agent-platform-tuning
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Command Execution]: The skill uses shell commands and the
gcloudCLI to manage cloud resources, check authentication, and enable services. While these are administrative actions, the skill incorporates guardrails requiring the agent to stop and ask for user confirmation before executing mutating actions like creating buckets or submitting jobs. - [Dynamic Execution]: The instructions describe generating and executing Python scripts (e.g., in
/tmp/) to interact with the Vertex AI SDK. This pattern is used to handle complex API calls for model tuning and is common in development-focused skills. - [Indirect Prompt Injection]: The skill processes external data from local files, Google Cloud Storage, and Hugging Face datasets. If these datasets contain adversarial instructions, they could potentially influence the agent's behavior during the 'preview' or 'validation' steps. The skill mitigates this by instructing the agent to show samples to the user for manual review.
- [External Downloads]: The skill fetches datasets from Hugging Face and manages Python dependencies via
pip. These interactions involve well-known, trusted platforms and are necessary for the skill's primary function of model tuning.
Audit Metadata