Harden YAML config validation for unsafe tool references #5531

🔴 Required Information

Describe the Bug:

YAML-based agent configurations currently block the args key because it can be used to pass arbitrary arguments to Python constructors or functions.

However, unsafe Python callables can still be referenced without using args, for example through a tool reference such as subprocess.run.

This creates a validation gap: args is blocked, but unsafe standard-library callable references may still be resolved and registered as configurable agent tools through YAML-based configuration paths.

Steps to Reproduce:

1. Use ADK from the current main branch or a version where YAML config validation blocks args.
2. Create or upload a YAML-based agent config with a tool reference that does not use args, for example:

name: test_agent
model: gemini-2.0-flash
tools:
  - name: subprocess.run

3. Load the YAML-based agent configuration or submit it through the builder config path.

4. Observe that the config does not contain args, so the existing blocked-key validation does not reject it.

5. During tool resolution, the reference may be resolved as a user-defined callable.

Expected Behavior:

YAML-based configuration paths should reject unsafe Python module references such as subprocess, os, builtins, importlib, and similar modules before they are resolved as configurable tools.

The validation should not rely only on blocking the args key.

Observed Behavior:

The current validation blocks args, but does not reject unsafe callable references when no args field is present.

For example, a YAML tool entry such as subprocess.run can pass the blocked-key validation because it does not use args.

Environment Details:

ADK Library Version (pip show google-adk): google-adk 1.31.0 / current main

Desktop OS: Windows

Python Version (python -V): Python 3.13.12

Model Information:

Are you using LiteLLM: No

Which model is being used: N/A for the validation issue. Example YAML uses gemini-2.0-flash, but the issue occurs before model invocation.

🟡 Optional Information

Regression:

N/A. This appears to be a validation gap in the current YAML-based config handling.

Logs:

N/A

Screenshots / Video:

N/A

Additional Context:

I opened a PR with a focused hardening change and regression tests:

Related PR: #5529

The PR centralizes blocked config validation in config_agent_utils.py, reuses it from the builder upload validation path, and adds a defense-in-depth check in LlmAgent._resolve_tools() before importing user-defined tool references.

Minimal Reproduction Code:

from google.adk.agents.config_agent_utils import check_config_for_blocked_keys

config = {
    "name": "test_agent",
    "model": "gemini-2.0-flash",
    "tools": [
        {
            "name": "subprocess.run",
        }
    ],
}

check_config_for_blocked_keys(config, "root_agent.yaml")

Before the proposed hardening change, this type of config is not rejected by blocked-key validation because it does not contain args.

How often has this issue occurred?:

Always (100%)