dak-setup
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
gcloudCLI to manage user authentication and retrieve existing GCP project and region configuration. - [COMMAND_EXECUTION]: It executes a bundled Node.js script (
scripts/dak-setup.js) to apply the configuration. - [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by explicitly instructing the agent to redirect sensitive token output to
/dev/nullto prevent exposure in session logs or transcripts. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (Project ID, Region, Services) in
SKILL.md. It mitigates risks by requiring the agent to validate Project ID syntax (lowercase, digits, hyphens) and map service inputs to a canonical whitelist before passing them to the setup command execution.
Audit Metadata