The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it is designed to ingest and process data from external, potentially untrusted storage objects into the agent's context.
Ingestion points: The read_object MCP tool and shell commands like gcloud storage cat allow the agent to read object content (including text, PDFs, and images) directly from GCS buckets.
Boundary markers: The skill includes explicit security warnings (CAUTION blocks) in SKILL.md and references/mcp-usage.md instructing the agent to stop and ask for user confirmation before calling any tool that deletes objects or overwrites content.
Capability inventory: The skill possesses extensive capabilities including bucket/object deletion, overwriting existing data, and modifying IAM policies via both MCP tools and the gcloud CLI.
Sanitization: The skill relies on procedural human-in-the-loop confirmation and structured tool execution rather than automated content filtering.
[COMMAND_EXECUTION]: The skill makes extensive use of the gcloud CLI and curl to interact with Google Cloud APIs. These operations are essential for its primary function and are transparently documented for the user.
[EXTERNAL_DOWNLOADS]: The skill references and provides instructions for downloading software from trusted vendor domains.
Evidence: Instructions for downloading the MCP Toolbox binary from storage.googleapis.com and installing Node.js packages from the official @toolbox-sdk scope.
Evidence: Installation steps for GCSFuse involve adding the official Google Cloud APT repository at packages.cloud.google.com.
[PRIVILEGE_ESCALATION]: The GCSFuse reference documentation includes commands requiring elevated privileges (sudo apt-get install, sudo tee) to install system-level drivers and configure mount points on Linux hosts, which is standard behavior for file system utilities.

google-cloud-storage-basics