google-cloud-scc-query
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [Command Execution Patterns]: The skill provides templates for
gcloud scccommands. These are restricted to read-only queries (list,group) and environmental configuration (gcloud config set api_endpoint_overrides). The skill explicitly prohibits modifying resources, applying patches, or executing configurations. - [Scope and Governance]: It implements 'Core Execution Rules' that mandate explicit parent scopes (projects/folders/organizations) and prohibits local credential searching or brute-force attempts. This ensures the agent operates under the principle of least privilege and does not attempt to escalate permissions.
- [Instructional Guardrails]: The skill contains specific guidance to halt on
PERMISSION_DENIEDerrors and avoid querying underlying resources (like VMs or Service Accounts) directly, focusing only on the SCC finding data.
Audit Metadata