agent-platform-alert-configuration
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Command Execution for Cloud Discovery: The skill uses
subprocess.runto call official CLI tools likegcloudandbq. These commands are used to discover agent runtimes, verify telemetry status, and check for existing monitoring configurations within the user's authorized environment. The use of list-based arguments and the absence of shell execution mitigates standard command injection risks. - Interaction with Trusted GCP APIs: Multiple scripts perform network requests to official Google Cloud API endpoints (e.g.,
logging.googleapis.com,monitoring.googleapis.com) to retrieve metadata. These operations use standard Google Auth libraries to handle OAuth2 tokens securely. - Standard Package Dependencies: The skill identifies necessary Python dependencies in a
requirements.txtfile, which includes well-known libraries such asgoogle-cloud-aiplatformandrequests. These are standard tools for interacting with cloud infrastructure. - Instructional Safety Tiers: The
SKILL.mdfile defines a clear 'Safety & Confirmation Tier' system. It distinguishes between read-only discovery (Tier R) and actions that incur costs or create resources (Tier B), enforcing a mandatory 'Explicit User Confirmation' step for the latter. - Configuration Validation: The skill includes a dedicated linting utility (
lint_syntax.py) that uses regular expressions to validate the syntax of generated PromQL and Terraform HCL configurations, helping to ensure the integrity of produced infrastructure-as-code files.
Audit Metadata