/softaworks-agent-toolkit/skills/gemini",
  "skill_directory": "/workspace/skills/softaworks-agent-toolkit/skills/gemini",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_gemini_0",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Unbounded Autonomy with YOLO Mode Encouragement",
      "description": "The skill strongly encourages using '--approval-mode yolo' for automated tasks, which auto-approves ALL tools without user confirmation. While this is documented as necessary for background execution, it creates a risk where the Gemini CLI could execute arbitrary file modifications, network calls, or system commands without oversight. The instructions emphasize using YOLO mode for 'background/automated tasks' but don't clearly define what constitutes appropriate use cases, potentially leading to over-permissive execution.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "'--approval-mode yolo' - Auto-approve all tools (\u2705 REQUIRED for background/automated tasks)\n\n'For background/automated tasks, ALWAYS use `--approval-mode yolo`'",
      "remediation": "1. Add explicit warnings about YOLO mode risks (arbitrary code execution, file modifications)\n2. Recommend '--approval-mode auto_edit' as safer default for code reviews\n3. Require explicit user confirmation before using YOLO mode\n4. Document specific scenarios where YOLO is truly necessary vs. safer alternatives\n5. Consider adding a user prompt asking for approval mode selection with risk explanations",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The Gemini skill is a wrapper for the Gemini CLI tool that enables large-context processing and code review. The skill itself contains no executable scripts (Python/Bash), only markdown instructions, which significantly reduces attack surface. However, it exhibits MEDIUM severity concerns around unbounded autonomy (YOLO mode encouragement) and availability risks (process hanging). The skill's primary security issues stem from operational risks rather than malicious code: (1) Strong encouragement to use '--approval-mode yolo' which auto-approves all tool executions without oversight, creating potential for unintended file modifications or system commands, and (2) Documented hanging behavior that could cause resource exhaustion if timeout protections aren't used. The skill lacks optional manifest metadata (allowed-tools, license, compatibility) and references non-existent files, but these are minor documentation issues. No data exfiltration, credential theft, prompt injection, or command injection threats were detected. The skill is functionally legitimate but needs stronger guardrails around autonomous execution modes and mandatory timeout protections.",
        "primary_threats": [
          "Tool Exploitation (unbounded autonomy via YOLO mode)",
          "Availability Disruption (process hanging without timeouts)",
          "Missing metadata (informational)"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified that YOLO mode bypasses all approval gates. While this is a legitimate feature of the Gemini CLI (not a skill vulnerability), the skill's instructions could better communicate risks and require explicit user consent before first use.",
        "meta_exploitability": "Medium - Requires user to follow skill instructions, but instructions strongly push YOLO mode as default for common use cases",
        "meta_impact": "Medium - Could lead to unintended file modifications or system changes if Gemini CLI misinterprets instructions or has bugs"
      }
    },
    {
      "id": "llm_finding_gemini_1",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "MEDIUM",
      "title": "Insufficient Timeout Protection for Hung Processes",
      "description": "The skill documents that Gemini CLI can hang indefinitely when using 'default' approval mode in non-interactive shells, requiring manual process killing. While a 300-second timeout wrapper is mentioned as an option, it's presented as secondary to YOLO mode rather than a required safeguard. This creates availability risks where hung processes could consume system resources indefinitely if users forget the timeout wrapper or use default mode incorrectly.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "'NEVER use `--approval-mode default` in background or non-interactive shells. It will hang indefinitely waiting for approval prompts'\n\n'OR wrap with timeout: `timeout 300 gemini ...`' (presented as optional alternative)\n\n'Symptoms of hung Gemini: Process running 20+ minutes with 0% CPU usage'",
      "remediation": "1. Make timeout wrapper MANDATORY for all Gemini CLI invocations, not optional\n2. Implement automatic timeout detection and process cleanup in skill logic\n3. Add pre-flight check to detect non-interactive shell and block 'default' mode\n4. Provide automatic fallback to YOLO with user notification if default mode is attempted\n5. Consider shorter default timeout (e.g., 120s) with option to extend",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The Gemini skill is a wrapper for the Gemini CLI tool that enables large-context processing and code review. The skill itself contains no executable scripts (Python/Bash), only markdown instructions, which significantly reduces attack surface. However, it exhibits MEDIUM severity concerns around unbounded autonomy (YOLO mode encouragement) and availability risks (process hanging). The skill's primary security issues stem from operational risks rather than malicious code: (1) Strong encouragement to use '--approval-mode yolo' which auto-approves all tool executions without oversight, creating potential for unintended file modifications or system commands, and (2) Documented hanging behavior that could cause resource exhaustion if timeout protections aren't used. The skill lacks optional manifest metadata (allowed-tools, license, compatibility) and references non-existent files, but these are minor documentation issues. No data exfiltration, credential theft, prompt injection, or command injection threats were detected. The skill is functionally legitimate but needs stronger guardrails around autonomous execution modes and mandatory timeout protections.",
        "primary_threats": [
          "Tool Exploitation (unbounded autonomy via YOLO mode)",
          "Availability Disruption (process hanging without timeouts)",
          "Missing metadata (informational)"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill explicitly documents the hanging behavior and provides kill commands, confirming this is a known operational issue. Making timeout mandatory would prevent resource exhaustion.",
        "meta_exploitability": "Easy - Users following examples without timeout will experience hangs",
        "meta_impact": "Medium - Resource exhaustion, requires manual intervention to kill processes"
      }
    }
  ],
  "scan_duration_seconds": 33.36549520492554,
  "duration_ms": 33365,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T01:56:06.630577"
}