google-gemini-api
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and installs the @google/genai package from the official NPM registry. This is an official SDK provided by Google, which is a trusted organization.
- [CREDENTIALS_UNSAFE]: Educational templates and examples correctly utilize environment variables (e.g., GEMINI_API_KEY) for authentication. This adheres to security best practices for secret management and ensures that API keys are not hardcoded in the source code.
- [PROMPT_INJECTION]: Several templates, including those for Cloudflare Workers and basic usage (e.g., templates/cloudflare-worker.ts and templates/basic-usage.ts), ingestion untrusted user input directly into model prompts. These examples do not include explicit boundary markers or instruction-ignoring delimiters, which presents a surface for indirect prompt injection. This is a common design pattern in educational templates but remains a relevant risk factor for developers to address with sanitization or delimiters.
Audit Metadata