Skills google-agents-cli-workflow

📦

google-agents-cli-workflow

Name: google-agents-cli-workflow
Author: google

v1.3.1 Content revision r2 High Risk 📁 Filesystem access⚙️ External commands⚡ Contains scripts🌐 Network access🔑 Env variables

Build and Operate Google ADK Agents

Agent projects often lose consistency between design, testing, deployment, and operations. This skill guides coding agents through a structured agents-cli and Google ADK workflow.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "google-agents-cli-workflow" from https://skillstore.io/skills/google-google-agents-cli-workflow.md and its manifest at https://skillstore.io/api/skills/google-google-agents-cli-workflow/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/google-google-agents-cli-workflow.md Signed manifest GET /api/skills/google-google-agents-cli-workflow/manifest Signed lockfile GET /api/skills/google-google-agents-cli-workflow/lockfile

Test it

Using "google-agents-cli-workflow". Design a support agent that searches internal product documentation.

Expected outcome:

Recommended architecture: one ADK agent with a retrieval tool and explicit citation requirements.
Open decision: confirm the documentation source and authentication method before scaffolding.
Next gate: approve the specification before studying the retrieval recipe.

Using "google-agents-cli-workflow". Prepare my evaluated agent for Cloud Run.

Expected outcome:

Deployment readiness: evaluation thresholds pass and the target is configured.
Required review: confirm secret storage, service identity, rollback plan, and logging settings.
Approval gate: deployment will not run until explicit human approval.

Security Audit

High Risk

v5 • 8/5/2026 Open versioned report

Review found that 94 of 97 alerts are contextual false positives caused by Markdown, CLI documentation, and official documentation links. Three high-severity findings are confirmed because the workflow can place secret-bearing `.env` files in agent context or generated projects. No prompt injection or data-exfiltration intent was found.

Files scanned

525

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:149

Environment file access

`AGENTS.md` / `README.md`, adapting the recipe's `infra/terraform/` and `.env` into your project.

The workflow directs agents to adapt a recipe's `.env` into a project. This can copy credentials or expose them to model context without handling safeguards.

High

SKILL.md:290

Environment file access

- `.env` files and env var assignments (e.g., `GOOGLE_CLOUD_PROJECT`, `GOOGLE_CLOUD_LOCATION`) are t

The workflow treats `.env` files and assignments as agent-managed configuration. Secret values may enter model context or be preserved in generated artifacts.

High

SKILL.md:291

Environment file access

- If a `.env` file exists in the project root, treat it as essential configuration

The instruction makes an existing project-root `.env` essential configuration. An agent may read the whole file, including credentials unrelated to the task.

Risk Factors

📁 Filesystem access (2)

references/brainstorming.md:96 SKILL.md:298

⚙️ External commands (50)

⚡ Contains scripts (1)

SKILL.md:143

🌐 Network access (5)

SKILL.md:24 SKILL.md:33 SKILL.md:61 SKILL.md:259 SKILL.md:273

🔑 Env variables (1)

SKILL.md:224

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/google-google-agents-cli-workflow/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/google-google-agents-cli-workflow/security.svg)](https://skillstore.io/skills/google-google-agents-cli-workflow?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/google-google-agents-cli-workflow?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-google-agents-cli-workflow/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/google-google-agents-cli-workflow.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

google. (2026). google-agents-cli-workflow security audit report (audit version 5) [Author version 1.3.1]. Skillstore. https://skillstore.io/skills/google-google-agents-cli-workflow/audits/5

BibTeX citation

@techreport{google-google-google-agents-cli-workflow-2026,
  author = {google},
  title = {google-agents-cli-workflow security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/google-google-agents-cli-workflow/audits/5},
  note = {Author version 1.3.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "google-agents-cli-workflow security audit report (audit version 5)"
version: "1.3.1"
type: report
authors:
  - name: "google"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/google-google-agents-cli-workflow/audits/5"
identifiers:
  - type: other
    value: "skillstore:google-google-agents-cli-workflow:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create an ADK agent

Turn an idea into an approved specification, select reference recipes, scaffold the project, and implement the first working agent.

Evaluate an existing agent

Build focused evaluation cases, separate deterministic tests from behavior checks, and iterate until agreed quality thresholds pass.

Deploy and operate an agent

Select a Google Cloud target, require deployment approval, publish when needed, and establish production observability.

Try These Prompts

Clarify a simple agent

Help me design a simple ADK agent for [purpose]. Ask one question at a time, then write a short specification for approval.

Scaffold an approved design

Review `.agents-cli-spec.md`, identify matching ADK recipes, and scaffold [project name]. Preserve existing files and explain each planned command before execution.

Evaluate agent behavior

Create a focused evaluation plan for [agent]. Include core cases, measurable thresholds, tool-use checks, safety criteria, and an iteration sequence.

Prepare production deployment

Assess [project] for deployment to [target]. Verify evaluation results, configuration, secret handling, rollback readiness, publishing needs, and observability before requesting approval.

Best Practices

Approve the specification before scaffolding or modifying project code.
Use agents-cli evaluation for behavioral quality and pytest for deterministic code correctness.
Require explicit human approval before deployment and keep secrets outside model context.

Avoid

Do not skip reference recipes for retrieval, memory, approvals, authentication, or sandboxed execution.
Do not replace a scaffolded model or unrelated configuration without an explicit user request.
Do not treat one successful local prompt as sufficient behavioral validation.

Frequently Asked Questions

What does this skill help build?

It guides development of Google ADK agents from initial design through evaluation, deployment, publishing, and production observation.

Does it create a project without approval?

No. It requires an approved specification before scaffolding and explicit human approval before deployment.

Which tools are required?

The workflow requires google-agents-cli. It also expects uv and phase-specific companion skills for scaffolding, coding, evaluation, deployment, publishing, and observability.

How are agent behaviors tested?

Use agents-cli evaluation for response quality, tool use, persona, and safety. Use pytest only for deterministic code behavior.

Can it modify an existing project?

Yes. It can guide project enhancement while preserving unrelated code, configuration, comments, models, and formatting.

How should secrets be handled?

Store secrets in GCP Secret Manager. Keep secret values out of prompts, logs, diffs, generated files, and copied `.env` content.