T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:23- Finding
Collection of Unredacted BigQuery Query and Billing Metadata
- Content
View full analysis
= DATE_SUB(CURRENT_DATE(), INTERVAL 30 DAY) ORDER BY total_bytes_billed DESC LIMIT 50' ``` 2. **BigQuery storage usage per dataset** — to identify large datasets ```bash bq query --use_legacy_sql=false \ 'SELECT table_schema as dataset, ROUND(SUM(size_bytes)/1e9, 2) as size_gb FROM `project`.INFORMATION_SCHEMA.TABLE_STORAGE GROUP BY 1 ORDER BY 2 DESC' ``` 3. **GCP Billing export filtered to BigQuery** — monthly BigQuery costs ```bash gcloud billing accounts list ``` ``` ### Technical Analysis The skill directs users to export and submit complete BigQuery job SQL, user email addresses, dataset names, and billing-account metadata. These fields exceed the minimum information necessary for many cost-optimization tasks. The `query` field can contain sensitive literals embedded in SQL statements, including customer identifiers, email addresses, internal project or table names, access tokens, or other application data. The `user_email` field directly exposes user or service-account identities. Dataset names may disclose internal system structure or business functions. The command `gcloud billing accounts list` enumerates billing-account identifiers and display names but does not provide the requested monthly BigQuery cost data. It therefore introduces unnecessary metadata exposure without directly satisfying the stated analysis objective. Although the skill later tells th ...[truncated 1827 chars]- Remediation
View remediation