ClawHub
Back to skill

Security audit

agent-bom discover gcp

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a user-controlled, read-only GCP inventory workflow with disclosed credential use and no evidence of hidden or destructive behavior.

Use project-scoped read-only credentials and a private inventory output location. Obtain and review the referenced adapter from a trusted release; it is absent from this package, so its credential redaction guarantees remain unverified. Review inventory before sharing it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
credential_handling: "Credentials stay in the operator environment. The skill invokes GCP SDK discovery locally and writes canonical inventory JSON with source_type=skill_invoked_pull. agent-bom receives sanitized inventory only when the operator explicitly scans or pushes that inventory."
    data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:
      - "operator-selected inventory JSON output path"

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- python
      env: []
      credentials: gcp-read-only
    credential_policy: "Use the operator's existing Application Default Credentials, workload identity, or short-lived service account credentials. Do not ask users to paste service account JSON into chat. Do not print credential values."
    optional_env:
      - GOOGLE_APPLICATION_CREDENTIALS
      - GOOGLE_CLOUD_PROJECT

Static analysis

No suspicious patterns detected.