adk-deploy-guide
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user to execute various shell commands for infrastructure management and deployment, including gcloud, terraform, gh, and make. It specifically utilizes uvx to run the agent-starter-pack CLI tool.
- [EXTERNAL_DOWNLOADS]: The use of uvx agent-starter-pack involves downloading and executing a Python package from a remote registry at runtime. The command includes an --auto-approve or -y flag in some instances, which bypasses manual review of the changes made by the tool.
- [REMOTE_CODE_EXECUTION]: The execution of agent-starter-pack via uvx constitutes a remote code execution pattern as the tool is fetched and run directly from a package repository.
- [PROMPT_INJECTION]: The skill documents an architecture that is vulnerable to indirect prompt injection by facilitating the ingestion of untrusted data from external triggers (Pub/Sub, Eventarc, BigQuery) into the agent context. 1. Ingestion points: FastAPI endpoints defined in reference/event-driven.md (e.g., /trigger/pubsub, /trigger/eventarc) receive payloads from external cloud services. 2. Boundary markers: Absent; the provided implementation examples do not use delimiters or provide instructions to the agent to ignore potentially malicious instructions embedded in the event data. 3. Capability inventory: The skill environment allows the use of Bash, Read, Write, and Edit tools, and the agent utilizes the vertexai and google-adk libraries for cloud operations. 4. Sanitization: Absent; the logic provided decodes and passes raw event data directly to the agent runner without validation or filtering.
Audit Metadata