google-cloud-networking-observability

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill extensively uses system tools such as gcloud, bq, curl, and jq to interact with Google Cloud Platform services for resource discovery and telemetry analysis.
  • [DYNAMIC_EXECUTION]: As detailed in references/vpc-flow-logs-cost-estimation.md, the skill generates and executes Python logic via python3 -c to perform arithmetic for tiered pricing calculations and to format data reports.
  • [CREDENTIALS_UNSAFE]: The skill retrieves active session authentication tokens using gcloud auth print-access-token to authorize curl requests to official Google Cloud Monitoring endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze VPC Flow Logs, firewall logs, and threat logs, which are data sources controlled by external network traffic and represent an indirect injection surface.
  • Ingestion points: Data is ingested via list_log_entries and execute_sql_readonly tools (SKILL.md, references/vpc-flow-analysis.md).
  • Boundary markers: The skill includes directives to print SQL for review and use structured markdown templates for results (SKILL.md, references/vpc-flow-logs-cost-estimation.md).
  • Capability inventory: The agent has access to gcloud, bq, curl, and python3 across various analysis scripts.
  • Sanitization: While BigQuery queries use JSON_VALUE for field extraction, there is no explicit sanitization for log content displayed in final reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:41 AM
Security Audit — agent-trust-hub — google-cloud-networking-observability