Google Cloud Api Gateway

• Outcome: Review
• Latest audit: May 29, 2026, 9:37 PM
• Version:
  1.0.4

Overview

This Google Cloud API Gateway skill is coherent, but it gives an agent broad authenticated cloud API write/delete capability without clear confirmation or safety boundaries.

Install only if you trust Membrane and are comfortable granting it delegated access to the relevant Google Cloud project. Use least-privilege Google Cloud permissions, prefer discovered Membrane actions when possible, and require explicit review before any POST, PUT, PATCH, or DELETE request.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill explicitly documents raw proxy requests with state-changing HTTP methods like POST, PUT, PATCH, and DELETE, but it does not instruct the agent to confirm intent, warn the user about mutation risk, or prefer read-only discovery first. In a cloud infrastructure context, this can lead to unintended configuration changes, service disruption, or destructive actions against API Gateway resources.

VirusTotal

63/63 vendors flagged this skill as clean.