google-gemini-image
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate and highly detailed documentation for the Google Gemini image generation ecosystem, including the Interactions API and Google Cloud Vertex AI integration.
- [DATA_EXFILTRATION]: Python code snippets demonstrate secure handling of API keys using environment variables (os.environ["GEMINI_API_KEY"]) and the standard genai.Client() initialization, which is a recommended security practice.
- [EXTERNAL_DOWNLOADS]: All network operations and resource links target official, trusted Google domains such as ai.google.dev, googleapis.com, and cloud.google.com. These are recognized as safe, well-known services.
- [OBFUSCATION]: The use of base64.b64decode in the examples is for the functional purpose of processing image binary data from API responses and does not involve hiding malicious code or commands.
- [INDIRECT_PROMPT_INJECTION]: The skill explicitly addresses the risks associated with processing external image data (reference images in SKILL.md), mandating the use of reference ledgers and explicit prompts (boundary markers), model capability inventory, and independent human/OCR verification (sanitization) to prevent unintended model behavior.
Audit Metadata