gcp-architecture-discovery

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses gcloud and kubectl commands to perform infrastructure discovery. This is the primary function of the skill and is performed within the user's authenticated GCP context.
  • [COMMAND_EXECUTION]: The script scripts/render_architecture_png.py utilizes subprocess.run() to invoke the local Graphviz dot utility. The implementation uses a list-based argument structure (shell=False) and passes data via stdin, which is a secure practice that prevents shell injection vulnerabilities.
  • [SAFE]: The skill includes explicit instructions for maintaining a structured documentation cache in the workspace using JSON and Markdown files. It uses invoke_subagent to handle these tasks asynchronously, preventing blocking of the main conversation thread while performing long-running discovery operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 01:11 AM
Security Audit — agent-trust-hub — gcp-architecture-discovery