fix(ci): update Gemini model and harden update-skill against prompt injection

[dkhawk]

Summary

Updates the Gemini model in .github/scripts/update_skill.py to default to gemini-3.8-flash and implements comprehensive hardening across .github/scripts/update_skill.py and .github/workflows/update-skill.yml to protect against indirect prompt injection and supply-chain tampering (referencing GHSA-8f2g-33j4-ghwg).

Background & Vulnerability

External pull requests or commit messages in release diffs can contain adversarial prompt directives. If ingested unescaped, an attacker could manipulate update_skill.py into injecting malicious instructions or compromised dependencies into .gemini/skills/android-maps-compose/SKILL.md.

Hardening Measures Applied

1. API Role Separation (system_instruction):
   • Uses Gemini API's top-level system_instruction parameter to isolate operational rules and security boundaries from untrusted diff content.
2. Input Fencing & Sanitization:
   • Encloses inputs inside <current_skill_file> and <untrusted_release_diff> XML blocks and sanitizes potential delimiter escape sequences.
   • Caps diff input length at 60k characters to prevent context exhaustion attacks.
3. Diff Scope Filtering:
   • Scopes git diff to code and build files only, explicitly excluding documentation (*.md, *.txt), images, and workflow files (.github/) where natural language injections typically hide.
4. Deterministic Pre-Commit Guardrails (validate_skill_content):
   • Verifies YAML frontmatter integrity.
   • Verifies preservation of critical version anchors (// x-release-please-version).
   • Rejects suspicious content drift (length ratio < 0.5 or > 2.0).
   • Scans for known prompt injection phrases and shell execution patterns before writing to disk.
5. Workflow & CI/CD Protections:
   • Removed the automerge label so AI-generated skill updates always require maintainer approval.
   • Configured peter-evans/create-pull-request to create draft PRs with required reviewers (LoyalAbbas, kikoso).
   • Updated bot author/committer emails to use googlemaps-bot@users.noreply.github.com.
   • Added Python cache (__pycache__/, *.py[cod]) to .gitignore.

[googlemaps-bot]

Code Coverage

Overall Project	24.59%	❌

There is no coverage information present for the Files changed