The Agent Skills Directory

Local Command Execution: The scripts/check_quota_metrics.py script utilizes subprocess.run to interact with the Google Cloud SDK (gcloud). This is used for legitimate tasks such as fetching active gateway configurations and API config details for comparison. The commands are executed as lists of arguments, which is a standard security practice to mitigate the risk of shell injection.
Indirect Prompt Injection Surface: The validation script processes OpenAPI specifications provided as local files. While this involves ingesting external data, the script uses safe parsing methods and operates within a limited local context.
Ingestion points: Local specification files loaded via the --spec and --baseline-spec arguments in scripts/check_quota_metrics.py.
Boundary markers: Not applicable for static file processing, though the script enforces structured data parsing.
Capability inventory: The script performs local file reads and executes gcloud commands via subprocess.run to compare configurations.
Sanitization: The script correctly utilizes yaml.safe_load() to parse YAML content, which prevents arbitrary code execution during the parsing process, and employs list-based argument passing for CLI calls.
Security Configuration Guidance: The documentation provided within the skill covers critical security topics such as identity-based authentication (JWT), backend lockdown using dedicated service accounts, and per-project request quotas. The instructions emphasize proper IAM role assignment and follow the principle of least privilege.

api-gateway-backend-security-and-rate-limiting