google-agents-cli-onboarding
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
google-agents-cliviauvxand add expert skills from thegoogle/agents-clirepository. These references target a trusted organization and are documented neutrally. - [COMMAND_EXECUTION]: The skill documentation includes commands for setting up the environment, scaffolding new projects, running evaluations, and deploying agents to Google Cloud platforms such as Vertex AI, Cloud Run, and GKE. These are standard operations for the tool's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a development workflow that involves reading project specifications from
.agents-cli-spec.mdand studying external code samples. While this creates a surface for processing untrusted data, it is a primary function of the CLI tool's intended use case. - Ingestion points: Project specifications in
.agents-cli-spec.mdand external agent samples (e.g.,ambient-expense). - Boundary markers: Not explicitly defined in this onboarding entrypoint.
- Capability inventory: File system writes (
scaffold), network operations, and cloud deployment (deploy,publish). - Sanitization: Not explicitly defined in the high-level instructions.
Audit Metadata