← 返回 Skills 市场
131
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install openclaw-gemini-cli
功能描述
Use the local Gemini CLI for one-shot prompts, structured JSON output, shell-assisted research, and delegated AI-to-AI workflows on this Linux host. Use when...
安全使用建议
This skill is essentially a wrapper around whatever `gemini` CLI binary is installed on the machine. Before installing or using it: 1) Verify the gemini binary's origin and what network/backend it contacts (is it truly local-only or a client that sends data to a remote model?). 2) Do not use the helper scripts on files containing secrets, credentials, or private data — the scripts embed full file content into Gemini prompts and will transmit that content if the CLI sends requests to a remote service. 3) If you need to use file-review automation, modify scripts to explicitly sanitize or redact secrets before sending, or prefer interactive/manual review. 4) If you are concerned about injection or argument issues, prefer passing file contents safely (e.g., read from stdin or use safe quoting/escaping) and audit the scripts accordingly. 5) Ensure Gemini CLI auth is completed in a controlled way and test with non-sensitive data first. These steps will reduce the main risk (data exposure) while keeping the skill's functionality.
功能分析
Type: OpenClaw Skill
Name: openclaw-gemini-cli
Version: 1.0.1
The skill bundle provides a wrapper for the local Gemini CLI but contains critical shell injection vulnerabilities in its helper scripts. Specifically, `scripts/gemini_review.sh` and `scripts/gemini_json.sh` expand variables containing potentially untrusted file content or prompts directly within double-quoted strings in an `exec` call. This allows for arbitrary command execution (RCE) if the input contains shell metacharacters such as backticks or command substitutions. While `SKILL.md` includes safety guidelines for the agent, the underlying script implementations are fundamentally insecure.
能力评估
Purpose & Capability
The name/description match the implementation: SKILL.md and helper scripts call the local `gemini` CLI via exec for one-shot prompts, JSON-output requests, file review, and AI-to-AI workflows. No unrelated binaries, env vars, or installs are requested.
Instruction Scope
The runtime instructions explicitly tell OpenClaw to read files and send their contents to the Gemini CLI (e.g., the provided scripts embed full file content in prompts). That behavior is coherent with the stated purpose (reviewing files with Gemini), but it creates a real risk of exposing sensitive local data to whatever backend the `gemini` CLI uses. The SKILL.md includes sensible warnings about reviewing AI-generated shell before execution, but it does not require or demonstrate sanitization/filtering of secrets before sending files. The helper script gemini_review.sh includes file content in a command-line prompt (expected for the purpose) — overall scope is as-advertised, but privacy/exfiltration risk is notable.
Install Mechanism
No install spec is included (instruction-only skill). This is low-risk from an installation perspective because nothing will be downloaded or written by the skill itself.
Credentials
The skill declares no required environment variables or credentials, which is appropriate for a thin wrapper around a local CLI. However, the `gemini` CLI typically requires authentication (handled externally), and that auth may cause network calls outside the host — the skill does not request credentials but does instruct sending local content to the CLI, so the effective data flow depends on the CLI's behavior and authentication method.
Persistence & Privilege
The skill does not request always:on execution or system-wide configuration changes. It is user-invocable and does not claim elevated persistence or privileges.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install openclaw-gemini-cli - 安装完成后，直接呼叫该 Skill 的名称或使用
/openclaw-gemini-cli触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
Add first-time auth guidance and model switching notes
v1.0.0
Initial release: local Gemini CLI skill for OpenClaw exec-based orchestration
元数据
常见问题
OpenGemini CLI 是什么？
Use the local Gemini CLI for one-shot prompts, structured JSON output, shell-assisted research, and delegated AI-to-AI workflows on this Linux host. Use when... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 131 次。
如何安装 OpenGemini CLI？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install openclaw-gemini-cli」即可一键安装，无需额外配置。
OpenGemini CLI 是免费的吗？
是的，OpenGemini CLI 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
OpenGemini CLI 支持哪些平台？
OpenGemini CLI 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 OpenGemini CLI？
由 hiromps（@hiromps）开发并维护，当前版本 v1.0.1。
推荐 Skills