Google ADK restricts how agents run skill scripts Google ADK restricts how agents run skill scripts

The model supplies arguments, not a whole command

The change concerns RunSkillScriptTool when a SkillToolset uses an execution environment. Previously, the model could supply a free-form shell command. The November 2 implementation commit describes a prompt-injection risk in that design: a manipulated model could request arbitrary shell commands. The new interface takes structured arguments for a selected skill script. It validates the script path, checks the supported file type and constructs the invocation itself. This moves part of the decision from model-generated text into the tool’s code.

Existing skill calls need a different shape

Calls that still send the command field now return INVALID_ARGUMENTS. The tool accepts named arguments, short options and positional arguments, and runs from the skill’s directory rather than the environment’s working directory. That directory change matters for a script that opens another file by relative path. For example, an adjacent configuration file and a file in the former working directory can have the same name while containing different data. The release therefore changes both the call format and the location from which a script resolves its work.

Stable environments are another part of the release

Google also promoted its base and local environment interfaces, environment toolset, and Daytona and E2B integrations out of experimental status. File reading gains a streaming interface so a requested line range need not load the complete file into memory. AgentEngineEnvironment handles large reads and writes in chunks, and reports a command exceeding 570 seconds as timed out before the service deadline. These are runtime and interface changes: they affect how agent code reaches its execution backend and receives results.

Evaluation can repeat the same case

The adk eval command-line interface gains configurable repeated runs. MultiRunConfig and --num_runs repeat each case; --parallelism caps concurrent evaluation work. Results combine scores or pass rates across those attempts. That gives a team a way to distinguish one successful execution from repeatable behavior using the same test case. Another tool, ToolArgsMatcher, compares arguments using exact matches, case-insensitive checks, numeric tolerances or a model-backed semantic comparison. The chosen matching rule determines what the evaluation treats as equivalent.

The publication date differs from the changelog date

GitHub records the public release at 00:58 UTC on November 7, while its changelog heading is dated November 4. The underlying script-runner fix was committed on November 2. The release record separates public distribution from the dates attached to its changelog and underlying code. Version 2.14.0 packages the change with other compatibility adjustments, including enum arguments arriving as members rather than raw strings and stricter options for Vertex AI session creation.