google/skills cloud-logging-finops
Checked the catalogued skill at cloud-logging-finops.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
14 suppressed by AI triage
The absolute path refers to a temporary virtual environment created by the skill, not arbitrary system access.
The path is used to execute a script within the skill’s own temporary environment, not for malicious traversal.
The script path points to the skill’s temporary VENV, which is a benign usage of an absolute path.
The code assigns a timer profile value, not a shell profile modification; no persistence mechanism is present.
The code references a legitimate Google Cloud API scope used for authenticated requests, not malicious activity.
The URL points to a Google Cloud Logging API endpoint used for reading project logs, a normal outbound call.
The call targets a Google Cloud Network Management API for retrieving VPC flow logs, which is legitimate.
The URL is a standard Google Compute Engine API call for listing subnetworks, part of normal inventory operations.
The reference is to a Google Observability API endpoint used for default scope configuration, a benign operation.
This variable holds the base URL for Google Logging API v2, used for legitimate API calls, not a malicious outbound request.
The absolute path is a static string used for printing a command, not dynamic path traversal or execution.
The code only formats a performance profile for output, with no shell profile modifications or persistence mechanisms present.
Only a string constant URL; no outbound network call executed here.
Only a string constant URL; no outbound network call executed here.