cloud-monitoring-promql-query

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [Command Execution]: The skill uses local shell commands such as gcloud and curl to resolve project configurations and fetch resource descriptors from Google Cloud APIs.
  • Evidence: SKILL.md contains instructions to run gcloud config get-value project and gcloud auth print-access-token to authenticate API calls to monitoring.googleapis.com.
  • Context: These operations are standard for interacting with Google Cloud services and are used here to ensure the generated queries are correctly scoped to the user's environment. The skill enforces a blocking check if the Project ID cannot be resolved, preventing unauthenticated or misconfigured query generation.
  • [Local Code Execution]: The skill includes a Python script (scripts/validate_promql.py) designed to lint and validate generated PromQL queries.
  • Evidence: SKILL.md instructs the agent to install promql-parser via pip and execute the local validation script.
  • Context: This is a utility for ensuring that the PromQL queries generated by the AI are syntactically valid and follow Cloud Monitoring best practices (e.g., requiring specific label filters). The script operates on the generated strings and does not ingest untrusted external data in a way that would facilitate code injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 04:27 PM
Security Audit — agent-trust-hub — cloud-monitoring-promql-query