Agent skill · Audited from source

gemma-dev

skill · google-gemma/gemma-skillsApache-2.0 licenceAudited 20 Oct 2026 · source 524f4804e9cd

★ 1,030pushed 2 days ago
✓SAFEGrade B · 89/100 · 20 Oct 2026 · 524f480
1,030repo stars · whole google-gemma/gemma-skills

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 524f4804e9cd and found no filesystem, network or shell access and no hard-coded secrets. What it does: Trigger this skill when building applications with Gemma or for general knowledge inquiries related to Gemma models (e.g. prompt structure, capabilities). Covers model selection, development workflows, and deployment…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “gemma-dev (google-gemma/gemma-skills)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/google-gemma/gemma-dev

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 524f4804e9cd · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishergoogle-gemma GitHub organizationOwner of the repository this skill is read from
  • Source foldergoogle-gemma/gemma-skills/skills/gemma-devThe exact folder we audited
  • LicenceApache-2.0As the repository states it
  • Commit pinned for this verdict524f4804e9cdA new audit runs when the source changes
  • Repository statusNot archivedLast push 2 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Trigger this skill when building applications with Gemma or for general knowledge inquiries related to Gemma models (e.g. prompt structure, capabilities). Covers model selection, development workflows, and deployment…

---
name: gemma-dev
description: Trigger this skill when building applications with Gemma or for general knowledge inquiries related to Gemma models (e.g. prompt structure, capabilities). Covers model selection, development workflows, and deployment best practices.
---

# Gemma Development Skill

## 1. Core Principle: Prioritize App Tooling

**DO NOT** generate raw PyTorch, TensorFlow, or `transformers` code unless the user explicitly asks for "Training," "Fine-tuning," or "Research." Always default to high-level frameworks, SDKs, and tooling optimized for application development.

## 2. Model Selection Guide

**CRITICAL:** Do not blindly default to `gemma-3-1b-it`. You must analyze the user's specific domain, technical constraints, and required input modalities to recommend the exact right fit. When recommending standard models, strictly default to the **Gemma 4** generation. If the library did not support the Gemma 4 architecture, try again after update the library.

### Core Gemma Models

All Gemma 4 models feature **Thinking Mode**, enabling advanced reasoning to process complex logic, math, and multi-step problems before generating a response.

- Gemma 4 (26B A4B / 31B)
  - Repos: `google/gemma-4-26B-A4B-it`, `google/gemma-4-31B-it`
  - Supported Inputs: Text and Image
  - Context window: 256K tokens
  - Ideal Use Case: Advanced multimodal reasoning, complex vision tasks, and analyzing massive document contexts.
  - Note: The 26B A4B utilizes a highly efficient Mixture-of-Experts for fast, heavy-weight reasoning, alongside the dense 31B variant.
- Gemma 4 (12B)
  - Repos: `google/gemma-4-12B-it`
  - Supported Inputs: Text, Image, **Audio**
  - Context window: 256K tokens
  - Ideal Use Case: Multimodal reasoning (including audio), inference in laptops, and consumer devices.
- Gemma 4 (E2B / E4B)
  - Repos: `google/gemma-4-E2B-it`, `google/gemma-4-E4B-it`
  - Supported Inputs:  Text, Image, **Audio**
  - Context window: 128K tokens
  - Ideal Use Case: Mobile NPU acceleration; on-device workflows explicitly requiring native audio processing alongside robust reasoning.

### Legacy & Lightweight Models (Gemma 3)

- Gemma 3 (4B / 12B / 27B)
  - Repos: `google/gemma-3-4b-it`, `google/gemma-3-12b-it`, `google/gemma-3-27b-it`
  - Supports Text and Image inputs with a 128K context window. Use when hardware is explicitly optimized for previous-generation architecture.
- Gemma 3 (270M / 1B)
  - Repos: `google/gemma-3-270m-it`, `google/gemma-3-1b-it`
  - Supports Text-only inputs with a 32K context window. Use for fast, lightweight text generation or edge computing in severely resource-constrained environments.

### Task-Specific Variants

Route users to purpose-built variants rather than forcing a standard model to perform highly specialized workflows.

- RAG / Vector Search: Use **EmbeddingGemma 2**
  - Repo: `google/embeddinggemma-2`
  - This dedicated embedder supports up to 8k tokens with flexible output dimensions (128 to 768). Fetch [EmbeddingGemma 2 model card](https://gemma.ai/models/embeddinggemma/model-card-v2.md.txt) for the best practice.
- Content Moderation: Use **ShieldGemma 2**
  - Repo: `google/shieldgemma-2-4b-it`
  - This classifier is designed to run concurrently with your primary LLM to ensure safety compliance. Fetch [ShieldGemma 2 model card](https://gemma.ai/models/shieldgemma/model-card-v2.md.txt) for the best practice.


## 3. Deployment Workflows

Map the user's deployment goals to the correct tooling stack and best practices.

- Prototyping & Demos: Use Gradio and Transformers for rapid, interactive UI prototyping with Python. Follow the `[assets/gradio-app.py]` best practice.
- Web & Client Applications: Use `transformers.js` to run inference directly on-device or entirely in the browser. Follow the `[assets/transformers-js-app.js]` best practice. **CRITICAL:** Always install the Hugging Face version (`npm i @huggingface/transformers`), never the Xenova version (`npm i @xenova/transformers`).
- Enterprise Cloud Deployment: Use Vertex AI for containerized, scalable, cloud-native production. Follow the `[assets/vertex-ai-app.py]` best practice. This requires setting the environment variables `GOOGLE_CLOUD_PROJECT`, `GOOGLE_CLOUD_LOCATION` (e.g., `us-central1`), and `GOOGLE_CLOUD_ENDPOINT_ID`.
- Apple Silicon (MLX): Recommend MLX when the user is on Mac Apple Silicon hardware. These configurations are optimized primarily for **Text** workflows.
  - Easy Path: Use [Ollama](https://ollama.com/library/gemma4/tags) with model tags like `gemma4:26b` or `gemma4:31b`.
  - Advanced Path: Use the `mlx-lm` package (`pip install mlx-lm`) for direct control, custom quantization, and fine-tuning (LoRA/QLoRA) via `mlx_lm.lora`.
  - For more details, follow the [MLX integration guide](https://gemma.ai/deployment/mlx.md.txt).

## 4. Speed Up Inference with Multi-Token Prediction (MTP)

When the user needs **faster inference** or **lower latency**, recommend **Multi-Token Prediction (MTP)** — Gemma 4's built-in speculative decoding technique. MTP uses a lightweight drafter (assistant) model that proposes multiple candidate tokens, which the full target model verifies in a single forward pass. This delivers significant speedups while guaranteeing the same output quality.

### Assistant Model Repos

Each Gemma 4 target model has a corresponding assistant model. The naming convention is `<target-model-id>-assistant`:

- Repos:
  - `google/gemma-4-E2B-it-assistant`
  - `google/gemma-4-E4B-it-assistant`
  - `google/gemma-4-12B-it-assistant`
  - `google/gemma-4-31B-it-assistant`
  - `google/gemma-4-26B-A4B-it-assistant`

Fetch [Speed-up Gemma 4 with Multi-Token Prediction](https://gemma.ai/get-started/capabilities/mtp.md.txt) for the best practice.

## 5. Quantization-Aware Training (QAT)

For deployments requiring maximum efficiency with minimal quality compromise, Gemma offers official **Quantization-Aware Training (QAT)** models. Unlike standard Post-Training Quantization (PTQ) which comp

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 524f480

Download folder ↗
git clone https://github.com/google-gemma/gemma-skills
git -C gemma-skills checkout 524f4804e9cd

The author documents no install command, so this uses the repository directly. Our verdict covers commit 524f4804e9cd only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 524f4804e9cd

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/google-gemma/gemma-dev/badge.svg)](https://modelsatlas.com/skills/google-gemma/gemma-dev/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/google-gemma/gemma-dev/badge.svg)](https://modelsatlas.com/skills/google-gemma/gemma-dev/)

Questions about gemma-dev

What does the gemma-dev skill do?
Skills for the Gemma and model/agent interactions
Is gemma-dev safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can gemma-dev access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (524f4804e9cd), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.