The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GKE cluster configurations and Kubernetes resources, creating a potential surface for indirect prompt injection if those resources are attacker-controlled.
Ingestion points: Uses gke:get_cluster and k8s:get_k8s_resource to read live cluster state and resource definitions (SKILL.md).
Boundary markers: No explicit instruction-data delimiters or warnings to ignore embedded instructions are defined for the data returned from the cluster.
Capability inventory: Possesses significant modification capabilities including gke:update_cluster, k8s:apply_k8s_manifest, and project-level IAM modifications via gcloud CLI (SKILL.md).
Sanitization: No sanitization or validation logic is specified for data retrieved from the cluster before it is processed by the agent or used in subsequent commands.
[COMMAND_EXECUTION]: The skill provides numerous gcloud shell commands for modifying cluster security settings and project IAM policies.
Evidence: Recommends commands such as gcloud container clusters update ... --enable-secret-manager, gcloud container clusters update ... --binauthz-evaluation-mode=..., and gcloud projects add-iam-policy-binding ... for execution (SKILL.md). While these are for hardening purposes, they represent a powerful execution capability.

gke-platform-security