bigquery-observability
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Installation of Companion Skills: The skill suggests using
npxto fetch and install related optimization and troubleshooting tools from the vendor's repository. This is a standard operational pattern for providing a complete suite of diagnostic capabilities. - Usage Attribution and Telemetry: Instructions require the agent to include specific identifiers in CLI environment variables and HTTP headers for usage tracking. This practice is limited to metadata and does not involve the transfer of sensitive user credentials or data.
- Indirect Prompt Injection Surface: The skill retrieves and processes telemetry data from various BigQuery
INFORMATION_SCHEMAviews. As this data originates from the database environment, it represents a standard surface for indirect prompt injection. The skill uses structured SQL queries to maintain clear boundaries for the data retrieved. - Command Execution: The skill relies on standard command-line tools like
gcloudandbqto interact with Google Cloud services, which is expected for its intended purpose in big data and analytics observability.
Audit Metadata