Security audit

Gws Cloudidentity

Security checks for vulnerabilities and agentic risk

Overview

The skill openly documents Google Cloud Identity administration, but its short description understates high-impact device wipe/delete and SSO configuration powers.

Review this as an administrator-level Google Cloud Identity skill, not just a groups tool. Install only if you intend agents to help with device administration and SSO configuration, and require explicit human confirmation before wipe, delete, patch, or assignment changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest description materially understates the skill's capabilities by claiming it manages only identity groups and memberships while the documentation exposes device lifecycle and wipe operations. This mismatch can mislead users or higher-level agents into invoking sensitive, destructive commands they did not expect, increasing the risk of accidental device deletion or wiping.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill metadata says it is for groups and memberships, but the body documents SSO profile and assignment management, which can directly alter authentication behavior and organizational access controls. Misdescribing identity and SSO administration as a narrower groups-only skill creates a dangerous trust mismatch that may cause operators to approve use without understanding access-impacting functionality.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The description omits additional capabilities such as user invitations and policy retrieval, which means the declared scope does not match the real operational surface. Even where operations are read-only or less destructive, this weakens transparency and can defeat policy-based allowlisting, review, or user consent based on the manifest text.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation advertises destructive operations such as device delete, device wipe, and group delete without any explicit caution about irreversible impact or operational prerequisites. In an agent skill context, omission of warnings raises the chance that users or automated workflows trigger destructive actions without sufficient review or confirmation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill lists commands that create, delete, or modify inbound SSO profiles and assignments without warning that these changes can disrupt authentication, lock out users, or weaken security posture. Because these functions affect identity federation and sign-in routing, silent exposure in a productivity-labeled skill makes the risk materially higher.

Static analysis

No suspicious patterns detected.