feat(examples): add Google ADK JS Runner guardrails example

[davidmytton]

Adds examples/google-adk-agent: a Google ADK JS (@google/adk 2.x) Runner support agent protected by @arcjet/guard/google-adk/v2.

Inbound guard() runs before Runner.runAsync and checks hasFailedOpen(). guardPlugin is first in new Runner({ plugins }) so beforeToolCallback rate-limits lookup_order and scans free-text note args for PII. Default DENY is an ArcjetDenialResult dict — ADK skips runAsync. Correlation is a caller-owned sessionId via googleAdkContext — never minted, never invocationId.

This is Google ADK JS, not @google/genai and not the Python google-adk SDK.

The adapter is not on npm yet, so @arcjet/guard and @arcjet/transport (./http2) are vendored from 41ef3681 (david/cursor/guard-google-adk-v2). Repin once @arcjet/guard/google-adk/v2 publishes.

import { googleAdkContext, guardPlugin } from "@arcjet/guard/google-adk/v2";
import { LlmAgent, Runner } from "@google/adk";

const ctx = googleAdkContext({
  context: sessionId === undefined ? {} : { sessionId },
});

const inbound = await arcjet.guard({
  label: "message.received",
  rules: [detectInjection(text)],
  ...ctx,
});
if (inbound.conclusion === "DENY" || inbound.hasFailedOpen()) {
  return; // do not call Runner.runAsync
}

const runner = new Runner({
  appName,
  agent,
  sessionService,
  plugins: [
    guardPlugin(arcjet, {
      action: ({ toolName }) => `${toolName}.invoked`,
      onGuardError: "deny",
      sessionId,
      rules: ({ input }) => [
        lookupLimit({ key: `order:${input.orderId}`, requested: 1 }),
        ...(input.note ? [detectPii(input.note)] : []),
      ],
    }),
  ],
});

Docs: /guards/google-adk/. Run examples/google-adk-agent with ARCJET_KEY and GOOGLE_GENAI_API_KEY (or GOOGLE_API_KEY / GEMINI_API_KEY).

  

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​google/​adk@​2.0.0

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential vulnerability: npm jsonpath-plus with risk level "medium" Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/jsonpath-plus@10.4.0 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsonpath-plus@10.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm lodash-es is 80.0% likely risky Notes: No overt malware/backdoor/IO/exfiltration behavior is present in this module itself. However, it is a high-risk template compiler because it dynamically generates and compiles JavaScript via Function(...) using template-derived fragments and caller-supplied configuration. In particular, the evaluate directive inserts raw JavaScript into the generated source, and with (obj) broadens scope when variable is unset. Treat template strings and especially evaluate/interpolate content and options as fully trusted or strictly controlled; otherwise, this can enable arbitrary code execution in the context of the application. Confidence: 0.80 Severity: 0.70 From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/lodash-es@4.18.1 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lodash-es@4.18.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm jsonpath-plus is 62.0% likely to have a medium risk anomaly Notes: This fragment does not show clear evidence of intentional malware such as network exfiltration, process spawning, or credential theft. The dominant security concern is the built-in, caller-configurable dynamic evaluation of JSONPath filter/expression text via VM compilation and runInNewContext using a caller-influenced sandbox. If untrusted expressions are evaluated and/or the sandbox/VM backend is not strongly hardened, this module can become a code execution or data access risk. Additional concerns include error-message leakage of the executed code and potential memory growth via script caching. Confidence: 0.62 Severity: 0.60 From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/jsonpath-plus@10.4.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsonpath-plus@10.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm protobufjs is 61.0% likely to have a medium risk anomaly Notes: The analyzed code segment is a standard RPC service wrapper (protobufjs style) with conventional input validation, encoding/decoding, event emission, and end handling. No malicious behavior is evident, and there are no observable security vulnerabilities beyond ordinary library-level error handling. It does not exhibit data exfiltration, backdoors, or other anti-security patterns. Confidence: 0.61 Severity: 0.55 From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/protobufjs@7.6.6 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/protobufjs@7.6.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @google-cloud/vertexai in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google-cloud/vertexai@1.12.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google-cloud/vertexai@1.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Install-time scripts: npm @google/genai during preinstall Install script: preinstall Source: echo 'preinstall: no-op' From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google/genai@1.52.0 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@1.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @google/genai in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google/genai@1.52.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@1.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Install-time scripts: npm @google/genai during preinstall Install script: preinstall Source: echo 'preinstall: no-op' From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google/genai@2.21.0 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@2.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @google/genai in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google/genai@2.21.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@2.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm @mikro-orm/core Eval Type: Function Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm lodash-es Eval Type: Function Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/lodash-es@4.18.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lodash-es@4.18.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @google-cloud/vertexai reads GOOGLE_CLOUD_PROJECT Env Vars: GOOGLE_CLOUD_PROJECT Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google-cloud/vertexai@1.12.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google-cloud/vertexai@1.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @google-cloud/vertexai reads GOOGLE_CLOUD_REGION Env Vars: GOOGLE_CLOUD_REGION Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google-cloud/vertexai@1.12.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google-cloud/vertexai@1.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @google-cloud/vertexai reads CLOUD_ML_REGION Env Vars: CLOUD_ML_REGION Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google-cloud/vertexai@1.12.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google-cloud/vertexai@1.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @google/genai Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google/genai@1.52.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@1.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: npm @google/genai with module fs Module: fs Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google/genai@1.52.0 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@1.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Filesystem access: npm @google/genai with module fs/promises Module: fs/promises Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@google/genai@1.52.0 ℹ Read more on: This package | This alert | What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@google/genai@1.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Debug access: npm @mikro-orm/core in module node:async_hooks Module: node:async_hooks Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is debug access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing the use of debug will reduce the risk of any reflection and dynamic code execution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Debug access: npm @mikro-orm/core in module node:module Module: node:module Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is debug access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing the use of debug will reduce the risk of any reflection and dynamic code execution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @mikro-orm/core reads MIKRO_ORM_LOG_EM_ID Env Vars: MIKRO_ORM_LOG_EM_ID Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @mikro-orm/core reads NO_COLOR Env Vars: NO_COLOR Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @mikro-orm/core reads MIKRO_ORM_NO_COLOR Env Vars: MIKRO_ORM_NO_COLOR Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @mikro-orm/core reads FORCE_COLOR Env Vars: FORCE_COLOR Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @mikro-orm/core reads MIKRO_ORM_COLORS Env Vars: MIKRO_ORM_COLORS Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @mikro-orm/core reads MIKRO_ORM_CONTEXT_NAME Env Vars: MIKRO_ORM_CONTEXT_NAME Location: Package overview From: examples/google-adk-agent/package-lock.json → npm/@google/adk@2.0.0 → npm/@mikro-orm/core@6.6.16 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mikro-orm/core@6.6.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 16 more rows in the dashboard

Ignoring alerts on:

• npm/@google/adk@2.0.0

View full report

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Needs Review

Rationale: New self-contained example under examples/google-adk-agent that adds a Google ADK JS agent protected by Arcjet Guard. The example is well-scoped, does not touch production code paths, includes explicit demo-only warnings in the README, validates input with Zod (2000-char message cap, 32 KiB body cap, printable-ASCII conversation id), and reads secrets only from environment variables. Two escalation triggers fire (dependency changes and CI/CD changes via Dockerfile/devcontainer), but both are scoped to the new example directory and additive top-level integrations (README link, root compose.yaml include, publish script workspace entry). The vendored @arcjet/guard and @arcjet/transport packages ship as dist/ tarballs from a specified SHA (documented in vendor/SOURCE.txt) — their source is not in this diff and cannot be reviewed here, but they are Arcjet's own packages pinned to a known commit on their monorepo, and the README clearly explains the reason for vendoring and the plan to unpin. No hardcoded secrets, no auth bypasses of existing routes, no changes to shared infrastructure. Approving despite Medium risk because the change is additive-only and follows the same pattern as the other example directories already in this repo.

Summary of Changes

Adds a new examples/google-adk-agent example demonstrating Arcjet Guard's Google ADK JS integration (guardPlugin + inbound guard() before Runner.runAsync). Includes README, Dockerfile, devcontainer, compose.yaml, a small Node http server (index.ts), the ADK Runner wiring (lib/agent.ts, lib/arcjet.ts), and vendored builds of @arcjet/guard and @arcjet/transport pinned to arcjet-js SHA 41ef36816e7174f1b0288d28217e63fa14114307. Also registers the example in the root README, root compose.yaml, and scripts/prepare-to-publish.ts.

PR Title & Description

These do not match the changes on the branch. They did not change this review's decision, but they will withhold approval once the other findings are resolved. Update them, then add the ai-review label to re-run the review.

• description (incomplete): The description contains only the Cursor Cloud Agent boilerplate and no substantive summary of the change. This PR adds a substantial new example (~28 files) including vendored builds of @arcjet/guard and @arcjet/transport pinned to a specific arcjet-js SHA — a reviewer or future reader would benefit from a short description covering that the example is Google ADK JS (not @google/genai or Python google-adk), that it depends on the unpublished @arcjet/guard/google-adk/v2 subpath and therefore shi

Suggested description

Adds a new `examples/google-adk-agent` example: a Google ADK JS (`@google/adk` 2.x) `Runner` support agent protected by Arcjet Guard's `google-adk/v2` integration.

- Inbound prompt injection screened with `guard()` before `Runner.runAsync` (checks `hasFailedOpen()`).
- `guardPlugin` is registered first on `new Runner({ plugins })` so `beforeToolCallback` gates the `lookup_order` tool with a per-order-id token bucket and PII scanning on the free-text `note` argument.
- Correlation IDs are caller-owned (from the browser) and threaded through `googleAdkContext` / `guardPlugin({ sessionId })`; the server never mints an id for Guard.

This is Google ADK JS, not `@google/genai` and not the Python `google-adk` SDK.

The example depends on `@arcjet/guard/google-adk/v2`, which is not yet published to npm. `@arcjet/guard` and `@arcjet/transport` are vendored from `arcjet/arcjet-js` at commit `41ef36816e7174f1b0288d28217e63fa14114307` (branch `david/cursor/guard-google-adk-v2`); see `vendor/SOURCE.txt`. Repin to the published release once the subpath ships.

Also wires the example into the root `README.md`, root `compose.yaml`, and `scripts/prepare-to-publish.ts`.

Escalation Triggers

• Dependency Changes: examples/google-adk-agent/package.json and vendored package.json files added
• CI/CD Pipeline: New Dockerfile, .devcontainer/devcontainer.json, and compose.yaml under examples/google-adk-agent

Notes

PR is large by line count (~5000+ lines of diff) but the bulk is vendored README.md (~2400 lines) and two Apache 2.0 LICENSE files (~200 lines each) — the actual reviewable code (index.ts, lib/agent.ts, lib/arcjet.ts, package.json, Dockerfile, compose.yaml, index.html) is well under the 1000-line threshold. The vendored packages ship compiled dist/ output that is not in the diff and therefore cannot be reviewed here; reviewers should verify the pinned arcjet-js SHA (41ef36816e7174f1b0288d28217e63fa14114307) matches what's expected and confirm the plan to repin once @arcjet/guard/google-adk/v2 is published to npm.

Path filtering: 95 files excluded by ignore paths. 27 of 122 files included in review.

Approval withheld: The PR title or description does not match the branch — see the "PR Title & Description" section. Update them, then add the ai-review label to re-run the review.

_{Review: 02c12941 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}

[davidmytton]

@SocketSecurity ignore npm/@google/adk@2.0.0