fix(skills): accept dotted registry ids in GCPSkillRegistry - #7138
Open
chelsealong wants to merge 1 commit into
Open
chelsealong wants to merge 1 commit into
chelsealong wants to merge 1 commit into
Conversation
Google-published skills have registry resource ids like cloud.google.com-<name>, which are not SKILL.md frontmatter names and were never meant to be held to the frontmatter naming rule. get_skill rejected every such id outright, and search_skills silently dropped every matching catalog entry, making Google-published skills unreachable from ADK. Give registry ids their own safe-path-segment check (still rejecting traversal, slashes, and other unsafe characters) instead of routing them through Frontmatter's kebab/snake-case name validator, which is scoped to SKILL.md content. Fixes google#7136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Please ensure you have read the contribution guide before creating a pull request.
Link to Issue or Description of Change
1. Link to an existing issue:
Problem:
Skills published by Google into Agent Registry have resource ids of the
form
cloud.google.com-<display-name>(alsodiscoveryengine.googleapis.com-<name>).GCPSkillRegistryrejects all ofthem:
get_skill(name="cloud.google.com-...")raisesValueError: Invalid skill name ...because the check added for fix(skills): skip invalid catalog hits in GCP skill search #6839 requires the name tomatch
models._SNAKE_OR_KEBAB_NAME_PATTERN, which does not allow dots.search_skills()feeds each catalog id intomodels.Frontmatter(name=...),whose own field validator applies the same strict kebab/snake-case rule,
so every Google-published hit is silently dropped with a "Skipping search
result" warning.
In a real catalog this rejects the large majority of skills — only
self-created, plain-kebab-case skills pass. That name-pattern check was
never meant to apply here in the first place: it is the SKILL.md
frontmatter naming rule (a content-format rule for the file inside the
skill archive), and a registry resource id is a different kind of string
that happens to reuse the same
Frontmatter.namefield for convenience.Solution:
_is_safe_registry_idhelper ingcp_skill_registry.pywith itsown pattern (
^[a-z0-9]+(?:[._-][a-z0-9]+)*$, length <= 64) that keepsthe original security intent (reject
./.., slashes, and anything elsethat isn't safe to interpolate as a single URL path segment) while
allowing dots.
get_skillnow validates the incoming name against this registry-id ruleinstead of the SKILL.md frontmatter name pattern.
search_skillsnow validates each catalog id the same way, andconstructs the returned
Frontmatterviamodel_construct(bypassingthe frontmatter name validator, which does not apply to registry ids)
while still running the real
descriptionvalidation so malformeddescriptions are still skipped and logged as before.
Neither change touches
models.Frontmatter's own naming rule, which stillapplies, unmodified, to names parsed from SKILL.md content.
Testing Plan
Unit Tests:
Added:
test_search_skills_accepts_dotted_registry_id— a dotted registry id(
cloud.google.com-agent-platform-eval-flywheel) is now returned bysearch_skillsinstead of being dropped.test_get_skill_builds_expected_url_for_valid_namewith the samedotted id to confirm
get_skillaccepts it and builds the expected URL.test_get_skill_rejects_unsafe_name_before_any_requestwith".","..", and a 65-character name to confirm the safe-path-segmentcheck still rejects bare traversal segments and enforces the length cap.
test_search_skills_skips_entry_failing_validation's first case(previously the dotted id, used as an example of a name that fails
validation) to
"..", since a dotted id is now valid.Verified the added tests fail without the fix (
git checkout HEAD~1 -- src/google/adk/integrations/skill_registry/gcp_skill_registry.py, keepingthe new tests) with the exact errors the issue describes:
Summary of passed pytest results (with the fix restored):
(One unrelated test,
test_eval_injects_session_input_state_into_instruction,is flaky under
-n autoparallel execution and reproduces identically onunmodified
main; deselected from the full run above for a clean signal.)Also ran
ruff check,pyink --check, andpylinton the changed files —clean (pylint's only remaining note is a pre-existing line-length warning on
an unrelated line this PR doesn't touch).
Manual End-to-End (E2E) Tests:
Not run — no live Agent Registry project was available in this
environment; verified via the unit tests above, which exercise the same
name-validation and Frontmatter-construction code paths the issue reports
as broken.
Checklist
Additional context
This PR was generated by an AI coding agent (Claude Code). The implementation
and tests were verified against the automated test suite as described above.