bigquery-observability

Pass

Audited by Gen Agent Trust Hub on Nov 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • Installation of Companion Skills: The skill suggests using npx to fetch and install related optimization and troubleshooting tools from the vendor's repository. This is a standard operational pattern for providing a complete suite of diagnostic capabilities.
  • Usage Attribution and Telemetry: Instructions require the agent to include specific identifiers in CLI environment variables and HTTP headers for usage tracking. This practice is limited to metadata and does not involve the transfer of sensitive user credentials or data.
  • Indirect Prompt Injection Surface: The skill retrieves and processes telemetry data from various BigQuery INFORMATION_SCHEMA views. As this data originates from the database environment, it represents a standard surface for indirect prompt injection. The skill uses structured SQL queries to maintain clear boundaries for the data retrieved.
  • Command Execution: The skill relies on standard command-line tools like gcloud and bq to interact with Google Cloud services, which is expected for its intended purpose in big data and analytics observability.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 12, 2026, 08:30 AM