The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses curl to interact with an external service at https://defuddle.md/ to fetch and process remote web content.
[DATA_EXFILTRATION]: Sending investigation-related URLs to the third-party defuddle.md service can expose metadata about the investigation or internal documentation paths to an external party. The skill documentation identifies this risk and advises against using it for adversary or sensitive infrastructure.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8) because it processes untrusted data fetched from external URLs via the defuddle.md service.
Ingestion points: The curl command in SKILL.md that fetches content from external URLs.
Boundary markers: None explicitly implemented to separate the fetched content from agent instructions.
Capability inventory: Includes gcloud for reading and modifying IAM policies and service account keys, and curl for network access.
Sanitization: No specific sanitization or validation of the fetched Markdown content is mentioned.
[COMMAND_EXECUTION]: The skill provides numerous gcloud shell commands for auditing IAM policies, reading logs, and investigating service account activity. These commands are typical for a cloud security investigation role.

investigating-gcp-incidents