iam-helper-for-troubleshooting
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Command Execution: The skill utilizes the
gcloudCLI and Python'ssubprocessmodule to interact with Google Cloud services. These operations are core to the skill's purpose of diagnosing and managing IAM policies. The scripts use list-based argument passing, which is a standard practice to mitigate command injection risks. - Human-in-the-Loop (HITL) Guardrails: A comprehensive approval policy is defined in the documentation, requiring explicit operator confirmation before any mutating or administrative actions are taken. This includes special high-risk warnings for destructive or administrative roles.
- Official Service Integration: The skill communicates with official Google Cloud API endpoints, specifically the Policy Troubleshooter API, to perform authoritative access analysis. These network operations are directed at well-known vendor infrastructure.
- Least-Privilege Resolution: The included automation scripts are designed to find the least-privileged roles that satisfy a specific permission requirement, promoting security best practices during the remediation process.
- Usage Attribution: The skill implements usage tracking via environment variables and custom User-Agent headers for telemetry. This is a standard operational practice and includes an opt-out mechanism for users.
Audit Metadata