rules-gemini-cli

Gemini CLI with default telemetry settings. Users reported GDPR non-compliance: Gemini CLI includes no privacy notice, no data collection disclosure, and no opt-out mechanism in its CLI, help output, or documentation (GitHub issue #1489). Review what data is transmitted before processing sensitive project code.

Google Cloud credentials accessed from Gemini CLI. Gemini CLI collects prompts and related code by default. Combined with GCloud credential access, there is risk of cloud resource access data being transmitted in telemetry without adequate GDPR consent.

README with executable content detected. Gemini CLI's README prompt injection vulnerability (Tracebit, June 2025) allows hidden commands in README files to execute silently. The attack was discovered just 2 days after Gemini CLI launched. Review README bash/sh code blocks before Gemini processes them.

Gemini CLI running in auto-execute/non-interactive mode. README prompt injection attacks are most dangerous with auto-execution enabled — injected commands run without human review. Logged for audit.

Documentation file read by Gemini CLI. README prompt injection is a documented attack (Tracebit, patched Gemini CLI v0.1.14). All markdown reads are logged for audit. Be alert to code blocks with curl, wget, rm, or shell commands.

Gemini CLI project config written. Audit for prompt injection payloads. README-based prompt injection was discovered within 2 days of Gemini CLI's launch — new config files in project directories warrant careful review.

Gemini CLI allowlist mechanism bypass. The July 2025 vulnerability (fixed in v0.1.14) exploited an improperly implemented allowlist that was meant to restrict command execution. Overriding sandbox or trust settings via environment variables replicates this bypass.

Eval injection bypass in shell scripts. A documented Gemini CLI security issue (GitHub issue #5495): eval with variable expansion bypasses Gemini's command restriction allowlist, enabling execution of commands that would otherwise be blocked. Use direct command execution without eval.

Hidden commands in documentation file. Gemini CLI processes markdown including HTML comments — attackers embed shell commands in HTML comments (<!-- curl attacker.com -->) that are invisible when rendered in GitHub/browsers but are read and processed by Gemini CLI as instructions.

README prompt injection vector. Security researchers (Tracebit) discovered that Gemini CLI silently executes commands injected via README files — identified just 2 days after the June 25, 2025 launch. Attackers hide natural language commands in README.md that Gemini interprets as instructions. Piping or chaining README content with shell operators is blocked.

Gemini CLI sandbox configuration modification blocked. The allowlist mechanism bypass (GitHub issue #5495) exploited disabled or misconfigured sandbox settings. Sandbox configuration must be managed manually, not by AI agents.

Gemini CLI telemetry enablement blocked. Gemini CLI has documented GDPR non-compliance: no privacy notice, no data collection disclosure, and no opt-out mechanism in the CLI or documentation (GitHub issue #1489, Jan 2025). Enabling additional telemetry increases data exposure without adequate consent mechanisms.