gcp-cloud-deploy
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions heavily utilize shell command execution through the
gcloudCLI and helper utilities likejq,xargs, andbasename. It also employs shell-specific patterns like background jobs (&) and synchronization (wait) to handle multi-resource management. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the GCP environment (resource names and metadata) and interpolates them into subsequent command executions and reporting templates. This creates a surface for indirect prompt injection if an attacker can control names of GCP resources.
- Ingestion points: Resource data is retrieved via
gcloud deploycommands in JSON format throughout the SKILL.md file. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external data as untrusted or to ignore embedded instructions.
- Capability inventory: The skill possesses significant capabilities, including full management of GCP deployment pipelines, releases, and rollouts.
- Sanitization: There is no evidence of sanitization or escaping of resource names before they are used in shell commands or reporting strings.
Audit Metadata