A Claude Code skill that delegates coding tasks to Google's Gemini CLI via the Agent Client Protocol (ACP) -- structured JSON-RPC communication instead of shell subprocess piping.
SaferSkills independently audited gemini-delegate (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Delegate tasks to Gemini via ACP bridge. Verification MANDATORY.
scripts/gemini_bridge.py only. NEVER call gemini directly.--prompt-stdin to prevent deadlocks.--output-file AUTO for unique result files.SESSION_ID from JSON for follow-ups.WebSearch: (e.g., WebSearch: API news 2026).WebSearch. Report in one line.| Task | Model | Template |
|---|---|---|
| Review (<200 lines) | gemini-3-flash-preview | Focused review |
| Bug/Arch (>3 files) | gemini-3.1-pro-preview | Tool-assisted |
| Search/Info | gemini-3-flash-preview | Web search |
| Adversarial/Plan | gemini-3.1-pro-preview | Critique |
| Flag | Description | Default | |||
|---|---|---|---|---|---|
--prompt | Prompt text | ||||
--prompt-file | Read prompt from file | ||||
--prompt-stdin | Read from stdin (MANDATORY for automation) | ||||
--session-id | Resume specific session | ||||
--new-session | Force fresh session | ||||
--sessions-dir | Override session storage dir | ||||
--cd | Workspace root directory | . | |||
--timeout | Total max wall-clock seconds | 600 | |||
--idle-timeout | Max seconds between chunks | 120 | |||
--first-chunk-timeout | Max seconds for first chunk | 300 | |||
--verbose | Print heartbeat markers to stderr | ||||
--output-file | Write JSON to file (AUTO for unique temp) | ||||
--approve-edits | Allow file writes within --cd scope | ||||
--cache | Content-addressed git-based caching | off | |||
--cache-ttl | Cache TTL in seconds (1-2592000) | 86400 | |||
--clear-cache | Clear result cache and exit | ||||
--parallel-models | Comma-separated models for parallel runs | ||||
--log-feedback | Append feedback entry `VERDICT | TASK | TOKENS | NOTE` | |
--model | Gemini model to use |
{
"success": true,
"SESSION_ID": "...",
"agent_messages": "...",
"read_file_count": N,
"fallback_occurred": boolean,
"requested_model": "...",
"actual_model_selection": "specified"|"automatic",
"tool_calls": [...],
"token_estimate": { "estimated_cost_usd": 0.00 }
}Violating the letter of these rules violates the spirit. STOP if:
read_file_count is 0 for code analysis (Gemini is guessing).fallback_occurred: true). Alert user immediately.gemini directly. Revert and use bridge.WebSearch: prefix. Re-run with prefix.| Excuse | Reality |
|---|---|
| "I know this code already." | Code changes. RE-VERIFY key logic via read_file. |
| "File names explain it." | Guessing = fabrication. READ content. |
| "I'll skip WebSearch: prefix." | Internal 2026 knowledge is fabrication. GROUND every claim. |
| "Pro failed, Flash is fine." | pro-preview is the tier for logic. Fallback must be reported. |
--approve-edits required for file writes.--log-feedback after every task.assets/prompt-template.md: Task templates.assets/reference.md: Logs, parallel runs, capsules.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.