gemini-agents-api

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill configuration mounts remote skills from "gs://your-agent-bucket-name/skills" into the agent workspace and configures a third-party MCP endpoint "https://mcp.yourcompany.com/api" that the platform will call at runtime to execute tools, meaning external content/servers can directly influence agent instructions and execution.