fix(docs): distinguish dependency working directory from sandbox setup

从 skills/dependency-manager/SKILL.md 中 dependency-manager skill 的第 5 步开始，然后阅读 mcp-server/src/index.ts 中 install_dependencies 处理程序里目录选择的分支，大约在第 227-263 行。确认 targetFile 只是通过向上最多搜索五级目录查找 package.json 或 requirements.txt 来选择 cwd。完成标准是：skill 文案说明 targetFile 用于选择工作目录，并且任何沙箱都是宿主机上单独的前提条件。

Summary

The dependency-manager skill says that passing targetFile to install_dependencies lets the tool calculate isolated execution contexts. The tool instead calculates the script's working directory. Please distinguish this directory selection from any sandbox configured in the Gemini CLI host, so that the skill accurately explains what this argument provides.

Runtime or environment

This is a source and published-artifact documentation comparison, not an executed dependency-installation test. The latest published extension release is v0.5.0, whose tag resolves to 0e4812c469a61fb87e29ce939f393715221553fb; current main is 2227f3cf7150972baac695b8233abc2186408538. The release's linux.x64.security.tar.gz contains the same dependency-manager skill as main, and its compiled MCP helper performs the same directory calculation. Host sandbox behavior was checked in Gemini CLI v0.66.0 source at 970413207732f5d4d8c50540c7fc359c44fdaaf2.

Steps to reproduce

1. Read step 5, “Trigger Isolated Execute,” in the dependency-manager skill on either extension baseline.
2. Follow the registered install_dependencies tool implementation, considering an invocation with targetFile set to /workspace/project/src/example.ts, no cwd override, an existing /workspace/project/package.json, and neither package.json nor requirements.txt in /workspace/project/src.
3. Inspect the use of the calculated directory: it becomes the cwd option for executing the provided script. These are static inspection steps; no generated script, dependency installation, or PoC was executed.

Expected behavior

The skill should describe the argument's actual effect: selecting a working directory by looking for a nearby manifest. If isolated execution requires an already configured host sandbox or a separate environment established by the generated script, state that prerequisite rather than attributing its creation to targetFile.

Actual behavior

The skill describes this argument as letting the tool “calculate isolated execution contexts.” For the example above, the helper finds package.json and selects /workspace/project as executionDir. It checks at most five directories for package.json or requirements.txt, then passes the selected directory as cwd to execFileAsync(input.scriptPath, { cwd: executionDir }). That calculation does not itself create a separate dependency environment.

Gemini CLI can provide a surrounding sandbox: when configured for full-process sandboxing, it relaunches the CLI before loading extensions, and the configured Node MCP server runs as a child in that environment. This report does not assert that MCP execution always lacks a sandbox, that a host sandbox is bypassed, or that a vulnerability was reproduced. It concerns the narrower description of what targetFile calculates.

Evidence

• Expected source: dependency-manager skill, step 5.
• Failure source: registered tool and complete directory-selection branch; the published artifact's mcp-server/dist/index.js contains the corresponding code.
• Evidence provenance: static
• Local verification: static-proof
• Reproduction completeness: complete

Runtime reproduction was not run. The extension manifest registers the Node MCP server, which exposes this tool directly; the supplied valid argument shape reaches the directory-selection branch without another environment-creation step in that helper. The skill, helper, extension manifest, published artifact, and host launch code were inspected.

Host counterevidence: CLI sandbox relaunch before extension loading and stdio MCP child transport. These are distinct from the helper's directory calculation.

Restoration check

Reading step 5 alongside the helper should accurately predict the selected working directory for the example above and distinguish that selection from the surrounding execution environment. A documentation clarification can meet this check without changing dependency execution behavior.

Triage assessment

• Impact level: P3
• Assessment status: supported
• Impact basis: This report establishes misleading wording about an argument's effect. No harmful execution, sandbox escape, or consequential runtime failure was observed.
• Workaround status: available
• Workaround basis: The tool's own description identifies workspace script execution, and its source exposes the directory calculation; users can consult Gemini CLI's sandbox configuration separately.