gemini-api
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents secure credential handling, advising that API keys like GEMINI_API_KEY and GOOGLE_API_KEY be stored in environment variables and used only in backend environments to prevent client-side exposure.
- [SAFE]: It utilizes official and reputable libraries from Google (@google/genai and google-genai) for its integration logic.
- [SAFE]: Implementation guidance for tools and function calling includes security controls such as schema validation, least privilege, and mandatory human confirmation for destructive operations.
- [SAFE]: The skill addresses potential indirect prompt injection surfaces. 1. Ingestion points: contents parameter in generateContent and chat session messages. 2. Boundary markers: Recommended use of systemInstruction to define agent behavior. 3. Capability inventory: SDK calls to Gemini models and function calling loops. 4. Sanitization: Recommendations for schema validation and human-in-the-loop review for destructive actions.
Audit Metadata