gemini-live-api

• Isolated Environment Usage: The skill instructions explicitly direct the agent to create isolated environments, such as a Python virtual environment (venv), and to generate a setup.sh script within a user-defined output folder. This is a positive security pattern that prevents the skill from mutating the host's global environment and avoids the need for elevated permissions.
• Credential Management: It recommends obtaining bearer tokens via Application Default Credentials (ADC) for WebSocket authentication and specifically warns against hardcoding long-lived API keys. This practice minimizes the risk of credential exposure and follows industry best practices for identity and access management.
• Code Generation Surface: A primary function of this skill is the generation of client classes, test files, and a demonstration frontend/backend. While generating executable code is a sensitive operation, the instructions define strict boundaries and types based on provided Protobuf schemas, which helps ensure the generated code remains consistent with the intended service contract.
• External Documentation Ingestion: The skill involves an 'Indirect Prompt Injection' surface where the agent is asked to reconcile local reference files with external public documentation. This requires the agent to process potentially untrusted external content, which could theoretically contain instructions to influence the code generation process. However, this risk is localized to the intended purpose of maintaining API compatibility.

Indirect Prompt Injection Evidence Chain:

• Ingestion points: Files in the references/ directory and external documentation linked from client_server_messages.md (e.g., Google Cloud documentation).
• Boundary markers: None explicitly defined in the processing instructions to separate documentation content from generation rules.
• Capability inventory: File writing (source code, bash scripts), shell execution (venv setup), and network operations (WebSocket connectivity).
• Sanitization: No specific sanitization or filtering instructions are provided for the content retrieved from external URLs during the reconciliation step.