Cloud Security Posture

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:09 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent cloud audit guide, but it asks for an overbroad GCP storage admin role while advertising a read-only posture.

Review before installing or using this skill in production cloud environments. Use a dedicated, short-lived audit identity, replace the GCP storage.admin prerequisite with the narrowest read-only/custom permissions that can list buckets and read IAM policies, and treat aws iam generate-credential-report as an explicit low-impact initiation step rather than a purely read-only command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:46

Finding

Excessive GCP Storage Administrative Privileges Required for Read-Only Inspection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 46
Vulnerability Type: Violation of least privilege
Risk Level: Medium

Complete Code Snippet:

markdown

- **[GCP]** gcloud CLI configured (`gcloud auth list` shows active account); roles `roles/iam.securityReviewer`, `roles/cloudkms.viewer`, `roles/compute.viewer`, `roles/storage.admin` (for bucket IAM inspection) on target project(s)

Technical Analysis

The Skill instructs users to grant the predefined GCP roles/storage.admin role merely to inspect bucket IAM policies. A storage administration role grants capabilities materially broader than those needed for a read-only cloud posture assessment.

This requirement conflicts with the package's declared read-only safety posture. Although the audited instructions do not explicitly invoke a mutating GCP command, provisioning the assessment identity with administrative storage authority unnecessarily expands the consequences of credential theft, command substitution, operator error, or future changes to the Skill.

The issue is a privilege-boundary failure: the assessment identity receives authority based on the broad service role rather than a minimum set of metadata and IAM-policy inspection permissions.

Attack Path

1. An operator follows the documented prerequisite and assigns roles/storage.admin to the identity used by the Skill.
2. The assessment process authenticates through gcloud with that overprivileged identity.
3. An attacker compromises the local Agent, CLI session, host, or associated credentials, or induces execution of an unintended storage command.
4. The attacker uses the administrative storage permissions available to that identity rather than being limited to read-only inspection.
5. Storage resources within the role's assignment scope may be modified or otherwise administered.

The audited package contains no command that directly performs these malicious steps; the exploitable condition is the e ...[truncated 563 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove roles/storage.admin from the documented prerequisites.
2. Use the narrowest predefined read-only role that provides the bucket metadata and IAM-policy inspection permissions required by the documented commands.
3. If no predefined role provides an appropriate permission set, create a custom audit role containing only the necessary get and list permissions.
4. Assign the replacement role at the narrowest practical resource scope rather than across unrelated projects or the organization.
5. Explicitly deny or omit permissions that create, update, delete, or change access to storage resources.
6. Test all documented GCP inspection commands using the reduced role and document the exact required permissions.
7. Add a prerequisite warning that the assessment must run under a dedicated, short-lived, read-only identity.
8. Periodically review the custom role and remove permissions no longer required by the Skill.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

[GCP] Assess Cloud KMS configuration and default encryption:

text

gcloud kms keyrings list --location=<location>
gcloud kms keys list --keyring=<keyring> --location=<location>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

[GCP] Assess Cloud KMS configuration and default encryption:

text

gcloud kms keyrings list --location=<location>
gcloud kms keys list --keyring=<keyring> --location=<location>

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file explicitly states that all commands are read-only, but aws iam generate-credential-report initiates report generation on the AWS side and is not strictly read-only. While this does not directly change security posture or destroy data, the inaccurate safety claim can mislead an agent or operator into executing a state-changing command under false assumptions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.