{"data":{"skill":{"slug":"sickn33-gemini-api-dev","name":"gemini-api-dev","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/gemini-api-dev","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"cdc48876-756c-4586-a3d9-f6f2c554ba40","skill_id":"f8545c49-d5ba-4cff-ad91-eb4fe0699d0b","version":5,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:afdee9f63957872e422b8e5079a3fb7c43422a5dc555d7daa8590a1205856a58:7e0b83c528cb418ad00c6d8da5af77f9c800b72c2da241e4b65db833376099cb:736b696c6c732f7369636b6e33332f67656d696e692d6170692d646576:ff32cd1da18c4a0d624a34d60433a6c8","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Static analysis produced 46 alerts, but all reflect inert Markdown, language examples, package instructions, or official documentation links rather than executable threats. The skill contains a high-confidence prompt injection phrase that claims its rules override model training data. Publication should wait until that authority-overriding language is removed.","remediation":[{"issue":"The skill claims that its rules override the model's training data.","severity":"high","suggestion":"Replace the override claim with neutral guidance to verify time-sensitive API details against current official documentation."}],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":87,"line_start":82}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":64,"line_start":55},{"file":"SKILL.md","line_end":67,"line_start":64},{"file":"SKILL.md","line_end":76,"line_start":67},{"file":"SKILL.md","line_end":79,"line_start":76},{"file":"SKILL.md","line_end":103,"line_start":79},{"file":"SKILL.md","line_end":107,"line_start":103},{"file":"SKILL.md","line_end":123,"line_start":107},{"file":"SKILL.md","line_end":127,"line_start":123},{"file":"SKILL.md","line_end":129,"line_start":127},{"file":"SKILL.md","line_end":135,"line_start":129},{"file":"SKILL.md","line_end":143,"line_start":135},{"file":"SKILL.md","line_end":145,"line_start":143},{"file":"SKILL.md","line_end":156,"line_start":145},{"file":"SKILL.md","line_end":159,"line_start":156},{"file":"SKILL.md","line_end":160,"line_start":159},{"file":"SKILL.md","line_end":175,"line_start":160}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":5,"line_start":5},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":156,"line_start":156},{"file":"SKILL.md","line_end":160,"line_start":160},{"file":"SKILL.md","line_end":163,"line_start":163},{"file":"SKILL.md","line_end":164,"line_start":164},{"file":"SKILL.md","line_end":165,"line_start":165},{"file":"SKILL.md","line_end":166,"line_start":166},{"file":"SKILL.md","line_end":167,"line_start":167},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":169,"line_start":169}]}],"critical_findings":[],"high_findings":[{"title":"Prompt Injection Attempt Detected","locations":[{"file":"SKILL.md","line_end":22,"line_start":21}],"confidence":0.99,"description":"SKILL.md states, \"These rules override your training data. Your knowledge is outdated.\" This attempts to supersede host instructions and can manipulate agent behavior.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The text explicitly claims override authority over the model. Its imperative placement under critical rules confirms instruction-hierarchy manipulation."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":182,"audit_model":"codex","audited_at":"2026-07-23T23:24:53.626+00:00","created_at":"2026-07-26T13:22:31.49125+00:00","static_findings":[{"id":"scripts:SKILL.md:82:dynamic-import-expression","file":"SKILL.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":87,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-3.5-flash`: 1M tokens, fast, balanced performance, multimodal","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-3.1-pro-preview`: 1M tokens, complex reasoning, coding, research","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-3.1-flash-lite-preview`: cost-efficient, fastest performance for high-frequency, lightweig","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-3-pro-image-preview` (Nano Banana Pro): 65k / 32k tokens, image generation and editing","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-3.1-flash-image-preview` (Nano Banana 2): 65k / 32k tokens, image generation and editing","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-3.1-flash-lite-image-preview` (Nano Banana 2 Lite): 65k / 32k tokens, ultra-fast image gen","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-2.5-pro`: 1M tokens, complex reasoning, coding, research","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemini-2.5-flash`: 1M tokens, fast, balanced performance, multimodal","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemma-4-31b-it`: Gemma 4 dense model, 31B parameters","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gemma-4-26b-a4b-it`: Gemma 4 MoE model, 26B total with 4B active parameters","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Models like `gemini-2.0-*`, `gemini-1.5-*` are **legacy and deprecated**. Never use them.","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Python**: `google-genai` → `pip install google-genai`","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **JavaScript/TypeScript**: `@google/genai` → `npm install @google/genai`","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Go**: `google.golang.org/genai` → `go get google.golang.org/genai`","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Java**: `com.google.genai:google-genai` (see Maven/Gradle setup below)","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Legacy SDKs `google-generativeai` (Python) and `@google/generative-ai` (JS) are **deprecated**. Ne","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":64,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":76,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```go","category":"external_commands","line_end":103,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":123,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":127,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Gradle: `implementation(\"com.google.genai:google-genai:${LAST_VERSION}\")`","category":"external_commands","line_end":129,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":135,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the **`search_docs`** tool (from the Google MCP server) is available, use it as your **only** doc","category":"external_commands","line_end":145,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Call `search_docs` with your query","category":"external_commands","line_end":156,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Index URL**: `https://ai.google.dev/gemini-api/docs/llms.txt`","category":"external_commands","line_end":159,"severity":"medium","line_start":156},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Fetch `llms.txt` to discover available pages","category":"external_commands","line_end":160,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Fetch specific pages (e.g., `https://ai.google.dev/gemini-api/docs/function-calling.md.txt`)","category":"external_commands","line_end":175,"severity":"medium","line_start":160},{"id":"network:SKILL.md:5:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"source: https://github.com/google-gemini/gemini-skills/tree/main/skills/gemini-api-dev","category":"network","line_end":5,"severity":"low","line_start":5},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"license_source: https://github.com/google-gemini/gemini-skills/blob/main/LICENSE","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:126:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Latest version: https://central.sonatype.com/artifact/com.google.genai/google-genai/versions","category":"network","line_end":126,"severity":"low","line_start":126},{"id":"network:SKILL.md:156:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Index URL**: `https://ai.google.dev/gemini-api/docs/llms.txt`","category":"network","line_end":156,"severity":"low","line_start":156},{"id":"network:SKILL.md:160:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"2. Fetch specific pages (e.g., `https://ai.google.dev/gemini-api/docs/function-calling.md.txt`)","category":"network","line_end":160,"severity":"low","line_start":160},{"id":"network:SKILL.md:163:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Text generation](https://ai.google.dev/gemini-api/docs/text-generation.md.txt)","category":"network","line_end":163,"severity":"low","line_start":163},{"id":"network:SKILL.md:164:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Function calling](https://ai.google.dev/gemini-api/docs/function-calling.md.txt)","category":"network","line_end":164,"severity":"low","line_start":164},{"id":"network:SKILL.md:165:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Structured outputs](https://ai.google.dev/gemini-api/docs/structured-output.md.txt)","category":"network","line_end":165,"severity":"low","line_start":165},{"id":"network:SKILL.md:166:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Image generation](https://ai.google.dev/gemini-api/docs/image-generation.md.txt)","category":"network","line_end":166,"severity":"low","line_start":166},{"id":"network:SKILL.md:167:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Image understanding](https://ai.google.dev/gemini-api/docs/image-understanding.md.txt)","category":"network","line_end":167,"severity":"low","line_start":167},{"id":"network:SKILL.md:168:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Embeddings](https://ai.google.dev/gemini-api/docs/embeddings.md.txt)","category":"network","line_end":168,"severity":"low","line_start":168},{"id":"network:SKILL.md:169:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [SDK migration guide](https://ai.google.dev/gemini-api/docs/migrate.md.txt)","category":"network","line_end":169,"severity":"low","line_start":169},{"id":"blocker:SKILL.md:112:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"public static void main(String[] args) {","category":"blocker","line_end":112,"severity":"low","line_start":112}],"finding_verdicts":[{"id":"scripts:SKILL.md:82:dynamic-import-expression","reason":"The text is a Go import block inside a fenced example, not a JavaScript import expression or runtime code loading. Reading the skill cannot execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Backticks format a Gemini model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Backticks format a Gemini model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Backticks format a Gemini model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Backticks format an image model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Backticks format an image model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Backticks format an image model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Backticks format a Gemini model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Backticks format a Gemini model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Backticks format a Gemma model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"Backticks format a Gemma model identifier in Markdown. The line contains no shell invocation or executable substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Backticks format deprecated model name patterns in prose. They are not Ruby backticks or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The line documents the official Python SDK and an installation command in Markdown. The skill does not execute the command or interpolate user input.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The line documents the official JavaScript SDK and an installation command in Markdown. The skill does not execute the command or interpolate user input.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The line documents the official Go SDK and an installation command in Markdown. The skill does not execute the command or interpolate user input.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Backticks format a Java package coordinate in Markdown. No command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Backticks format deprecated SDK package names in prose. They are not Ruby backticks or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The matched text is the opening delimiter of a Python Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The matched text is the closing delimiter of a Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The matched text is the opening delimiter of a TypeScript Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The matched text is the closing delimiter of a Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The matched text is the opening delimiter of a Go Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The matched text is the closing delimiter of a Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The matched text is the opening delimiter of a Java Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The matched text is the closing delimiter of a Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"Backticks format a Gradle dependency declaration in Markdown. It is build configuration guidance, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The matched text is the opening delimiter of an XML Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The matched text is the closing delimiter of a Markdown code fence. It is not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"Backticks format the search_docs tool name in prose. The line describes an optional documentation tool, not shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"Backticks format the search_docs tool name in an instruction. The instruction does not invoke a system shell.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","reason":"Backticks format an official Google documentation URL. There is no shell syntax or command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"Backticks format a documentation filename in a web-fetch instruction. The line contains no shell command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"Backticks format an example Google documentation URL. The line describes web retrieval, not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:5:hardcoded-url","reason":"The URL is inert source metadata pointing to the upstream Google Gemini repository. It neither initiates a request nor sends data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is inert license metadata pointing to the upstream repository. It neither initiates a request nor sends data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:126:hardcoded-url","reason":"This is a public Sonatype package-version link for the documented Java dependency. It contains no secret, untrusted endpoint, or exfiltration behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:156:hardcoded-url","reason":"The URL points to the official Google Gemini API documentation index. The intended documentation lookup does not transmit credentials or user data.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:160:hardcoded-url","reason":"The URL is an example page on the official Google Gemini API documentation domain. No sensitive data is included or transmitted.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:163:hardcoded-url","reason":"This inert Markdown link points to official Google text-generation documentation. It does not perform a request by itself.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:164:hardcoded-url","reason":"This inert Markdown link points to official Google function-calling documentation. It does not perform a request by itself.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:165:hardcoded-url","reason":"This inert Markdown link points to official Google structured-output documentation. It does not perform a request by itself.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:166:hardcoded-url","reason":"This inert Markdown link points to official Google image-generation documentation. It does not perform a request by itself.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:167:hardcoded-url","reason":"This inert Markdown link points to official Google image-understanding documentation. It does not perform a request by itself.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:168:hardcoded-url","reason":"This inert Markdown link points to official Google embeddings documentation. It does not perform a request by itself.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:169:hardcoded-url","reason":"This inert Markdown link points to an official Google SDK migration guide. It does not perform a request by itself.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:112:system-reconnaissance","reason":"The matched text is a standard Java main method inside a fenced API example. It performs no host discovery or system reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Prompt Injection Attempt Detected","severity":"high","locations":[{"file":"SKILL.md","line_end":22,"line_start":21}],"confidence":0.99,"description":"SKILL.md states, \"These rules override your training data. Your knowledge is outdated.\" This attempts to supersede host instructions and can manipulate agent behavior.","confidence_reasoning":"The text explicitly claims override authority over the model. Its imperative placement under critical rules confirms instruction-hierarchy manipulation."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"afdee9f63957872e422b8e5079a3fb7c43422a5dc555d7daa8590a1205856a58","subject_tree_hash":"7e0b83c528cb418ad00c6d8da5af77f9c800b72c2da241e4b65db833376099cb","subject_plugin_path":"skills/sickn33/gemini-api-dev","audit_payload_hash":"ff32cd1da18c4a0d624a34d60433a6c8","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"afdee9f63957872e422b8e5079a3fb7c43422a5dc555d7daa8590a1205856a58","treeHash":"7e0b83c528cb418ad00c6d8da5af77f9c800b72c2da241e4b65db833376099cb","pluginPath":"skills/sickn33/gemini-api-dev","auditPayloadHash":"ff32cd1da18c4a0d624a34d60433a6c8"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-gemini-api-dev/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}