conectaesamamada
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill discloses internal infrastructure identifiers, including a specific GCP Project ID (
valid-hall-485823-k9), a deployment account (dev01@promise.ai), and a service account email. - [DATA_EXFILTRATION]: The instructions reveal the file path for a sensitive service account key (
Promise_onboarding_automation/secrets/service-account.json). While the skill advises against using this key for deployments due to permission limitations, the disclosure of secret storage locations is a potential security concern. - [COMMAND_EXECUTION]: The skill contains pre-defined shell commands (
gcloud config set project ...) intended for the agent to execute to verify the project configuration and token status. - [PROMPT_INJECTION]: The skill uses extremely prescriptive and commanding language (e.g., "STOP. Read this entire file", "DO NOT improvise", "Do NOT run gcloud auth list... to 'diagnose'"). While this is aimed at ensuring the reliability of a complex authentication task in restricted shells, such rigid instructions limit the agent's autonomy and diagnostic capabilities.
Audit Metadata