google-adk
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: All external dependencies referenced in the installation guides and code examples (such as
google-adk,litellm, and@google/adk) originate from trusted organizations or well-known service registries. - [SAFE]: The skill uses industry-standard patterns for credential management, advising users to store API keys in environment variables or secret managers rather than hardcoding them in the agent's logic.
- [SAFE]: No obfuscation, data exfiltration patterns, or unauthorized privilege escalation commands were detected. The use of base64 in examples is confined to standard media (image/audio) handling within the Gemini Live API context.
- [INDIRECT_PROMPT_INJECTION]: The skill documents features such as 'Google Search Grounding' and 'Vertex AI Search Grounding'. While these provide surfaces for indirect prompt injection (where instructions from external search results could influence agent behavior), the documentation explicitly addresses these risks in a dedicated safety section and recommends best practices like sandboxing and output escaping. As these are documented framework features, they do not constitute a malicious finding for this skill.
Audit Metadata