gke-ai-troubleshooting-tpu-vbar-oom
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via multiple variables such as
{project_id},{cluster_name},{node_name},{workload_name}, and{namespace}which are directly interpolated into Cloud Logging (LQL) query templates inSKILL.md. - Ingestion points: Variable definitions in
SKILL.md(Step 0) used across Steps 1, 2, and 3. - Boundary markers: Absent; there are no delimiters or instructions provided to the agent to treat these specific values as data rather than instructions if they contain malicious payloads.
- Capability inventory: The skill uses the
query_logstool and executeskubectlcommands. - Sanitization: Absent; the instructions do not specify any validation or escaping of the user-provided strings before they are used to construct queries.
- [COMMAND_EXECUTION]: The skill provides and encourages the execution of a
kubectlcommand inSKILL.md(Step 3) that performs a cluster-wide scan using the-Aflag to list all pod names and container images across every namespace. This exposes broad workload metadata to the agent context.
Audit Metadata