The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill implements a 'Lazy Role Remediation Strategy' (Phase 2) which directs the agent to self-remediate permission failures by granting the deployment identity high-level administrative roles.
Evidence: SKILL.md instructions to run gcloud organizations add-iam-policy-binding or gcloud billing accounts add-iam-policy-binding to grant groups of roles (e.g., Organization Admin, Billing Admin, Security Admin) upon encountering failure.
Evidence: references/admin-iam.md provides scripts to sequentially grant 23 distinct administrative roles to the identity.
[COMMAND_EXECUTION]: The skill makes extensive use of the gcloud CLI to perform sensitive organization-level administrative operations, including resource hierarchy modification and IAM policy updates.
[DYNAMIC_EXECUTION]: In Phase 3, the agent is instructed to generate YAML configuration files for 17 organization policies at runtime and apply them using the gcloud org-policies set-policy command.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from cloud resources which could be manipulated to influence agent behavior or resource naming.
Ingestion points: gcloud organizations describe output is used to populate variables for the deployment summary and resource IDs in SKILL.md.
Boundary markers: No delimiters or specific 'ignore' instructions are used when interpolating metadata into prompts.
Capability inventory: The skill possesses high-privilege capabilities including resource creation, IAM modification, and security policy enforcement.
Sanitization: No sanitization or validation logic is defined for the metadata retrieved from the Google Cloud API.

google-cloud-recipe-foundation-builder