vpc-network-setup
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION] (HIGH): The skill requests
Bash(gcloud:*)access. This allows for arbitrary execution of Google Cloud commands. If parameters provided by a user or external data are not strictly validated, an attacker could execute destructive commands or exfiltrate environment data.- [PROMPT_INJECTION] (HIGH): (Indirect) The skill is vulnerable to indirect injection because it lacks safeguards for its execution capabilities. Evidence Chain: 1. Ingestion points: User requests and data related to 'vpc network setup' in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Bash(gcloud:*), Write, and Edit tools across the skill context. 4. Sanitization: No sanitization, escaping, or validation logic is specified to prevent malicious strings from being passed directly to the bash shell.
Recommendations
- AI detected serious security threats
Audit Metadata