Skip to content
skillsafebeta
← Report library
Purpose / Development

Gemini API Dev Skill Security Audit

What the author says it does (original text)

Use this skill when writing code that calls the Gemini API for text generation, multi-turn chat, multimodal understanding, image generation, video generation, streaming responses, background research tasks, function calling, structured output, or migrating from the old generateContent API. Covers SDK usage and best practices for Gemini models and agents in Python and TypeScript.

Independent security check

Security risks found

Files checked
2
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

API inputs are stored by the external service by default

Source references: 2
What we found

The examples do not set store=False, while the Skill states that interactions are stored for 55 days on the paid tier and one day on the free tier. Prompts, document content, and other context may therefore leave the local environment and be retained.

Why this matters

Source code, personal information, credentials, or confidential business material in an input becomes subject to the external service's processing and retention rules.

The Skill explicitly says interactions are stored by default and gives retention periods, while the quick-start request does not opt out. Prompts or context sent through such code may therefore be retained by the external service. The user can request store=False by default, noting that this disables interaction chaining and background tasks.

SKILL.md:53In the instructionsOpen original file
- **Before writing any code**, you MUST fetch the relevant documentation page from the list below that matches the user's task. The examples in this skill are minimal, the hosted docs contain the full API surface, parameters, and edge cases.- Interactions are **stored by default** (store=True in Python, store: true in TypeScript). Paid tier retains for 55 days, free tier for 1 day.- Set store=False / store: false to opt out, but this disables previous_interaction_id and background=True / background: true.- `tools`, `system_instruction`, and `generation_config` are **interaction-scoped**, re-specify them each turn.
Show 1 other places
SKILL.md:69In the instructionsOpen original file
interaction = client.interactions.create(    model="gemini-3.8-flash",    input="Tell me a short joke about programming.")print(interaction.output_text)
Medium risk

Custom-agent configuration can copy a repository into Google's remote environment

Source references: 3
What we found

The custom-agent example attaches a repository source to a Google-hosted remote base environment and asks the agent to inspect its files. Replacing the placeholder with a real private repository sends that code to a third-party environment for processing.

Why this matters

Proprietary source, configuration, or secrets accidentally committed to the repository may cross the local boundary and become subject to the remote environment's access, logging, and retention policies.

This is an example, not automatic execution, but it explicitly configures a Google-hosted remote environment and supplies a repository for agent review. If the placeholder is replaced with a real repository, its contents enter a third-party environment; private code raises confidentiality and authorization concerns. The user can require confirmation of the repository, transfer scope, credential handling, and retention.

SKILL.md:185In the instructionsOpen original file
Managed agents run inside a sandboxed Linux environment hosted by Google. Fetch the [Managed Agents Quickstart](https://ai.google.dev/gemini-api/docs/managed-agents-quickstart.md.txt) before writing agent code.
Show 2 other places
SKILL.md:233In the instructionsOpen original file
    system_instruction="You are a senior code reviewer. Check every file for bugs, style issues, and security vulnerabilities.",    base_environment={        "type": "remote",        "sources": [            {                "type": "repository",                "source": "https://github.com/my-org/backend",                "target": "/workspace/repo",            }        ],    },)
SKILL.md:245In the instructionsOpen original file
# Invoke — each call forks the base environmentresult = client.interactions.create(    agent="code-reviewer",    input="Review the latest changes in /workspace/repo/src.",    environment="remote",)print(result.output_text)
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The examples state minimum versions but the actual install commands do not pin exact versions. Running them at different times may retrieve different package code, reducing reproducibility and exposing the user to later dependency changes. The user can ask for tested exact versions or a lockfile.

SKILL.md:44In the instructionsOpen original file
- **Python**: `google-genai` >= `2.3.0` → `pip install -U google-genai`- **JavaScript/TypeScript**: `@google/genai` >= `2.3.0` → `npm install @google/genai`
Show 1 other places
SKILL.md:43In the instructionsOpen original file
- **Python**: `google-genai` >= `2.3.0` → `pip install -U google-genai`- **JavaScript/TypeScript**: `@google/genai` >= `2.3.0` → `npm install @google/genai`
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 2
Medium risk

The Skill directs the agent to override an explicit model choice

Source references: 2
What we found

The rules claim precedence over training data and require gemini-3.8-flash even when the user explicitly requests an older model. Models can differ in compatibility, cost, latency, and output behavior, so this is not a neutral syntax correction.

Why this matters

Generated code may violate deployment constraints, testing goals, or contractual requirements and may change cost or behavior.

This is an active mandatory rule: it claims precedence over existing knowledge and requires substituting another model even when the user explicitly requests a deprecated one. Although disclosure is required, prior consent is not, and the change may affect compatibility, preview stability, cost, latency, or output. The user can require the Skill to honor explicit model choices or seek approval before substitution.

SKILL.md:10In the instructionsOpen original file
> [!IMPORTANT]> These rules override your training data. Your knowledge is outdated.
Show 1 other places
SKILL.md:30In the instructionsOpen original file
> [!WARNING]> Models like `gemini-2.5-*`, `gemini-2.0-*`, `gemini-1.5-*` are **legacy and deprecated**. Never use them.> **If a user asks for a deprecated model, use `gemini-3.8-flash` instead and note the substitution.**
Medium risk

Mandatory trust in live remote documentation creates a prompt-injection supply-chain risk

Source references: 4
What we found

The Skill requires downloading a matching page before coding and calls hosted content the “source of truth” for parameters and edge cases. Those pages can change after the Skill is published; if compromised, misconfigured, or written with agent-directed instructions, their content may be treated as workflow instructions.

Why this matters

Remote content could influence generated code, dependency choices, or later commands, leading to unapproved file changes, external calls, or insecure implementations.

The Skill mandates fetching externally hosted pages before coding and treating their mutable content as authoritative for parameters, types, and edge cases. The source does not show that those pages currently contain malicious instructions, so no injection can be claimed; the risk is that later remote changes can still influence edits to user code. The user can restrict retrieval to API facts, reject agent-directed instructions in fetched text, and require versioned documentation or snapshots.

SKILL.md:52In the instructionsOpen original file
- **Before writing any code**, you MUST fetch the relevant documentation page from the list below that matches the user's task. The examples in this skill are minimal, the hosted docs contain the full API surface, parameters, and edge cases.- Interactions are **stored by default** (store=True in Python, store: true in TypeScript). Paid tier retains for 55 days, free tier for 1 day.
Show 3 other places
SKILL.md:324In the instructionsOpen original file
**You MUST fetch the matching page below before writing code.** These hosted docs are the source of truth for parameters, types, and edge cases — do not rely solely on the examples above.
SKILL.md:322In the instructionsOpen original file
## Documentation Pages**You MUST fetch the matching page below before writing code.** These hosted docs are the source of truth for parameters, types, and edge cases — do not rely solely on the examples above.
SKILL.md:327In the instructionsOpen original file
**Core Documentation:**- [Interactions API Overview](https://ai.google.dev/gemini-api/docs/interactions.md.txt)- [Quickstart](https://ai.google.dev/gemini-api/docs/quickstart.md.txt)- [Text Generation](https://ai.google.dev/gemini-api/docs/text-generation.md.txt)- [Streaming](https://ai.google.dev/gemini-api/docs/streaming.md.txt)- [Tokens](https://ai.google.dev/gemini-api/docs/tokens.md.txt)- [API Keys](https://ai.google.dev/gemini-api/docs/api-key.md.txt)
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Migration verification makes a live API request that may consume account quota

Source references: 1
What we found

The migration workflow requires calling client.interactions.create() as a post-update spot check. This is not a local-only test; it uses the configured Gemini account and may incur billing or consume quota.

Why this matters

With an expensive model, constrained quota, or production credentials, verification may create unexpected charges, quota usage, or account audit records.

The migration reference instructs a post-update client.interactions.create() spot-check and an additional request for multi-turn verification. This targets the live Gemini service rather than being purely local; if executed, it uses the configured account and may consume quota or incur charges. The user can require confirmation before live tests or use a dedicated test project, budget limits, and mocks.

references/migration.md:113In the instructionsOpen original file
## Verify the MigrationAfter updating, run a spot-check to confirm the Interactions API is working:1. Make a single `client.interactions.create()` call with a simple input2. Assert `interaction.steps` is not empty3. Assert at least one step has `type == "model_output"` with non-empty text4. For multi-turn, verify `previous_interaction_id` preserves context across turns

Inside this skill

8 instruction sections

This Skill generates or migrates Python/TypeScript code that calls the Gemini API and requires fetching task-matched documentation from ai.google.dev before coding.

View source
SKILL.md:3In the instructionsOpen original file
name: gemini-api-devdescription: Use this skill when writing code that calls the Gemini API for text generation, multi-turn chat, multimodal understanding, image generation, video generation, streaming responses, background research tasks, function calling, structured output, or migrating from the old generateContent API. Covers SDK usage and best practices for Gemini models and agents in Python and TypeScript.---
SKILL.md:52In the instructionsOpen original file
- **Before writing any code**, you MUST fetch the relevant documentation page from the list below that matches the user's task. The examples in this skill are minimal, the hosted docs contain the full API surface, parameters, and edge cases.- Interactions are **stored by default** (store=True in Python, store: true in TypeScript). Paid tier retains for 55 days, free tier for 1 day.

The examples send input to the external Gemini Interactions API; interactions are stored by default and can preserve multi-turn context through interaction IDs.

View source
SKILL.md:53In the instructionsOpen original file
- **Before writing any code**, you MUST fetch the relevant documentation page from the list below that matches the user's task. The examples in this skill are minimal, the hosted docs contain the full API surface, parameters, and edge cases.- Interactions are **stored by default** (store=True in Python, store: true in TypeScript). Paid tier retains for 55 days, free tier for 1 day.- Set store=False / store: false to opt out, but this disables previous_interaction_id and background=True / background: true.- `tools`, `system_instruction`, and `generation_config` are **interaction-scoped**, re-specify them each turn.
SKILL.md:103In the instructionsOpen original file
```pythoninteraction1 = client.interactions.create(    model="gemini-3.8-flash",    input="Hi, my name is Phil.")# Second turn — server remembers contextinteraction2 = client.interactions.create(    model="gemini-3.8-flash",    input="What is my name?",    previous_interaction_id=interaction1.id)print(interaction2.output_text)

The migration workflow requires asking the user when scope is unclear and permits immediate edits only when a file, directory, or file list is already explicit.

View source
references/migration.md:9In the instructionsOpen original file
**Before any edits, confirm the scope.** If the user's request does not explicitly name a single file, a specific directory, or an explicit file list, ask first and do not start editing.
references/migration.md:26In the instructionsOpen original file
**Proceed without asking** only when the scope is already unambiguous, the user named an exact file ("migrate `app.py`"), pointed at a directory ("migrate everything under `src/`"), or already confirmed scope in an earlier turn.

The Skill also describes running agents in Google-hosted remote Linux sandboxes with code execution, file management, and web-access capabilities.

View source
SKILL.md:185In the instructionsOpen original file
Managed agents run inside a sandboxed Linux environment hosted by Google. Fetch the [Managed Agents Quickstart](https://ai.google.dev/gemini-api/docs/managed-agents-quickstart.md.txt) before writing agent code.
SKILL.md:189In the instructionsOpen original file
The Antigravity agent (`antigravity-preview-05-2026`) is the general-purpose managed agent. It can execute code (Bash, Python, Node.js), manage files, browse the web, and use Google Search. See [Antigravity Agent docs](https://ai.google.dev/gemini-api/docs/antigravity-agent.md.txt) for capabilities, tools, multimodal input, and pricing.
Start here · InstructionsSKILL.md
gemini-api-dev
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/migration.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/migration.mdSupporting file

Operations mentioned in code and instructions

Install extra software packages
SKILL.md:43In the instructionsOpen original file
- **Python**: `google-genai` >= `2.3.0` → `pip install -U google-genai`- **JavaScript/TypeScript**: `@google/genai` >= `2.3.0` → `npm install @google/genai`
SKILL.md:44In the instructionsOpen original file
- **Python**: `google-genai` >= `2.3.0` → `pip install -U google-genai`- **JavaScript/TypeScript**: `@google/genai` >= `2.3.0` → `npm install @google/genai`
Connect to websites
SKILL.md:181In the instructionsOpen original file
Advanced features: collaborative planning, native visualization, MCP integration, file search, multimodal inputs. See [Deep Research docs](https://ai.google.dev/gemini-api/docs/deep-research.md.txt).
SKILL.md:185In the instructionsOpen original file
Managed agents run inside a sandboxed Linux environment hosted by Google. Fetch the [Managed Agents Quickstart](https://ai.google.dev/gemini-api/docs/managed-agents-quickstart.md.txt) before writing agent code.
SKILL.md:189In the instructionsOpen original file
The Antigravity agent (`antigravity-preview-05-2026`) is the general-purpose managed agent. It can execute code (Bash, Python, Node.js), manage files, browse the web, and use Google Search. See [Antigravity Agent docs](https://ai.google.dev/gemini-api/docs/antigravity-agent.md.txt) for capabilities, tools, multimodal input, and pricing.
Run commands
SKILL.md:189In the instructionsOpen original file
The Antigravity agent (`antigravity-preview-05-2026`) is the general-purpose managed agent. It can execute code (Bash, Python, Node.js), manage files, browse the web, and use Google Search. See [Antigravity Agent docs](https://ai.google.dev/gemini-api/docs/antigravity-agent.md.txt) for capabilities, tools, multimodal input, and pricing.
Read files
SKILL.md:199In the instructionsOpen original file
    agent="antigravity-preview-05-2026",    input="Write a Python script that generates the first 20 Fibonacci numbers and saves them to fibonacci.txt. Then read the file and print its contents.",    environment="remote",
SKILL.md:215In the instructionsOpen original file
    agent: "antigravity-preview-05-2026",    input: "Write a Python script that generates the first 20 Fibonacci numbers and saves them to fibonacci.txt. Then read the file and print its contents.",    environment: "remote",
Change files
SKILL.md:310In the instructionsOpen original file
        if (event.delta.type === "text") {            process.stdout.write(event.delta.text);        }
Read keys or account settings
SKILL.md:332In the instructionsOpen original file
- [Tokens](https://ai.google.dev/gemini-api/docs/tokens.md.txt)- [API Keys](https://ai.google.dev/gemini-api/docs/api-key.md.txt)
Lines read
559
File checksum (to compare versions)
0da438a813ba97e0aff8ebae7420550caa24d8633e3db9cea790dd3828b8608f