agent-platform-troubleshooting
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- Diagnostic Command Execution: The skill uses the
run_commandtool to executegcloudandcurlcommands. These operations are used for legitimate diagnostic purposes, such as inspecting project resources, reading logs, and verifying IAM policies on official Google Cloud APIs. - Instructional Guardrails: The instructions include a 'Mandatory Pre-Flight Checklist' with specific rules that prevent the agent from performing out-of-scope tasks or executing potentially risky custom scripts. For instance, Rule 2 explicitly prohibits the writing or execution of custom Python or bash scripts for resource discovery to prevent timeouts and ensure predictable behavior.
- Security Best Practices Advocacy: The reference documentation and instructions promote secure configurations. Rule 6 and Rule 9 specifically instruct the agent to recommend verifying IAP roles and creating VPC Service Controls (VPC-SC) ingress policies rather than bypassing these security layers.
- Data Ingestion Analysis: The skill processes user prompts and platform logs to identify root causes of failures. While this involves ingesting external data, the skill is constrained to read-only inspection of the platform's diagnostic information and does not perform any sensitive data exfiltration.
- Use of Official APIs: Network operations performed via
curltarget official Google Cloud API endpoints (e.g.,iap.googleapis.com,networkservices.googleapis.com). These are well-known, trusted services used for platform management.
Audit Metadata