skills/gemini-cli-extensions/google-cloud-storage/google-cloud-storage-diagnostic/Gen Agent Trust Hub
google-cloud-storage-diagnostic
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
gcloudCLI tool to inspect cloud resources. It executes commands to retrieve IAM policies (gcloud storage buckets get-iam-policy), bucket metadata (gcloud storage buckets describe), and compute instance configurations (gcloud compute instances describe). These operations are essential for its primary diagnostic purpose. - [PRIVILEGE_ESCALATION]: The skill is designed to remediate access issues by proposing commands that modify IAM bindings (
gcloud storage buckets add-iam-policy-binding) or update compute instance access scopes (gcloud compute instances set-service-account). While these represent privilege modifications, the skill includes a strong 'CRITICAL SAFETY MANDATE' that strictly forbids auto-execution and requires explicit, per-command user approval (Y/N) before any such changes are applied. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests and processes untrusted data from Cloud Audit Logs (
gcloud logging read) and resource metadata. Malicious content embedded in resource names or log entries could theoretically influence the agent's behavior. However, the skill mitigates this risk by following a highly structured procedural workflow and focusing on specific fields within the JSON output of its diagnostic commands.
Audit Metadata