Gemini CLI is a terminal-based AI agent that lets developers interact with Google Gemini models and use tools for tasks such as file operations, shell commands, web fetching, and search. Developers use it from the command line, and the catalogue add-ons extend its workflows and integrations.
Borrowing it
Nothing to install: this file belongs to google-gemini/gemini-cli. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/google-gemini/gemini-cli/main/.gemini/skills/agent-tui/SKILL.mdgit clone --depth 1 https://github.com/google-gemini/gemini-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/google-gemini/gemini-cli/agent-tui)<a href="https://agentmods.dev/skills/google-gemini/gemini-cli/agent-tui"><img src="https://agentmods.dev/badge/skills/google-gemini/gemini-cli/agent-tui/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/google-gemini/gemini-cli/agent-tui"><img src="https://agentmods.dev/badge/skills/google-gemini/gemini-cli/agent-tui.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 23 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 68 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- medium Excessive Agency · line 228 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- low Supply Chain · line 68 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00122 | $0.03187 |
| Opus 5.5 | $0.00049 | $0.01275 |
| Sonnet 5.5 | $0.00024 | $0.00637 |
| Haiku 4.5 | $0.00012 | $0.00319 |
Grade C, and why
agent-tui scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://raw.githubusercontent.com/pproenca/agent-tui/master/install.sh | sh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://raw.githubusercontent.com/pproenca/agent-tui/master/install.sh | sh How it starts
The opening of the file, as written. The whole thing — 331 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🚨 CRITICAL: macOS Daemon Workaround & Gemini CLI Usage 🚨
When using agent-tui in this macOS environment, the default background daemonization process crashes, causing Connection refused (os error 61) errors.
You MUST start the daemon manually shielded from TTY hangups before running any agent-tui commands. Using nohup is insufficient; you must use tmux to provide a fully isolated pseudo-terminal.
To support parallel runs, only restart the daemon if it is not currently running:
# Check if daemon is alive, start it in tmux if it is not
if ! agent-tui sessions >/dev/null 2>&1; then
tmux kill-session -t agent-tui 2>/dev/null || true
agent-tui daemon stop 2>/dev/null || true
rm -f /tmp/agent-tui*
tmux new-session -d -s agent-tui 'agent-tui daemon start --foreground > /tmp/agent-tui-daemon.log 2>&1'
sleep 1
fi
Session ID vs PID (Crucial for Reconnection)
When agent-tui run returns JSON, it includes both a session_id and a pid. The pid is purely informational (the OS process ID of the child command). You do not use the pid to reconnect or issue commands. You must always use the session_id (e.g., --session <id>).
If the daemon crashes (os error 61), the pseudo-terminal is destroyed. Even if the child pid survives as an orphan, you cannot reconnect to it. You must restart the daemon using the workaround above and start a completely new session.
Testing the Gemini CLI
When testing the Gemini CLI with agent-tui, there are several strict requirements to ensure deterministic and accurate behavior:
- Build Before Running:
agent-tuiruns the built JS files, not TypeScript. You MUST runnpm run buildornpm run build:allafter making code changes and before launching the CLI withagent-tui. - Bypass Trust Modals: Always pass
GEMINI_CLI_TRUST_WORKSPACE=truein the environment. If you don't, any new project-level agents or extensions will trigger a full-screen "Acknowledge and Enable" modal. This modal steals focus, swallows automation keystrokes, and causesagent-tui waitcommands to time out. - Isolated Environments: If you need to test without real user credentials or existing agents interfering, isolate the global settings using
GEMINI_CLI_HOME=<some-test-dir>. - Testing State Deltas (e.g., Reloads): If you are testing features that report deltas (e.g.,
/agents reloadoutputting "1 new local subagent"), you MUST:- Start the CLI first so it establishes its baseline registry.
- Use a separate shell command (outside of
agent-tui) to write the new agent.md/.tomlfile. - Use
agent-tui typeandpressto trigger the/agents reloadcommand inside the running session. - (If you add the files before starting the CLI, they become part of the baseline and won't trigger the delta logic).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 331 lines · 122 tokens per session scan C e5d1452e1089
agent-tui is a skill published in the GitHub repository google-gemini/gemini-cli (107,525 stars, last pushed today), licensed Apache-2.0. It adds 122 tokens to every session and 3,187 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
round-verification
Verify a CCB execution round and produce a machine-readable round result artifact.
node-check
Verify one CCB worker node and reject hidden fallback, degradation, scope shrinkage, or missing evidence.
team-lifecycle-v4
Full lifecycle team skill — plan, develop, test, review in one coordinated session. Role-based architecture with coordinator-driven beat model. Triggers on "team lifecycle v4".
team-testing
Unified team skill for testing team. Progressive test coverage through Generator-Critic loops, shared memory, and dynamic layer selection. Triggers on "team testing".
sinch-mailgun-inspect
Checks email quality before sending via Mailgun Inspect API. Use when previewing emails across clients, checking accessibility (WCAG), validating links, validating images, or analyzing email HTML/CSS compatibility.
sinch-mailgun-inspect
Checks email quality before sending via Mailgun Inspect API. Use when previewing emails across clients, checking accessibility (WCAG), validating links, validating images, or analyzing email HTML/CSS compatibility.