api-gateway-openapi-spec-authoring
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Usage Attribution and Telemetry: The skill instructions (references/attribution.md) specify adding attribution tags to gcloud CLI commands and User-Agent headers for usage tracking. This is a common practice in official developer tools, is clearly disclosed, and includes an explicit opt-out mechanism if desired by the user.
- Infrastructure Management via CLI: The skill utilizes the Google Cloud CLI (gcloud) for authenticating, enabling services, and managing API Gateway resources. These operations are standard for managing Google Cloud infrastructure and are the primary intended purpose of the skill.
- Secure Data Parsing: The included Python validation script (scripts/validate_apigw_openapi.py) is used to analyze user-provided OpenAPI specifications. The script implements security best practices by using yaml.SafeLoader (or CSafeLoader) when parsing input, which prevents potential arbitrary code execution vulnerabilities associated with unsafe YAML loading.
- Input Validation Surface: Because the skill processes untrusted OpenAPI specifications from the user's environment, it identifies this as a potential input surface. To mitigate risks, it provides a dedicated validation script that checks the specifications for structural and configuration errors before any deployment commands are executed.
- Standard Dependencies: The skill requires well-known and reputable dependencies, such as the Google Cloud SDK and the PyYAML Python package, which are fetched from official sources.
Audit Metadata