GCPSkillRegistry rejects every Google-published skill: dotted ids (cloud.google.com-*) fail name validation in get_skill and search_skills

[codebee-aoki]

Follow-up to #6838 / #6839: that fix stopped search_skills from crashing on these ids, but the ids themselves are still rejected everywhere, so Google-published skills remain unusable from ADK.

🔴 Required Information

Describe the Bug:
Skills published by Google into Agent Registry have resource ids of the form cloud.google.com-<display-name> (also discoveryengine.googleapis.com-<name>). ADK cannot use any of them:

• GCPSkillRegistry.get_skill(name="cloud.google.com-google-cloud-networking-observability") raises ValueError: Invalid skill name ... because the name check added in 11101ac only accepts kebab/snake case (no dots).
• GCPSkillRegistry.search_skills() feeds each id into Frontmatter(name=...), whose validator also rejects dots, so since 3c977bc (GCPSkillRegistry.search_skills crashes on the first catalog entry that fails Frontmatter validation #6838) every Google-published hit is dropped with a "Skipping search result" warning. tests/unittests/integrations/skill_registry/test_gcp_skill_registry.py even uses cloud.google.com-agent-platform-eval-flywheel as the example of a "bad" name.

In a real project catalog (location global) this rejects 113 of 117 skills; the only 4 that pass are ones we created ourselves with plain kebab ids. With the validation bypassed locally, downloading the Google skill works (SKILL.md with 7184 chars, 8 resources; the frontmatter name inside the archive equals the displayName and is valid kebab-case), so the archives themselves are fine. It is only the registry id that fails the SKILL.md naming rule.

Steps to Reproduce:

1. google-adk main (ac0133a) or 2.9.1, project with Agent Registry enabled (Google-published skills are visible in the Console).
2. registry = GCPSkillRegistry(project_id=..., location="global")
3. await registry.search_skills(query="networking") -> only self-created skills are returned; one warning per Google skill.
4. await registry.get_skill(name="cloud.google.com-google-cloud-networking-observability") -> ValueError.

Expected Behavior:
Google-published skills are searchable and loadable. The security intent of 11101ac (single path segment, no traversal) can be kept by validating the id as a safe path segment (e.g. ^[A-Za-z0-9._-]+$, and not ./..) instead of applying the SKILL.md frontmatter naming rule to a registry resource id. search_skills should not validate registry ids with the frontmatter rule either; that rule belongs to the SKILL.md inside the archive, which does pass.

Observed Behavior:
ValueError from get_skill, and silent exclusion from search_skills.

Environment Details:

• ADK Library Version: main @ ac0133a, also 2.9.1
• Reproduced locally (macOS, Python 3.14) against a real Agent Registry catalog

Model Information:

• Are you using LiteLLM: No
• Which model is being used: N/A (registry client only)

Additional Context

• GCPSkillRegistry.search_skills crashes on the first catalog entry that fails Frontmatter validation #6838 reported this exact catalog entry (cloud.google.com-agent-platform-eval-flywheel) but asked only for the crash to be fixed; fix(skills): skip invalid catalog hits in GCP skill search #6839 implemented "skip and log", and its description states this matches get_skill() already rejecting those names. So the current behaviour is deliberate at the symptom level, but it means every Google-published skill (113/117 in our catalog) is unreachable from ADK, which I don't think was the intent. This issue is about accepting those ids, not about the crash.
• Related: GcpSkillRegistry.get_skill() always fails with 302: Agent Registry media download redirect to GCS signed URL is not followed #6908 / fix: follow redirects when downloading skills in GcpSkillRegistry #6824 (redirect on media download; needed for the download to succeed at all), feat(skills): let SkillToolset pin registry skills so they appear in list_skills / the catalog without a search_skills turn #7130 / feat(skills): let SkillToolset pin registry skills to appear in the catalog #7135 (pinning registry skills). Note that registry id and frontmatter name differ for 117/117 skills in the catalog, which is why feat(skills): let SkillToolset pin registry skills to appear in the catalog #7135 needs to key the pinned skill by both names.
• Happy to send a PR.

[chelsealong]

Picking this one up now — opening a PR shortly. Flagging it here so nobody duplicates the work; if someone is already on it, say so and I will drop mine.

[llalitkumarrr]

Hello @codebee-aoki,

Could you please try the patch below (along with the fix you shared in #6824) and let us know if this resolves your issue?

models._SNAKE_OR_KEBAB_NAME_PATTERN = re.compile(r"^[a-zA-Z0-9._-]+$")

Example code:

import asyncio
import os
import re
import httpx
from dotenv import load_dotenv

from google.adk.agents.llm_agent import LlmAgent
from google.adk.integrations.skill_registry.gcp_skill_registry import GCPSkillRegistry
from google.adk.skills import models
from google.adk.tools.skill_toolset import SkillToolset
from google.adk.runners import InMemoryRunner
from google.genai import types

load_dotenv(override=True)


models._SNAKE_OR_KEBAB_NAME_PATTERN = re.compile(r"^[a-zA-Z0-9._-]+$")

#below patch address #6908 
orig_create_client = GCPSkillRegistry._create_httpx_client
def patched_create_client(self):
    client = orig_create_client(self)
    ssl_ctx = getattr(getattr(getattr(client, "_transport", None), "_pool", None), "_ssl_context", None)
    return httpx.AsyncClient(verify=ssl_ctx if ssl_ctx else True, follow_redirects=True)

GCPSkillRegistry._create_httpx_client = patched_create_client


PROJECT_ID = os.environ.get("GOOGLE_CLOUD_PROJECT")
LOCATION = os.environ.get("GOOGLE_CLOUD_LOCATION")
SKILL_ID = SKILL_ID


async def main():
  
    skill_registry = GCPSkillRegistry(project_id=PROJECT_ID, location=LOCATION)

    print("="*60)
    print(f"Fetching skill '{SKILL_ID}' from GCP Agent Registry")
    print("="*60)

 
    skill = await skill_registry.get_skill(name=SKILL_ID)


 
    skill_toolset = SkillToolset(
        skills=[skill],
        registry=skill_registry,
    )

    agent = LlmAgent(
        model="gemini-2.5-flash",
        name="email_agent",
        description=DESCRIPTION,
        instruction=INSTRUCTION,
        tools=[skill_toolset],
    )

    runner = InMemoryRunner(agent=agent)
    session = await runner.session_service.create_session(
        user_id="user_1",
        app_name=runner.app_name,
    )

    user_query = QUERY,
    print("=" * 60)
    print(f"User Request:\n\"{user_query}\"\n")
    print("Agent Execution:")
    print("=" * 60)

    content = types.Content(
        role="user",
        parts=[types.Part.from_text(text=user_query)],
    )

    async for event in runner.run_async(
        user_id="user_1",
        session_id=session.id,
        new_message=content,
    ):
        if event.content and event.content.parts:
            for part in event.content.parts:
                if part.function_call:
                    print(f"[Agent called tool: {part.function_call.name}({part.function_call.args})]")
                if part.text:
                    print(part.text, end="", flush=True)

    print("\n" + "=" * 60)

if __name__ == "__main__":
    asyncio.run(main())