gke-workload-troubleshooting
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from untrusted sources that could contain malicious instructions.
- Ingestion points: The skill ingests untrusted data via
kubectl logs(Step 3),kubectl get events, andgcloud logging read(Step 2). - Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within the logs or events being processed.
- Capability inventory: The skill possesses significant capabilities including shell execution (
kubectl,gcloud,git) and the ability to create/update GitHub Pull Requests (Step 5). - Sanitization: The instructions do not specify any sanitization, filtering, or validation of the content retrieved from logs or events before the agent processes it.
- [COMMAND_EXECUTION]: The skill dynamically constructs shell commands using variables extracted from user prompts or environment defaults.
- Evidence: Commands such as
kubectl get deployment {workload_name},gcloud logging read ... --project="{project_id}", andgit log -p -S "{image_name}" -- {manifest_file_path}interpolate parameters directly into shell strings. - Risk: If the platform does not sanitize these parameters, an attacker could provide a malicious string (e.g., for
{workload_name}) to execute arbitrary commands on the host system.
Audit Metadata