gemini-live-api-dev
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install official SDKs from trusted registries (Python's
google-genaiand Node.js's@google/genai). It also fetches documentation from Google's official domainai.google.dev. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process real-time, bidirectional streaming data (audio, video, and text). This creates an attack surface for indirect prompt injection where instructions could be embedded in the user's input streams. The skill explicitly warns that tool-call arguments should be treated as untrusted and validated server-side.
- [SAFE]: All external resources, including code repositories, SDKs, and documentation URLs, originate from Google, which is a trusted organization. No obfuscation, persistence mechanisms, or unauthorized privilege escalation attempts were found.
Audit Metadata