cloud-monitoring-promql-query
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [Command Execution]: The skill uses local shell commands such as
gcloudandcurlto resolve project configurations and fetch resource descriptors from Google Cloud APIs. - Evidence:
SKILL.mdcontains instructions to rungcloud config get-value projectandgcloud auth print-access-tokento authenticate API calls tomonitoring.googleapis.com. - Context: These operations are standard for interacting with Google Cloud services and are used here to ensure the generated queries are correctly scoped to the user's environment. The skill enforces a blocking check if the Project ID cannot be resolved, preventing unauthenticated or misconfigured query generation.
- [Local Code Execution]: The skill includes a Python script (
scripts/validate_promql.py) designed to lint and validate generated PromQL queries. - Evidence:
SKILL.mdinstructs the agent to installpromql-parservia pip and execute the local validation script. - Context: This is a utility for ensuring that the PromQL queries generated by the AI are syntactically valid and follow Cloud Monitoring best practices (e.g., requiring specific label filters). The script operates on the generated strings and does not ingest untrusted external data in a way that would facilitate code injection.
Audit Metadata