gemini
Verdict safe, but 2 findings (2 medium), mainly unauthorized tool use, resource abuse. Most recent scan 2026-02-06.
The Gemini skill is a wrapper for the Gemini CLI tool that enables large-context processing and code review. The skill itself contains no executable scripts (Python/Bash), only markdown instructions, which significantly reduces attack surface. However, it exhibits MEDIUM severity concerns around unbounded autonomy (YOLO mode encouragement) and availability risks (process hanging). The skill's primary security issues stem from operational risks rather than malicious code: (1) Strong encouragement to use '--approval-mode yolo' which auto-approves all tool executions without oversight, creating potential for unintended file modifications or system commands, and (2) Documented hanging behavior that could cause resource exhaustion if timeout protections aren't used. The skill lacks optional manifest metadata (allowed-tools, license, compatibility) and references non-existent files, but these are minor documentation issues. No data exfiltration, credential theft, prompt injection, or command injection threats were detected. The skill is functionally legitimate but needs stronger guardrails around autonomous execution modes and mandatory timeout protections.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Use when the user asks to run Gemini CLI for code review, plan review, or big context (>200k) processing. Ideal for comprehensive analysis requiring large context windows. Uses Gemini 3 Pro by default for state-of-the-art reasoning and coding.
- Package
- 2 files, 21 KB
- SKILL.md
- 1341 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Gemini Skill Guide · When to Use Gemini · ⚠️ Critical: Background/Non-Interactive Mode Warning · Check if hung · Kill if necessary · Running a Task · Quick Reference · Model Selection Guide · Common Use Cases · Code Review (Background/Automated) · For background execution (Claude Code, CI/CD, etc.) · With timeout safety (5 minutes)
Findings
MEDIUM Unbounded Autonomy with YOLO Mode Encouragement Unauthorized Tool Usellm
The skill strongly encourages using '--approval-mode yolo' for automated tasks, which auto-approves ALL tools without user confirmation. While this is documented as necessary for background execution, it creates a risk where the Gemini CLI could execute arbitrary file modifications, network calls, or system commands without oversight. The instructions emphasize using YOLO mode for 'background/automated tasks' but don't clearly define what constitutes appropriate use cases, potentially leading to over-permissive execution.
SKILL.md
'--approval-mode yolo' - Auto-approve all tools (✅ REQUIRED for background/automated tasks)
'For background/automated tasks, ALWAYS use `--approval-mode yolo`'MEDIUM Insufficient Timeout Protection for Hung Processes Resource Abusellm
The skill documents that Gemini CLI can hang indefinitely when using 'default' approval mode in non-interactive shells, requiring manual process killing. While a 300-second timeout wrapper is mentioned as an option, it's presented as secondary to YOLO mode rather than a required safeguard. This creates availability risks where hung processes could consume system resources indefinitely if users forget the timeout wrapper or use default mode incorrectly.
SKILL.md
'NEVER use `--approval-mode default` in background or non-interactive shells. It will hang indefinitely waiting for approval prompts'
'OR wrap with timeout: `timeout 300 gemini ...`' (presented as optional alternative)
'Symptoms of hung Gemini: Process running 20+ minutes with 0% CPU usage'What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 11 KB |
SKILL.md | doc | 9.6 KB |
External hosts referenced
ai.google.dev github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit b00cf8491de1. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/softaworks/agent-toolkit
- Raw scan result: gemini-scan.json
- Badge for your README:
- Request a re-scan