Gcp Fullstack

• Analyzed: May 12, 2026, 4:19 AM
• Findings: 1
• Version: 0.1.4
• Hash: c6d9346401d5f9caa9146b79c68ea195728d955327f37cc1badb2584babd967b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides extensive automation for GCP and Cloudflare management, requiring high-privilege credentials (GCP, Cloudflare, Firebase) and broad network/filesystem permissions. While the instructions include a mandatory 'Planning Protocol' and safety checks, the skill exhibits high-risk behaviors such as constructing Cloudflare API payloads via `curl` using user-provided strings (e.g., in `docs/08-cloudflare.md`), which poses a risk of injection. Additionally, the 'LLM-as-Judge' feature in `SKILL.md` sends application data to an external endpoint (OpenRouter), which, although aligned with the stated QA purpose, represents a significant data egress point.