Dialogflow Cx Flows

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent and shows no malicious behavior, but it uses Google Cloud credentials and documents Dialogflow changes that should be done with least-privilege access and explicit user review.

Before installing or using this skill, make sure you are comfortable giving it access through your Google Cloud credentials. Use a limited service account, confirm the exact Dialogflow project/agent before any create/update/delete/import/load action, and install the Python dependencies from trusted sources.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If broad credentials are used, the agent could access or change Dialogflow resources beyond the intended flow or agent.

Why it was flagged

The skill expects Google Cloud credentials to access Dialogflow. This is necessary for the stated purpose, but the agent inherits whatever Dialogflow permissions the selected account or token has.

Skill content

- Service account or OAuth credentials with Dialogflow API access
- `gcloud` CLI authenticated OR bearer token

Recommendation

Use a dedicated least-privilege service account or OAuth identity limited to the intended project, location, and Dialogflow agent; avoid broad Owner/Editor credentials.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken or overbroad request could update, delete, import, or restore Dialogflow flow configuration in the authenticated Google Cloud account.

Why it was flagged

The API reference documents mutating and potentially destructive Dialogflow operations. These are relevant to flow management, but they can alter cloud-hosted conversation behavior.

Skill content

### Update Flow
PATCH /v3beta1/{flow.name=projects/*/locations/*/agents/*/flows/*}

### Delete Flow
DELETE /v3beta1/{name=projects/*/locations/*/agents/*/flows/*}

### Load Version (restore flow to version)
POST /v3beta1/{name=projects/*/locations/*/agents/*/flows/*/versions/*}:load

Recommendation

Require explicit user approval for mutating operations, verify project/location/agent IDs before execution, and test changes in a non-production agent when possible.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Different environments may install different package versions, which can affect behavior or supply-chain assurance.

Why it was flagged

The helper script relies on manually installed, unpinned PyPI packages. This is common for a client-library wrapper, but dependency versions and provenance are not fixed by an install spec or lockfile.

Skill content

Install:
    pip install google-cloud-dialogflow-cx google-auth

Recommendation

Install dependencies from a trusted package index and consider pinning reviewed versions in a local requirements file before use.