Requesting triage on several open PRs

[prasanna8585]

Filing this to make it easier to triage in one place - six PRs, each fixing a distinct, independently-verified security-relevant issue, currently have no reviews and no maintainer response beyond automatic assignment. Several have had multiple follow-up pings with no response. Listing them together in case that helps with routing, since they touch different components (auth, plugins/tracing, agent-config, tools, skills) and may need different reviewers.

PR	Opened	Assignee	Summary
#6474	Jul 25	@DeanChensj	_AuthLlmRequestProcessor resumes and executes a tool call found by ID in session history without checking it was authored by the current agent - the same check request_confirmation.py's equivalent resume path already has. In a shared session, one agent could resume and execute a different agent's auth-gated tool call.
#6499	Jul 28	@jawoszek	BigQueryAgentAnalyticsPlugin's sanitizer only pattern-inspects JSON-container-shaped strings; plain prose values (e.g. a tool's own error message containing Authorization: Bearer sk-...) passed through unredacted unless caught by an exact dict-key match.
#6546	Aug 1	@jawoszek	_build_request_log() in google_llm.py serializes req.config for DEBUG-level logging but didn't exclude http_options, so headers/extra_body/client_args (common places to put auth for a custom model endpoint) were written to the debug log stream in plaintext. Sibling of the already-fixed 761f1ac (same data, different sink - logs instead of trace spans).
#6646	Aug 8	@DeanChensj	_validate_module_reference()'s denylist doesn't cover yaml.unsafe_load/yaml.load/yaml.full_load (PyYAML is an unconditional dependency, not optional). Referenced as a no-args tool - the same entry point the already-fixed cProfile.run exploit used - this reaches full RCE via a malicious YAML string in a functionCall argument. Confirmed dynamically against the installed package, both before and after the fix.
#6676	Aug 11	@xuanyang15	RestApiTool substitutes model-supplied path parameter values into the request URL via unescaped str.format(). A value containing /, .., ?, or # can redirect the outgoing request (including its configured auth credentials) to an undeclared path or inject query parameters.
#6689	Aug 12	(unassigned)	_load_skill_from_gcs_dir builds its GCS blob prefix by directly interpolating a caller-supplied skill_id with no path validation, unlike the equivalent, already-validated app_name/eval_set_id handling in GcsEvalSetsManager.

Each PR includes a written reproduction/verification (several with dynamic confirmation against the installed package, not just static analysis) and a regression test; none have received review comments or a merge/close decision yet.

Not asking for expedited review ahead of others in the queue - just consolidating these in one place in case grouping them helps with assignment, since a few share root causes with already-merged fixes (761f1ac, the cProfile.run denylist fix, gcs_artifact_service.py's path validation) and might be quick to cross-reference.