finding-google-skills
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [Remote Resource Retrieval]: The skill instructs the agent to fetch a catalog index and individual skill files from
https://raw.githubusercontent.com/google/skills/main/. While this involves downloading external content, the resource belongs to the official repository of the skill's author, which is a standard method for maintaining up-to-date documentation without preloading excessive data. - [Shell Command Usage]: The instructions recommend using
curl,wget, or a basicnodefetch snippet to retrieve the JSON catalog and subsequent Markdown files. These commands are used strictly for data retrieval (fetching bytes) rather than installing packages or modifying system state. - [Dynamic Skill Loading]: The skill implements a 'fetch-on-demand' pattern where the agent identifies and retrieves relevant skill instructions at runtime. This is a common architectural pattern for large skill ecosystems to manage context window limits and ensure the agent uses the most recent instructions available from the vendor.
Audit Metadata