Is performing-gcp-penetration-testing-with-gcpbucketbrute safe to install?

SaferSkills independently audited performing-gcp-penetration-testing-with-gcpbucketbrute (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md · 1 file

performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md2.1 KB · Markdown

name: performing-gcp-penetration-testing-with-gcpbucketbrute

description: Perform GCP security testing using GCPBucketBrute for storage bucket enumeration, gcloud IAM privilege escalation path analysis, and service account permission auditing

domain: cybersecurity

subdomain: cloud-security

tags: [gcp, cloud-pentesting, bucket-enumeration, iam-audit, privilege-escalation, gcpbucketbrute]

version: "1.0"

author: mahipal

license: Apache-2.0

Performing GCP Penetration Testing with GCPBucketBrute

Overview

This skill covers Google Cloud Platform security testing using GCPBucketBrute for storage bucket enumeration and access permission testing, combined with gcloud CLI IAM enumeration to identify privilege escalation paths. The approach tests for publicly accessible buckets, overly permissive IAM bindings, and service account key exposure.

Prerequisites

Python 3.8+ with google-cloud-storage library
GCPBucketBrute installed from RhinoSecurityLabs GitHub
gcloud CLI authenticated with test credentials
Authorized penetration testing scope for target GCP project
google-api-python-client and google-auth libraries

Steps

Enumerate Storage Buckets — Use GCPBucketBrute with keyword permutations to discover accessible GCP storage buckets
Test Bucket Permissions — Call TestIamPermissions API on each discovered bucket to determine read/write/admin access levels
Audit IAM Bindings — Enumerate project-level IAM policies to identify overly permissive role bindings
Check Service Account Keys — Identify service accounts with user-managed keys and test for privilege escalation via impersonation
Test Privilege Escalation Paths — Check for iam.serviceAccounts.actAs, setIamPolicy, and other privilege escalation vectors
Generate Findings Report — Produce a structured security assessment with risk severity ratings

Expected Output

JSON report of discovered buckets with permission levels
IAM privilege escalation path analysis
Service account security assessment
Risk-scored findings with remediation recommendations

performing-gcp-penetration-testing-with-gcpbucketbrute— agent skill

Is performing-gcp-penetration-testing-with-gcpbucketbrute safe to install?

Performing GCP Penetration Testing with GCPBucketBrute

Overview

Prerequisites

Steps

Expected Output

Audit the pieces. Scan the whole. Decide.