gcp-bigquery-deep
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple local shell commands (bq, gcloud, jq, date) to retrieve BigQuery metadata, job statistics, and monitoring data for analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches dataset and table identifiers from the GCP environment and interpolates them directly into shell commands (e.g.,
bq show --format=json "$table"). This pattern represents an attack surface for indirect command injection if an attacker can control resource names in the environment. - Ingestion points: Resource names (datasetId, tableId) are ingested from bq command outputs within SKILL.md.
- Boundary markers: Shell variables are double-quoted, which mitigates simple word splitting but does not fully prevent injection if names contain subshells or backticks.
- Capability inventory: The skill can execute shell commands, list cloud resources, and access monitoring metrics.
- Sanitization: No validation or sanitization of ingested resource names is performed before they are used in shell commands.
Audit Metadata