agent-platform-skill-registry
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill utilizes local Python scripts located in the
scripts/directory to perform registry operations and environment validation. This is standard behavior for a development-focused skill that interacts with external APIs. - External Resource Interaction: The instructions specify the installation of well-known libraries (
google-auth,requests) and authentication via the official Google Cloud CLI (gcloud). These resources are provided by the vendor and are standard for interacting with Google Cloud services. - Service Communication: The Python scripts communicate with official Google API endpoints (
aiplatform.googleapis.com) using authenticated requests. The use of Application Default Credentials (ADC) is a recommended security practice for managing access to cloud resources. - Indirect Prompt Injection Considerations: The
Generate Skillcapability ingests user requirements to create new documentation and folder structures. While this involves processing untrusted user input, the skill documentation explicitly mandates human review and manual revision of all generated output before use, which serves as an important security boundary.
Audit Metadata