gemini-api-dev
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation from official Google domains (ai.google.dev and googleapis.com), which are recognized and trusted sources.
- [SAFE]: The skill uses official and current SDKs (google-genai and @google/genai) as recommended by the vendor.
- [SAFE]: Sensitive credentials like GOOGLE_API_KEY are managed via environment variables rather than being hardcoded in scripts.
- [SAFE]: The skill contains an indirect prompt injection surface by fetching external documentation to guide code generation. Evidence chain: 1. Ingestion points: SKILL.md (instructions to fetch ai.google.dev content). 2. Boundary markers: Absent. 3. Capability inventory: Bash, Write, and Edit tools are permitted. 4. Sanitization: Absent. The risk is considered safe as the content originates from authoritative vendor documentation.
Audit Metadata