Google Agent Development Kit for Java 1.9.0

Apply the Java 25 baseline first. These rules cover com.google.adk:google-adk:1.9.0 and its Java tools, MCP, A2A, code executors, and development server. ADK targets Java 17 or later; these rules target Java 25. Keep behavior specific to Java 1.9.0 when using documentation shared with other ADK languages or releases.

Agent instructions, configuration, and output

• Build LlmAgent instructions and tool descriptions from trusted code. Treat user messages, retrieved text, artifacts, memory, tool results, and peer-agent output as untrusted data; model instructions and safety filters do not authorize actions.
• Review every static instruction placeholder, including {key}, {user:key}, and {artifact.filename}: ADK interpolates state or artifact content into instructions. Keep attacker-controlled values out of privileged instruction text. An Instruction.Provider bypasses automatic interpolation but must enforce its own data boundaries.
• Load ConfigAgentUtils.fromConfig YAML, ComponentRegistry components, callbacks, and tool classes only from controlled deployment inputs. Enforce canonical file containment yourself for sub-agent and AgentTool config_path references: escaping the base directory only produces a warning in this release.
• Restrict SkillToolset sources to reviewed skills and resources. Keep LocalSkillSource directories immutable to untrusted users and reject symlinks escaping the approved tree; its absolute-path and traversal checks normalize paths without resolving symlinks. Bound resource bytes before adding them to context.
• Validate