gemini-api
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and model metadata from official Google domains (ai.google.dev and cloud.google.com), which are well-known and trusted services.
- [COMMAND_EXECUTION]: Instructions include installing official, widely-used SDKs (@google/generative-ai and @google-cloud/vertexai) through standard package managers (pnpm).
- [CREDENTIALS_UNSAFE]: The skill demonstrates security best practices by instructing the user to store API keys in .env.local files rather than hardcoding them in the source code.
- [PROMPT_INJECTION]: The skill ingest documentation from trusted sources and user-provided code files to assist with development; while this represents an indirect injection surface, it is necessary for the skill's primary function and lacks malicious intent markers.
Audit Metadata