Security audit
Security checks for vulnerabilities and agentic risk
This skill is a sparse Google Cloud Storage helper that asks for cloud credentials but does not clearly scope what it may do or include the script it says to run.
Review this before installing. Use only a least-privilege credential limited to the specific storage actions you intend, avoid shared shells or logs that may expose STORAGE_API_KEY, and do not rely on the skill for non-storage GCP tasks unless the missing implementation and operation scope are clarified.
The skill's activation guidance is very broad ('gcp related functionality', 'cloud operations'), which can cause the agent to invoke this skill in contexts beyond narrowly scoped storage tasks. In a cloud-management skill, over-broad triggering increases the chance of unnecessary credentialed actions or use in situations the user did not explicitly intend.
The documentation instructs users to set a cloud credential environment variable but provides no warning about the sensitivity of the API key, least-privilege expectations, or the risk of unintended cloud actions. For a GCP storage management skill, missing credential safety guidance can lead to over-privileged key use, accidental exposure, or unsafe execution in shared environments.
No suspicious patterns detected.
