Google Agents Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent onboarding helper, but it asks users or agents to run an unpinned remote setup command that installs multiple additional agent skills not included in this review.

Review before installing. Only run the setup if you intentionally want the Google agents-cli toolchain added to your coding-agent environment, and prefer a pinned, verified package version or an isolated environment with no unnecessary credentials or sensitive project access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned External Package Execution and Transitive Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14 and 21–39
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

requires:
  bins:
    - agents-cli
  install: "uvx google-agents-cli setup"

markdown

> Requires: `agents-cli` and `uv`
> One-time setup: `uvx google-agents-cli setup`
> [Install uv](https://docs.astral.sh/uv/getting-started/installation/index.md) first if needed.

## Setup

Run this once to install the CLI and all 7 specialized skills into the
user's coding agent:

    uvx google-agents-cli setup

After setup, the following skills become available and activate
automatically based on the user's request:

- `google-agents-cli-workflow` — full development lifecycle (always active)
- `google-agents-cli-scaffold` — create new ADK projects, add CI/CD or deployment
- `google-agents-cli-adk-code` — ADK Python API reference (agent types, tools, callbacks)
- `google-agents-cli-eval` — run and debug agent evaluations
- `google-agents-cli-deploy` — deploy to Agent Runtime, Cloud Run, or GKE
- `google-agents-cli-publish` — register agents with Gemini Enterprise
- `google-agents-cli-observability` — production tracing, logging, monitoring

Technical Analysis

The skill instructs the user to resolve and execute google-agents-cli through uvx without specifying an exact version, package hash, lockfile, or immutable source revision. The implementation executed by this command is not included in the audited project and can change independently after review.

The command also installs seven additional skills into the user's coding-agent environment. Those transitive skills are absent from the project and therefore could not be inspected. Their documented automatic activation expands the trust boundary from the single reviewed file to mutable external package content and subsequently installed agent instruction ...[truncated 1623 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin google-agents-cli to a specific, reviewed release rather than resolving the latest available version.
2. Verify the package using trusted hashes, signed provenance, or an immutable source revision.
3. Use a lockfile or equivalent reproducible dependency manifest covering transitive dependencies.
4. Include the exact seven installed skill definitions in the review scope, or publish verifiable references to their pinned source revisions.
5. Require explicit user confirmation before executing the external package and before installing or automatically activating additional skills.
6. Run setup in a least-privileged, isolated environment without unnecessary credentials or access to sensitive project files.
7. Document the files and configuration changed by setup, required network access, granted permissions, and a complete uninstall or rollback procedure.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation description covers broad user intents such as 'build an agent' or 'deploy an agent,' which can match many unrelated requests. Overly broad triggering can cause this onboarding skill to activate inappropriately and steer users toward installing or using external tooling they did not explicitly request. In context, this is more dangerous because the skill is an entrypoint that bootstraps additional capabilities and setup commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill instructs users to run uvx google-agents-cli setup without pinning a specific version. This allows whatever package version is current at execution time to be installed and run, creating supply-chain risk if a malicious or compromised release is published later. Because this is an onboarding skill that explicitly bootstraps additional tooling, the blast radius is larger than a normal documentation reference.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The setup section again directs execution of uvx google-agents-cli setup without a pinned version. Repeated unpinned install-and-execute guidance increases the chance that users will run mutable remote code, exposing them to package substitution or compromised upstream releases. In this skill's context, that code installs a CLI and seven additional skills, so compromise could cascade into broader agent behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The metadata install field contains uvx google-agents-cli setup without version pinning, which is especially sensitive because agents may consume metadata programmatically. An automated system could execute this mutable command directly, leading to installation of unreviewed code if the upstream package changes or is hijacked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The statement that specialized skills 'activate automatically based on the user's request' is ambiguous and does not define clear trigger constraints. This can result in unintended activation of downstream skills with powerful guidance around scaffolding, deployment, publishing, and observability, increasing the chance of overreach or unsafe tool use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.