google-agents-cli-workflow
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [Project Configuration and Secret Management]: The skill manages project-specific settings and environment variables. It correctly identifies the risk of storing sensitive credentials in plain-text files and advises using managed services such as Google Cloud Secret Manager for secure handling of API keys and secrets.
- [Official Tooling and Dependencies]: The development workflow utilizes the
google-agents-clianduvpackage manager. These tools are central to the development lifecycle and are obtained from official repositories. Use of thegoogle-genaipackage is also documented for model management tasks. - [Reference Sample Integration]: The skill includes instructions to clone reference samples from a public repository on GitHub. This allows developers to study established code patterns and apply them to their own projects during the scaffolding phase.
- [Human-in-the-Loop Process]: To ensure the agent aligns with user intent and safety requirements, the skill requires explicit human review and approval for critical actions, such as finalizing design specifications and performing deployments to cloud environments.
- [Input Processing Surface]: The skill collects user requirements to generate a project design specification. This surface for processing external information is managed through specific steps:
- Ingestion points: User answers collected during the understanding phase (Phase 0) in
SKILL.md. - Boundary markers: A manual approval step is required before the
DESIGN_SPEC.mdis finalized. - Capability inventory: The skill uses
agents-clianduvfor shell-based task execution and scaffolding throughout the workflow. - Sanitization: The workflow incorporates a review process where the user validates the generated output before it is used for subsequent development steps.
Audit Metadata