@ai-plugins-cc/gemini
Use Gemini from Claude Code to review code or delegate tasks.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:silent-process-exec | AI (semgrep): Spawns own script as a task worker with fixed args; not a reverse shell or miner pattern. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same detached task-worker spawn; scriptPath is derived from package's own ROOT_DIR. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Passes process.env to Gemini CLI subprocess; standard pattern for CLI wrappers needing inherited env vars. | ai | |
| phantom-deps | phantom-dep:@ai-plugins-cc/shared-prompts | AI (phantom-deps): Same-org scoped package declared as dependency; likely used transitively or via dynamic import in the companion script. | ai |
v0.1.1
5 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/dysfunc/ai-plugins-cc/blob/175fa81430f60cfdf16be083249ace1208df7a70/scripts/gemini-companion.mjs#L691 689 | function spawnDetachedTaskWorker(cwd, jobId) { 690 | const scriptPath = path.join(ROOT_DIR, "scripts", "gemini-companion.mjs"); > 691 | const child = spawn(process.execPath, [scriptPath, "task-worker", "--cwd", cwd, "--job-id", jobId], { 692 | cwd, 693 | env: process.env,
Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/dysfunc/ai-plugins-cc/blob/175fa81430f60cfdf16be083249ace1208df7a70/scripts/gemini-companion.mjs#L691 689 | function spawnDetachedTaskWorker(cwd, jobId) { 690 | const scriptPath = path.join(ROOT_DIR, "scripts", "gemini-companion.mjs"); > 691 | const child = spawn(process.execPath, [scriptPath, "task-worker", "--cwd", cwd, "--job-id", jobId], { 692 | cwd, 693 | env: process.env,
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/dysfunc/ai-plugins-cc/blob/175fa81430f60cfdf16be083249ace1208df7a70/scripts/lib/gemini.mjs#L133 131 | const child = spawn(DEFAULT_BIN, args, { 132 | cwd, > 133 | env: { ...process.env, ...(options.env ?? {}) }, 134 | stdio: ["pipe", "pipe", "pipe"], 135 | detached: process.platform !== "win32"
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/dysfunc/ai-plugins-cc/blob/175fa81430f60cfdf16be083249ace1208df7a70/scripts/stop-review-gate-hook.mjs#L97 95 | const scriptPath = path.join(SCRIPT_DIR, "gemini-companion.mjs"); 96 | const prompt = buildStopReviewPrompt(input); > 97 | const childEnv = { 98 | ...process.env, 99 | ...(input.session_id ? { [SESSION_ID_ENV]: input.session_id } : {})
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
5 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/dysfunc/ai-plugins-cc/blob/468b26667f7a9e2d4b0185807d6bb903bf7b99fd/scripts/gemini-companion.mjs#L691 689 | function spawnDetachedTaskWorker(cwd, jobId) { 690 | const scriptPath = path.join(ROOT_DIR, "scripts", "gemini-companion.mjs"); > 691 | const child = spawn(process.execPath, [scriptPath, "task-worker", "--cwd", cwd, "--job-id", jobId], { 692 | cwd, 693 | env: process.env,
Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/dysfunc/ai-plugins-cc/blob/468b26667f7a9e2d4b0185807d6bb903bf7b99fd/scripts/gemini-companion.mjs#L691 689 | function spawnDetachedTaskWorker(cwd, jobId) { 690 | const scriptPath = path.join(ROOT_DIR, "scripts", "gemini-companion.mjs"); > 691 | const child = spawn(process.execPath, [scriptPath, "task-worker", "--cwd", cwd, "--job-id", jobId], { 692 | cwd, 693 | env: process.env,
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/dysfunc/ai-plugins-cc/blob/468b26667f7a9e2d4b0185807d6bb903bf7b99fd/scripts/lib/gemini.mjs#L133 131 | const child = spawn(DEFAULT_BIN, args, { 132 | cwd, > 133 | env: { ...process.env, ...(options.env ?? {}) }, 134 | stdio: ["pipe", "pipe", "pipe"], 135 | detached: process.platform !== "win32"
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/dysfunc/ai-plugins-cc/blob/468b26667f7a9e2d4b0185807d6bb903bf7b99fd/scripts/stop-review-gate-hook.mjs#L97 95 | const scriptPath = path.join(SCRIPT_DIR, "gemini-companion.mjs"); 96 | const prompt = buildStopReviewPrompt(input); > 97 | const childEnv = { 98 | ...process.env, 99 | ...(input.session_id ? { [SESSION_ID_ENV]: input.session_id } : {})
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.