gcp-cloud-run
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official Google Cloud container images for its build and deployment patterns. Specifically, it uses 'gcr.io/cloud-builders/docker' and 'gcr.io/google.com/cloudsdktool/cloud-sdk' for CI/CD tasks, and 'gcr.io/distroless/nodejs20-debian12' as a base image for production containers. These are established, trusted images from a well-known service.
- [COMMAND_EXECUTION]: Technical patterns in the skill demonstrate the use of the 'gcloud' CLI for deploying serverless infrastructure. The commands provided include the '--allow-unauthenticated' flag, which is a standard configuration for public-facing APIs and services on Google Cloud.
- [PROMPT_INJECTION]: The skill defines patterns for handling external data which serves as a potential surface for indirect prompt injection.
- Ingestion points: External data enters the application context via 'req.query' and 'req.body' in Express.js handlers, as well as 'cloudEvent.data' in Cloud Run Functions.
- Boundary markers: No explicit delimiters or boundary markers are used to isolate untrusted data in the provided code snippets.
- Capability inventory: The skill's primary capabilities involve infrastructure deployment ('gcloud run/functions deploy') and standard Node.js runtime operations.
- Sanitization: Example code uses 'JSON.parse()' on incoming Pub/Sub data without demonstrating additional validation or sanitization logic.
Audit Metadata