cloud-agents-cli
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct users to clone a source repository from GitHub (pifferologo/cloud-agents-cli) and install the library via the npm registry (cloud-agents-cli).
- [EXTERNAL_DOWNLOADS]: Fetches additional configuration and agent skills from Google's official repository using the command npx skills add google/agents-cli.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and process content from Google Workspace services, which serves as an ingestion surface for potentially malicious instructions embedded in external data.
- Ingestion points: Google Drive, Gmail, Calendar, Sheets, Docs, Chat, and Admin APIs.
- Boundary markers: Absent; there are no instructions provided to the agent to treat external content as untrusted data or to ignore embedded commands.
- Capability inventory: The skill possesses the ability to interact with Google Cloud APIs and execute CLI commands.
- Sanitization: Absent; the provided documentation does not describe any validation or sanitization mechanisms for the data retrieved from Workspace services.
Audit Metadata