google-cloud-storage-bucket-architect
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- Command Execution Framework: The skill is designed to generate and, upon explicit user confirmation, execute Cloud Storage management commands (e.g.,
gcloud storage). This is a core functional requirement of the skill's purpose as an infrastructure architect. The skill mitigates risks by implementing a strict confirmation policy and providing alternative non-executable formats like Terraform and SDK snippets. - Dynamic Context Consideration: The skill uses
!notation (e.g.,!gcloud ...) to describe how project settings and bucket availability are assessed at runtime. While these commands execute to provide the agent with necessary context, the skill restricts these to read-only operations for baseline assessments (Phase 1) and availability checks (Phase 2), preventing unauthorized mutations during the automated assessment phase. - Attribution and Telemetry: The skill includes instructions to inject specific environment variables (
CLOUDSDK_METRICS_ENVIRONMENT) and headers into commands. This is used for platform-level usage tracking and attribution to this specific skill version. It does not appear to exfiltrate user data, as the instructions explicitly state the tag should carry no user data. - Secure-by-Default Posture: The instructions mandate several security best practices, including Uniform Bucket-Level Access (UBLA), restricted encryption types, and enforced soft-delete policies, unless the user provides an explicit override.
Audit Metadata