gemini-agents-api

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly allows mounting remote skill content from a Google Cloud Storage URI (gs://your-agent-bucket-name/skills) or the Skill Registry (projects/your-project-id/locations/global/skills/...), and it routes tool execution to external MCP servers (e.g., https://mcp.yourcompany.com/api) at runtime — all of which can inject instructions or execute remote code inside the agent container, so these external URLs are runtime dependencies that can directly control agent behavior.