cloud-logging-configuration-basics
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides structured templates for using the
gcloudcommand-line interface to manage resources like log buckets, sinks, and metrics. - [PRIVILEGE_ESCALATION]: The skill includes instructions for modifying project-level IAM policy bindings via
gcloud projects add-iam-policy-binding. This capability is identified as a high-risk security mutation, and the skill implements strict confirmation tiers to ensure the agent receives explicit user approval before execution. - [EXTERNAL_DOWNLOADS]: References to official Google Cloud documentation and installation scripts are provided for environment setup. As these target official Google domains, they are considered safe references.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing user-supplied data such as log filters and resource IDs.
- Ingestion points: Template placeholders in
SKILL.md(e.g.,{project_id},{filter_expression}). - Boundary markers: Implementation of defined safety tiers (R, M, B, D) that govern command execution based on risk.
- Capability inventory:
gcloudmanagement commands acrossSKILL.md. - Sanitization: The skill mandates interactive and typed confirmations for high-risk data-modifying operations.
Audit Metadata