google-gemini-file-search
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to create retrieval-augmented generation (RAG) systems that ingest external documents (PDFs, Word, Excel, code, etc.) into a Google Gemini File Search store. This process introduces a vulnerability surface where adversarial content within these documents could potentially influence the behavior of the AI agent at query time.\n
- Ingestion Points: Documents are read from the local file system and uploaded to the Gemini API (SKILL.md, scripts/upload-batch.ts).\n
- Boundary Markers: The provided examples and templates do not implement specific delimiters or 'ignore' instructions to separate retrieved content from agent instructions.\n
- Capability Inventory: The skill is configured to allow broad tools including Bash, Read, Write, and WebFetch, which could be targeted by successful injection attacks.\n
- Sanitization: No content sanitization or validation logic is present in the management scripts; content is streamed directly to the API.\n- [EXTERNAL_DOWNLOADS]: The skill correctly instructs users to install the
@google/genaipackage. This is a legitimate dependency provided by Google, a well-known and trusted service provider.
Audit Metadata