Is skill scanning in Google Cloud Agent Registry generally available?

Google's release notes dated November 6, 2026 say skill security scanning and governance "are available", with no stage label. The same date labels standalone skills generally available (GA) and encryption with your own keys (CMEK) Preview. Separately, the roles page tags the Agent Registry User role Beta.

How accurate is the skill scanner?

Google gives no figure. Its scan page warns that scans "might produce false positives or false negatives, and results might vary across runs", and tells developers to review and verify findings. The pages we read do not name the models that do the scanning.

What happens by default to a skill version that is flagged?

With the default blocking policy, Google says a version with findings cannot be downloaded, and a version with findings or an unfinished scan cannot become the skill's default version. Under blocking, a new skill created as active with a first version stays in Draft until its scan finishes with no findings. Audit-only mode, if company rules allow it, lets flagged versions through with warnings.

Does Google Cloud Agent Registry scan every AI agent skill?

No. Google describes scanning for standalone skill versions uploaded to Agent Registry while the policy is on. Versions created earlier are not scanned again when you turn it on.

What does scanning cost, and what is not stated?

Google lists scanning as free through December 31, 2026, then $8.00 per 1 million input tokens; its example comes to $0.02 for a 10 KB package. The pages we read do not state accuracy figures, where scan content is processed or kept, how long a scan takes, or a CMEK price.

Agent Registry Skill Scanning: What Google Checks

A brushed-metal scanning gate with a large glowing red glass lens over a rail; glass folder-shaped cartridges travel along the rail, one held under the lens by a glowing red bar while the others continue on to a metal shelf holding stacked glass folders.

The short version

Who checks the instructions your AI agent follows? Google Cloud's Agent Registry now has AI models read each new version of the instruction files (skills) kept there, and it blocks flagged ones by default. Google says the check can be wrong both ways and gives no accuracy figures. It calls the feature "available" and has not given it its full-launch label, GA. We tested nothing.

In plain words

A skill is a written playbook that an AI agent follows to do a job the same way every time, such as preparing your monthly report. A registry is the shelf where a company keeps those playbooks, with every version saved. Scanning is a review step, like an app-store reviewer, except the reviewer is AI: it reads each new version looking for data being sent out, passwords left inside and hidden instructions aimed at the agent. It matters to you only if your agents load shared playbooks from Google's Agent Registry.

Imagine an AI agent on your finance team that closes the month by following a written playbook. One afternoon somebody edits the playbook so the agent also emails a spreadsheet to an outside address. In a folder of plain text, that edit is easy to miss. (This is an example, not a reported case.)

Google Cloud's release notes dated November 6, 2026 describe a scanner that checks for problems of this general kind, data being sent out among them: an AI reviewer that reads each new version uploaded to its Agent Registry. Google gives no accuracy figure, as we explain below.

How does the check work?

Three words first. A revision is one saved version of a skill; it never changes, so any edit makes a new revision. The default revision is the one agents get when nobody asks for a specific version. The policy is a switch on each skill that says what a scan may block: blocking (the default), audit-only, or off. Here is one new revision's path, as Google's pages describe it.

Upload. Someone uploads a ZIP file (one compressed file) holding the instructions, optional scripts and supporting files.
An AI reads it. The scan runs in the background. Google says the scanner "uses large language models (LLMs) to evaluate instructions, code logic, and semantic intent". It looks for data being sent out ("data exfiltration"), passwords left in plain sight ("exposed credentials") and hidden instructions meant to steer the agent ("prompt injection").
Problems become findings. Each one is saved as a read-only record (Google's term). Google defines two kinds: "a software or instruction weakness", and "exposed plaintext credentials, keys, or tokens". Each has a severity and a file, with a line number (0 means the whole file).
The gate closes. With blocking on, a revision with findings cannot be downloaded. A revision with findings, or with a scan still running, cannot become the default. For a new revision of an existing skill, Google lists no download block while its scan is still running (a brand-new skill is held in Draft until its first scan ends, and Draft skills cannot be downloaded).
A person fixes it. Someone edits the files and uploads a new revision, and checks that its scan ends "with no findings listed" before promoting it.

Only new revisions are scanned: scanning "isn't retroactively triggered for revisions that were already created", Google says. For engineers: the default policy is ENABLED_BLOCKING, finding classes are VULNERABILITY and SECRET, and a clean scan state reads SUCCEEDED.

How sure is the scanner?

Google does not say how often the scanner is right. It only warns that it can be wrong in both directions: "scans might produce false positives or false negatives, and results might vary across runs." A false positive flags a legitimate skill; a false negative waves a risky one through.

Google adds that details about a finding "might be approximate and subject to hallucination", and that "Developers must review and verify scan findings". The pages we read never call a clean result safe, and do not name the models that do the reading.

What happens to a skill that is flagged by mistake?

Back to our imagined playbook, this time an honest one that the scanner flags wrongly. Under the default policy, a brand-new skill created as active with a first version starts in "Draft", a holding state, and Google says "Resolution and payload downloads aren't available when a skill is in the Draft state". A flagged new version of an existing skill can be neither downloaded nor made the default. In our reading, agents keep getting the older default version until someone fixes the files or loosens the policy.

The pages we read describe no way to mark a finding as accepted. Audit-only mode exists, where downloads are "permitted with warning notices" and the findings stay on record, but who may switch to it can depend on a company-wide rule.

One more catch: setting up scanning and reading its results are different jobs. Google's scan page says viewing findings needs the Admin role (a role is a named bundle of permissions). The role listed for setting up scanning is Agent Registry User, which Google's roles page tags Beta. Google adds that custom or other predefined roles might also carry the permissions.

Does this affect you?

Only if your agents load shared skills from Google's Agent Registry. If they do, think of the scanner as a second pair of eyes rather than a verdict. Google's comparison table says a skill is "Downloaded and loaded into an agent's context or runtime environment". In our reading, the registry stores, versions, scans and hands out skills, and the agent does the loading and acting; the pages we read describe a scan when a version is uploaded and limits on serving it, not a new scan each time an agent runs a skill. On giving each agent its own limited keys, see IBM's agent identity vault; on what an agent may do, see agent permissions.

How finished is it? Google's own labels

In the cloud industry, "GA" (generally available) usually means a product is fully launched and supported, while "Preview" and "Beta" mean it is still being tested. That is a general explanation, not Google's text. In the CMEK section of its architecture page, Google says pre-GA features are available "as is" and "might have limited support". Here is what each piece is called:

Piece	Label as printed
Agent Registry itself (June 18, 2026)	"generally available (GA)"
Standalone skills: register, version, search, govern	"generally available (GA)"
Skill security scanning and governance	"are available" - no stage label
Encryption with your own keys (CMEK) for skills	"(Preview)"
Agent Registry User role	"Beta" (roles page)

So Google has not labelled the scanner GA, and we do not either. CMEK means keys you control that lock the stored files; Google says it is supported "only in the us and eu skill locations" (places you choose when registering a skill) and cannot be set or updated once a skill exists there.

What about limits, company rules and price?

Google caps what you can upload: a 1 MB ZIP file, then 10 MB unpacked and 1 MB per unpacked file, the last two "enforced when scanning is enabled". It also allows 100 skills and 500 revisions per project per location, and 120 create, update or delete requests a minute. A company-wide rule can forbid switching scanning off, but Google says such rules "can't inspect" file contents or security findings, so they check the setting, not the skill.

Scanning is free "Through December 31, 2026", then "$8.00 per 1 million input tokens" from January 1, 2027. A token is a small chunk of text that AI services count and bill by. Google's example, a 10 KB package of about 2,500 tokens, comes to $0.02 per new revision; that is Google's estimate, not a rate we checked.

Where Google's pages differ

The pages we read differ in one place, and we did not find which page is current. Switching an existing skill to blocking is refused, says the architecture page, when the default revision has "security findings, pending scan results, or failed or incomplete scan results". The manage skills page names only "security findings or pending scan results".

What do Google's pages not say?

We did not find, on the pages we read, how often the scanner is right or what test set backs it; which models scan; where scan content is processed or whether it is kept; how long a scan takes; whether a version with a failed scan can be downloaded or made the default; whether anything is rescanned when the scanner changes; or a CMEK price.

How we know

We read 13 Google Cloud Agent Registry pages (release notes, pricing, scan skills, skills architecture, register skills, roles, quotas, manage skills, manage skill revisions, troubleshooting, overview, concepts, data model) and the combined Google Cloud release notes on November 9, 2026. Eleven print "Last updated 2026-11-06 UTC"; the release notes page and the overview print 2026-10-29, although the release notes page carries the November 6 entry. We tested nothing, and everything here is Google's documentation alone. We did not read Google's general Cloud terms, data-processing terms or Cloud KMS pricing. Pages can change.

What to do this week

Steps that need no developer access.

Ask whoever runs your Google Cloud account whether any of your agents load skills from Agent Registry, and whether scanning is on for each skill (it is on by default). If none do, stop here.
Name one owner for flagged skills: someone who can read findings and decide between fixing the skill and switching the policy. Give the Admin and Editor roles only to trusted administrators, and remember that the User role can change skills and scanning settings too; Google says to avoid granting the first two "directly to agents".
Ask your Google account team in writing how often the scanner is right on skills like yours, where skill content is processed and whether it is kept, and whether a failed scan blocks a version. The pages we read do not answer these. Treat every scan result as input to a human review.

Book an AI discovery call

Agent Skill Scanning on Google Cloud: Who Checks the Instructions Your AI Agent Follows?