The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/agent.py and scripts/process.py execute gcloud CLI commands using subprocess.run to manage Binary Authorization policies and attestations. The execution uses list-based arguments, which is a secure practice to prevent shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of GCP policies and container image metadata retrieved from the GCP environment.
Ingestion points: Binary Authorization policies retrieved via gcloud container binauthz policy export and attestations via gcloud container binauthz attestations list.
Boundary markers: None explicitly defined in the input parsing.
Capability inventory: Uses subprocess.run to execute authorized gcloud commands and writes results to local JSON reports (binauthz_report.json).
Sanitization: The use of list-based command execution ensures that values retrieved from policies (like attestor names or image URLs) cannot be used to inject additional shell commands.
[EXTERNAL_DOWNLOADS]: The skill uses curl to interact with the official Google Cloud Container Analysis API (containeranalysis.googleapis.com). This is a well-known, trusted service used for its intended purpose in the skill's workflow.

implementing-gcp-binary-authorization