finding-google-skills

Pass

Audited by Gen Agent Trust Hub on Aug 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [Remote Resource Retrieval]: The skill instructs the agent to fetch a catalog index and individual skill files from https://raw.githubusercontent.com/google/skills/main/. While this involves downloading external content, the resource belongs to the official repository of the skill's author, which is a standard method for maintaining up-to-date documentation without preloading excessive data.
  • [Shell Command Usage]: The instructions recommend using curl, wget, or a basic node fetch snippet to retrieve the JSON catalog and subsequent Markdown files. These commands are used strictly for data retrieval (fetching bytes) rather than installing packages or modifying system state.
  • [Dynamic Skill Loading]: The skill implements a 'fetch-on-demand' pattern where the agent identifies and retrieves relevant skill instructions at runtime. This is a common architectural pattern for large skill ecosystems to manage context window limits and ensure the agent uses the most recent instructions available from the vendor.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 29, 2026, 07:20 PM
Security Audit — agent-trust-hub — finding-google-skills