Google Agents Cli

ReviewAudited by ClawScan on May 12, 2026.

Overview

This is a plausible Google Agents CLI onboarding skill, but it relies on an unpinned external setup command that installs multiple persistent agent skills not included in the review.

Only install this if you intend to add the Google Agents CLI toolchain to your coding agent. Before running `uvx google-agents-cli setup`, verify the package provenance, consider pinning a known version, inspect what skills it will install, and make sure you know how to disable or remove the added always-active behavior.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the setup could add or change agent behavior through code and skills whose contents were not reviewed here.

Why it was flagged

The primary setup path executes an unpinned external package command and uses it to install additional agent skills that are not present in the reviewed artifact set.

Skill content
Run this once to install the CLI and all 7 specialized skills into the user's coding agent:

    uvx google-agents-cli setup
Recommendation

Verify the package source and version, review what `google-agents-cli setup` installs, and prefer a pinned, documented install path before running it.

ConcernHigh Confidence
ASI10: Rogue Agents
What this means

After setup, future coding-agent sessions may be influenced by additional installed skills, including one that is always active.

Why it was flagged

The setup creates persistent agent behavior, including an always-active workflow skill, without the reviewed artifact showing the installed skill contents, scope limits, or removal controls.

Skill content
- `google-agents-cli-workflow` — full development lifecycle (always active)
Recommendation

Install only if you are comfortable adding persistent skills to your agent, and confirm how to inspect, disable, or uninstall the added skills.

What this means

Later use of the installed skills could affect cloud projects, production deployments, or enterprise agent registries.

Why it was flagged

The installed toolchain is intended to support cloud deployment and publishing workflows, which may later require Google Cloud or Gemini Enterprise account authority.

Skill content
- `google-agents-cli-deploy` — deploy to Agent Runtime, Cloud Run, or GKE
- `google-agents-cli-publish` — register agents with Gemini Enterprise
Recommendation

Use least-privilege Google credentials and confirm project, region, deployment, and publishing targets before approving those operations.

What this means

A user may place extra trust in the setup command because it appears to be Google-branded.

Why it was flagged

The skill presents itself as Google-authored and official-looking; because the registry source/homepage are not populated in the provided metadata, users should verify provenance before trusting the installer.

Skill content
metadata:
  author: Google
...
Entrypoint skill for [agents-cli](https://github.com/google/agents-cli) — Google's CLI
Recommendation

Confirm that the package and repository are the intended official Google Agents CLI distribution before running the setup.