fix(docs): distinguish dependency working directory from sandbox setup

Open Beginner friendly
  • Is something wrong?
#179 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
devtools, documentation

Research direction

Start with step 5 of the dependency-manager skill in skills/dependency-manager/SKILL.md, then read the directory-selection branch of the install_dependencies handler in mcp-server/src/index.ts, around lines 227-263. Confirm that targetFile only picks the cwd by searching up to five directories for package.json or requirements.txt. Done means the skill wording states that targetFile selects a working directory and that any sandbox is a separate host prerequisite.

Written by the indexing model from the issue text.

Description

Summary

The dependency-manager skill says that passing targetFile to install_dependencies lets the tool calculate isolated execution contexts. The tool instead calculates the script's working directory. Please distinguish this directory selection from any sandbox configured in the Gemini CLI host, so that the skill accurately explains what this argument provides.

Runtime or environment

This is a source and published-artifact documentation comparison, not an executed dependency-installation test. The latest published extension release is v0.5.0, whose tag resolves to 0e4812c469a61fb87e29ce939f393715221553fb; current main is 2227f3cf7150972baac695b8233abc2186408538. The release's linux.x64.security.tar.gz contains the same dependency-manager skill as main, and its compiled MCP helper performs the same directory calculation. Host sandbox behavior was checked in Gemini CLI v0.66.0 source at 970413207732f5d4d8c50540c7fc359c44fdaaf2.

Steps to reproduce

  1. Read step 5, “Trigger Isolated Execute,” in the dependency-manager skill on either extension baseline.
  2. Follow the registered install_dependencies tool implementation, considering an invocation with targetFile set to /workspace/project/src/example.ts, no cwd override, an existing /workspace/project/package.json, and neither package.json nor requirements.txt in /workspace/project/src.
  3. Inspect the use of the calculated directory: it becomes the cwd option for executing the provided script. These are static inspection steps; no generated script, dependency installation, or PoC was executed.

Expected behavior

The skill should describe the argument's actual effect: selecting a working directory by looking for a nearby manifest. If isolated execution requires an already configured host sandbox or a separate environment established by the generated script, state that prerequisite rather than attributing its creation to targetFile.

Actual behavior

The skill describes this argument as letting the tool “calculate isolated execution contexts.” For the example above, the helper finds package.json and selects /workspace/project as executionDir. It checks at most five directories for package.json or requirements.txt, then passes the selected directory as cwd to execFileAsync(input.scriptPath, { cwd: executionDir }). That calculation does not itself create a separate dependency environment.

Gemini CLI can provide a surrounding sandbox: when configured for full-process sandboxing, it relaunches the CLI before loading extensions, and the configured Node MCP server runs as a child in that environment. This report does not assert that MCP execution always lacks a sandbox, that a host sandbox is bypassed, or that a vulnerability was reproduced. It concerns the narrower description of what targetFile calculates.

Evidence

Runtime reproduction was not run. The extension manifest registers the Node MCP server, which exposes this tool directly; the supplied valid argument shape reaches the directory-selection branch without another environment-creation step in that helper. The skill, helper, extension manifest, published artifact, and host launch code were inspected.

Host counterevidence: CLI sandbox relaunch before extension loading and stdio MCP child transport. These are distinct from the helper's directory calculation.

Restoration check

Reading step 5 alongside the helper should accurately predict the selected working directory for the example above and distinguish that selection from the surrounding execution environment. A documentation clarification can meet this check without changing dependency execution behavior.

Triage assessment

  • Impact level: P3
  • Assessment status: supported
  • Impact basis: This report establishes misleading wording about an argument's effect. No harmful execution, sandbox escape, or consequential runtime failure was observed.
  • Workaround status: available
  • Workaround basis: The tool's own description identifies workspace script execution, and its source exposes the directory calculation; users can consult Gemini CLI's sandbox configuration separately.
Dominant language
TypeScript
Stars
793
Forks
60
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from gemini-cli-extensions/security

All issues in gemini-cli-extensions/security

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.