google-agents-cli-adk-code
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch documentation and indices from
adk.devusingcurland links to various documentation pages for the ADK ecosystem. - [COMMAND_EXECUTION]: The documentation includes instructions for users to install necessary development tools and libraries using package managers such as
uvandpip(e.g.,uv tool install google-agents-cli,pip install --pre google-adk). - [DYNAMIC_EXECUTION]: The skill provides a snippet to verify environment configuration by dynamically listing available Gemini models via
uv runand thegoogle-genaiPython library. - [METADATA_POISONING]: The skill metadata lists 'Google' as the author while the skill is distributed by 'oscarrondon-dev'. This is evaluated as a descriptive attribution for the API being documented rather than an attempt at malicious impersonation, as the content is technical and helpful.
- [INDIRECT_PROMPT_INJECTION]: As a development reference, the skill guides users in creating agents that ingest external data (e.g., via
node_inputor tool responses). It provides standard patterns for handling this data, such as using Pydantic models for structured output and validation, which helps mitigate injection risks in the agents being built.
Audit Metadata