ClawHub
Back to skill

Security audit

agent-bom discover gcp

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, read-only GCP inventory helper, but it should only be used with scoped cloud credentials because local credential files may be accessed for authentication.

Install only if you are comfortable letting the workflow use your local GCP authentication context for read-only inventory. Use a narrowly scoped project and read-only ADC, workload identity, or short-lived service account; do not provide broad owner credentials or paste service account keys into chat, and review generated inventory JSON before sharing it.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Content
data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:
Confidence
66% confidence
Finding
The explicit reference to application_default_credentials.json confirms potential access to a file that commonly contains usable credential artifacts. In context this is not overtly malicious, but it is still risky because the skill's purpose does not require enumerating credential file contents, and accidental disclosure through debug output, persistence, or error handling would be damaging.

Credential Access

High
Category
Privilege Escalation
Content
file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:
      - "operator-selected inventory JSON output path"
Confidence
79% confidence
Finding
Reading gcloud credentials.db is more dangerous than reading ordinary config because it can contain locally stored authenticated account data and token-related material. Although the declared intent is inventory discovery, direct access to this credential store creates unnecessary exposure and could enable credential compromise if the implementation mishandles, logs, exports, or scans its contents.

Credential Access

High
Category
Privilege Escalation
Content
data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:
Confidence
66% confidence
Finding
The explicit reference to application_default_credentials.json confirms potential access to a file that commonly contains usable credential artifacts. In context this is not overtly malicious, but it is still risky because the skill's purpose does not require enumerating credential file contents, and accidental disclosure through debug output, persistence, or error handling would be damaging.

Credential Access

High
Category
Privilege Escalation
Content
data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:
Confidence
66% confidence
Finding
The explicit reference to application_default_credentials.json confirms potential access to a file that commonly contains usable credential artifacts. In context this is not overtly malicious, but it is still risky because the skill's purpose does not require enumerating credential file contents, and accidental disclosure through debug output, persistence, or error handling would be damaging.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.