Deployment skill in the Google agents-cli suite (SKILL.md signed by Google): Guides agents to use agents-cli to deploy agents built with frameworks like ADK to Agent Runtime, Cloud Run, or GKE, and to configure secrets, service accounts, CI/CD pipelines, rollbacks, and troubleshooting.
skills.sh install count 525087 (+4817 / 24h)
Security Audit: Risk warnings present
- Installs or runs third-party packages (npx / pip, etc.), which involves executing commands
- Instructs the agent to execute shell / script commands
- Initiates network requests or calls external APIs / remote MCP
- Reports usage data (telemetry)
- Reads environment variables or requires API Keys / Tokens
- Audit scope: GitHub google/agents-cli/skills/google-agents-cli-deploy/SKILL.md (only the SKILL.md text was scanned)
Rationale
- First provides a comparison table of the three targets (scalability, networking, session state, billing model, ease of setup), requiring the agent to ask the user which one to choose; for agents requiring OAuth user authorization, Agent Runtime is recommended, while for real-time voice, Cloud Run with --timeout 3600 and --min-instances 1 is recommended
- Before deployment, evaluation scores and test results must be presented to the user, asking “Ready to deploy to dev?”, and agents-cli deploy is only run after explicit consent; SKILL.md states that deployment never occurs without human approval
- Secrets are handled via Secret Manager, injected during deployment using --secrets; custom infrastructure (Cloud SQL, Pub/Sub, etc.) must be defined in Terraform, not created manually via gcloud
- Rollback: Primarily relies on fixing the code in git and re-running the pipeline; Cloud Run allows traffic shifting to older versions, GKE uses kubectl rollout undo, and Agent Runtime only supports fixing and redeploying
- The publish and adk-code skills included two days ago are part of the same suite; skills.sh 24-hour installs 4817, cumulative 525087, weekly installs have dropped from a peak of 132542 to 11134 (this only reflects attention level)
Usage
- Installation command will be displayed after the audit passes (risk warnings present in this release); the CLI is installed using uv tool install google-agents-cli
- Requires a Google Cloud project and corresponding permissions; if the project is not set up, use /google-agents-cli-scaffold first, and it is best to install the entire skill set together
- Triggered by phrases like “deploy my ADK agent”, “set up CI/CD”, “configure secrets”, etc.; when automatically parsing the project, add --no-confirm-project in non-interactive environments
Risks
- The installation, shell execution, network requests, and key reading flagged by the audit align with the intended use: agents-cli must be installed, and deployment itself involves calling GCP and handling keys in Secret Manager
- The “telemetry” flagged by the audit corresponds to optional observability configuration (Cloud Trace, prompt and response logs written to your own project’s BigQuery), not reporting to third parties; once enabled, prompt content will be stored in the database
- Deployment, IAM authorization, and Terraform apply will modify real cloud resources and incur costs; detailed documentation under references/ was not scanned