sign-in-with-google-web
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- External Script Integration: The skill incorporates the Google Identity Services SDK by loading scripts from official Google domains (e.g.,
https://accounts.google.com/gsi/client). This is a standard and expected practice for identity provider integrations. - Data Ingestion and Processing Considerations: The implementation involves ingesting identity credentials (JWTs) from external sources. To ensure security, the skill provides the following evidence chain:
- Ingestion Points: Credentials are received via JavaScript callbacks or form POST requests as seen in the BFF and TMB reference files.
- Boundary Markers: Instructions mandate the use of cryptographic signature verification, audience checks, and nonce validation to ensure data integrity.
- Capability Inventory: The provided recipes include session management, cookie issuance, and navigation control.
- Sanitization: The skill demonstrates the use of official vendor libraries (e.g.,
google-auth) to perform rigorous server-side verification of all ingested identity tokens before they are trusted. - Secure Storage and Cookie Management: The skill follows security best practices by recommending
HttpOnly,Secure, andSameSiteflags for session cookies, and utilizing the Web Cryptography API for encrypted storage in Progressive Web Apps (PWAs).
Audit Metadata