Security audit

Gcp Fullstack

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate GCP automation skill, but it combines broad live cloud/CDN authority with under-disclosed external LLM evaluation and several unsafe default examples.

Install only if you are comfortable with an agent that can scaffold code, install packages, run tests, deploy to GCP, and alter Cloudflare/DNS settings. Treat OpenRouter-based QA as external data sharing, review or disable it for sensitive projects, pin package versions before running scaffolding commands, and require explicit confirmation before production deploys, database changes, public endpoints, IAM changes, or destructive tests.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:354
Finding: Unredacted prompts and model outputs transmitted to OpenRouter
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: docs/01-scaffolding.md:11
Finding: Unpinned packages are downloaded and executed during project scaffolding
Content: View full analysis
--typescript --tailwind --eslint --app --src-dir --import-alias "@/*"` | `next.config.ts` | | Nuxt 3 | `npx nuxi@latest init ` | `nuxt.config.ts` | | SvelteKit | `npx sv create ` | `svelte.config.js` | | Remix | `npx create-remix@latest ` | `remix.config.js` | | Astro | `npx create-astro@latest ` | `astro.config.mjs` | ``` Related unpinned installation instructions at lines 27–41 include: ```bash npm install firebase firebase-admin npm install prisma @prisma/client npm install drizzle-orm postgres npm install zod npm install -D vitest @vitejs/plugin-react playwright @playwright/test prettier ``` ### Technical Analysis `npx` downloads and executes package code from the configured package registry when the package is not already available locally. The explicit `@latest` tag permits the effective executable payload to change after this Skill has been reviewed. The additional unpinned `npm install` commands similarly resolve mutable versions and may execute package lifecycle scripts. No immutable version, integrity digest, reviewed lockfile, registry allowlist, or provenance verification is required. Consequently, compromise of a package maintainer account, registry resolution, or a future malicious release could turn a routine scaffolding operation into arbitrary code execution. ### Attack Path 1. A targeted package or maintainer account is compromised, or a future release becomes malicious. 2. The agent invokes one of the documented `npx ...@latest` commands. 3. The package manager retrieves the current registry artifact rather than a reviewed immutable version. 4. Package initialization ...[truncated 640 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: docs/03-database.md:56
Finding: Firestore profile creation rule permits cross-user document creation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: docs/03-database.md:125
Finding: Cloud SQL password is passed through the command line
Content: View full analysis
\ --instance= \ --password= ``` ### Technical Analysis Replacing `` with a real credential places the database password directly in the shell command. Depending on the environment, command arguments may be retained in shell history, terminal transcripts, CI logs, agent execution records, process-monitoring output, or debugging traces. The placeholder is not itself a secret, but the documented operational pattern encourages users or agents to insert a real password into an observable command-line channel. Anyone with access to those records can recover and reuse the credential. ### Attack Path 1. A user or agent replaces `` with the actual Cloud SQL password. 2. The command is executed in an interactive shell, CI job, or recorded agent environment. 3. The complete command is retained in history, logs, transcripts, or process telemetry. 4. Another local user, CI operator, log reader, or compromised monitoring component retrieves the password. 5. The exposed credential is used to authenticate to the database through any reachable connection path. ### Impact Assessment The exposed credential grants the database privileges assigned to the created Cloud SQL user. Depending on that user's grants and network reachability, an attacker may read, alter, or delete application data. The issue does not by itself grant GCP IAM privileges, but database compromise may affect all schemas and records accessible to that account. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (57)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file claims listed credentials are never used for direct API calls, but later provides a template that sends OPENROUTER_API_KEY in an outbound fetch request to OpenRouter. This contradiction is dangerous because users may trust the credential-handling statement and unknowingly allow external transmission of prompts and potentially sensitive generated content under false assumptions.
Content: No source excerpt is available for this finding.

Unvalidated Output Injection

High

Category: Output Handling
Confidence: 90% confidence
Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
Content: Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.
md
} if (config.forbiddenPatterns) { for (const p of config.forbiddenPatterns) { const match = p.exec(output.content); results.push({ rule: `forbidden:${p.source}`, passed: !match, details: match ? `Found: "${match[0]}"` : "Clean" }); }

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is user-invocable and framed as handling the entire GCP development lifecycle, which is broad enough to match many ordinary requests and trigger powerful actions with weak boundaries. In an agent setting, overbroad activation increases the chance of unintended scaffolding, cloud operations, file modification, or deployment in response to ambiguous prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises code generation, testing, deployment orchestration, and Cloudflare/GCP changes without a prominent user-facing warning that these actions can modify local files and live infrastructure. In this context, missing warnings are risky because the skill is designed for high-impact operational tasks and could be invoked by users who do not expect side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The migration guide states that pre-production validation was extracted into a dedicated qa-gate-gcp skill, implying this skill no longer owns that capability. Later sections reintroduce a full QA gate workflow, generated validation tests, and go/no-go reporting as active responsibilities of gcp-fullstack, creating a semantic mismatch about the skill's actual scope.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The OpenRouter fetch sends prompt and output content, along with authorization derived from OPENROUTER_API_KEY, to an external service. In a QA workflow for arbitrary applications, this can expose proprietary code, user content, secrets, or sensitive business data unless the payload is minimized and redacted first.
Content: Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.
md
return { overall_score: 0, issues: ["OPENROUTER_API_KEY not set — skipping"], recommendation: "review" }; } const response = await fetch("https://openrouter.ai/api/v1/chat/completions", { method: "POST", headers: { Authorization: `Bearer ${OPENROUTER_API_KEY}`, "Content-Type": "application/json" }, body: JSON.stringify({

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 423)May include surrounding context.
md
Also generate `qa-reports/go-no-go-report.md` (human-readable version). NEVER auto-deploy after a CONDITIONAL or NO-GO verdict. NEVER delete test data from production databases. Redact API keys from reports before writing to disk.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description advertises a very broad 'super agent' that spans scaffolding, cloud provisioning, authentication, deployment, CDN/security, and monitoring, but it provides no narrowing activation conditions, safety boundaries, or explicit exclusions. In a skill that also requests filesystem and network permissions plus access to cloud and CDN credentials, this ambiguity increases the chance the agent is invoked for overly broad or sensitive operations without clear user intent verification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The scaffolding instructions invoke remote package executables via npx using the moving @latest tag, which causes unreviewed code to be fetched and executed at runtime. If an upstream package is compromised or a breaking release is published, users following the skill may execute attacker-controlled code on their workstation or CI environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This instruction runs nuxi through npx with @latest, which downloads and executes whichever version is current at the time the skill is used. That creates a supply-chain risk because the executed bootstrap code is not fixed, reviewed, or reproducible, and a compromised or malicious upstream release could run arbitrary code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx sv create without an exact version means the skill directs users to execute mutable remote code during project setup. In a high-automation scaffolding context, this increases exposure to supply-chain compromise and makes builds non-reproducible.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The create-remix scaffolding command is executed through npx with @latest, so the exact code run is uncontrolled and may change over time. If the upstream package or dependency chain is compromised, the initialization step could execute arbitrary code and alter generated project files.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The create-astro command uses npx with @latest, which instructs users to fetch and run the newest remote package version without prior validation. That exposes developers to supply-chain attacks and unpredictable behavior during bootstrap, especially when this skill is used repeatedly across environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Cloud Run deployment example includes --allow-unauthenticated, which makes the service publicly reachable, but the documentation does not clearly warn readers that this exposes the endpoint to the internet. In a "fullstack super agent" skill intended to scaffold and deploy production workloads, this can lead users to unintentionally publish internal/admin or partially secured services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTTP Cloud Functions example also uses --allow-unauthenticated without explaining that anyone on the internet can invoke the function. For webhook/API patterns, this is especially risky because users may copy the command for handlers that process sensitive data or trigger privileged backend actions, resulting in unintended public exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file includes code that accesses sensitive credentials via environment variables, including a private key, but the surrounding documentation does not warn the user about handling secrets safely. Under the markdown-file criteria for SQP-2, examples that affect privacy or credential security should include a clear warning or disclosure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation tells users to execute npx firebase without pinning an exact package version, which can pull whatever version is current at execution time. This creates a supply-chain and reproducibility risk: a compromised, malicious, or breaking upstream release could be fetched and run in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx firebase without a pinned version allows arbitrary latest code from the package registry to be downloaded and executed at runtime. In a deployment-oriented skill, this is especially risky because the command may run with developer credentials and modify production Firebase resources.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: npx prisma generate without version pinning can execute whichever Prisma package version is resolved at the time, undermining build integrity and reproducibility. If the upstream package or dependency chain is compromised, the generated client step becomes an arbitrary code execution vector in the developer or CI environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: npx prisma db push executes an unpinned CLI that may change behavior across releases or run compromised upstream code. Because this command directly affects the database schema, exploitation or accidental drift could impact data integrity in addition to supply-chain exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: npx prisma migrate dev is another unpinned package execution point, exposing the user to dependency substitution, malicious releases, or unexpected version behavior. In a database migration context, this can lead to unauthorized code execution and unintended schema modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to implement a complete feature 'autonomously' including schema changes, API routes, auth-related logic, and write operations, but it does not require warning the user or obtaining confirmation before making impactful code or data-model changes. In a high-privilege full-stack/GCP automation skill, that omission increases the chance of unintended database mutations, privilege-affecting auth changes, or broad code changes being applied without informed user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The E2E example performs create and delete operations after logging in, but it does not require a dedicated test environment, seeded fixture account, or explicit warning against running against production-like systems. In this skill's GCP full-stack context, these steps can mutate real cloud-backed data and cause accidental data loss or unauthorized changes if pointed at the wrong environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The full-suite commands encourage running Vitest and Playwright without warning that tests may invoke state-changing operations in connected services. Given the preceding destructive E2E examples and the skill's cloud deployment scope, an agent or user could unintentionally execute writes, deletions, or billable actions against non-test environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.