The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the gcloud CLI to manage security policies and fetch logs. This involves executing system commands such as gcloud compute security-policies and gcloud logging read to interact with the GCP environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from external sources during analysis operations.
Ingestion points: The get_armor_logs function in SKILL.md reads data from http_load_balancer logs which may contain user-controlled strings (e.g., request URLs).
Boundary markers: The output is structured using jq to extract specific fields, providing some separation from the raw log data.
Capability inventory: Capabilities are focused on GCP resource management and logging via gcloud and jq. No dangerous file-system writes or arbitrary network exfiltration tools are used.
Sanitization: There is no explicit sanitization or escaping of the log contents before they are processed and presented in the final report.

gcp-cloud-armor