Repository navigation
Feature request: New skill "gcp-agent-security-audit" for proactive threat detection #160
Description
Proactive Security Audit Skill Proposal
Context:
As an active contributor and developer, I’ve been assessing our current skill set and identified an opportunity to strengthen our security-first roadmap. While we have excellent troubleshooting tools, we lack a native, proactive mechanism for agent self-auditing.
Proposal:
I propose adding a new skill: gcp-agent-security-audit. This skill will leverage BigQuery diagnostics to analyze agent interaction logs, specifically targeting anomaly detection and prompt injection patterns.
Proposed Scope:
- Anomaly Detection: Using BigQuery ML to flag deviations in agent behavior.
- Security Reporting: Providing actionable insights into an agent's historical interactions.
- Integration: Ensuring seamless integration with our existing agent platform workflows.
Proposed Structure:
skills/security/gcp-agent-security-audit/SKILL.md(Security best practices documentation)audit.py(Core logic for BigQuery diagnostic integration)
I have the architectural plan ready and am eager to contribute this. I'd appreciate any architectural feedback or preferred patterns you'd like me to follow before I push the initial implementation.
Activity
[-][Proposal]: New skill "gcp-agent-security-audit" for proactive threat detection[/-][+]Feature request: New skill "gcp-agent-security-audit" for proactive threat detection[/+]gaurika-analyst commentedon Aug 7, 2026
Great proposal! Adding proactive audit capabilities like prompt injection pattern detection and anomaly analysis directly via BigQuery ML is a huge step forward for agent security.
A couple of architectural suggestions that could enhance this skill pattern:
Real-time Alerting Integration: In addition to BigQuery diagnostic logs, adding a pattern to route critical anomalies directly to GCP Security Command Center or Cloud Monitoring alerts.
Granular Injection Patterns: Including pre-configured SQL templates/queries specifically tailored to identify common LLM vulnerability patterns (e.g., jailbreak attempts, indirect prompt injections in retrieved documents).
Mhmda1998 commentedon Aug 7, 2026
@gaurika-analyst Thank you for the architectural suggestions.
I incorporated the proposed improvements into PR #203:
The implementation is available in PR #203 for review.
Mhmda1998 commentedon Sep 9, 2026
Thanks @kumar-dhanagopal for the clarification.
This proposal is already tracked here as Issue #160, which specifically describes the gcp-agent-security-audit skill and the proposed BigQuery ML-based security auditing approach.
PR #203 was created as the implementation of Issue #160 and incorporated the architectural suggestions discussed in this issue, including BigQuery ML anomaly detection, modular SQL threat-detection patterns, and Pub/Sub alerting for high-risk findings.
I’ll keep Issue #160 as the primary reference for the proposal and internal triage. Thank you for taking the time to review and provide feedback.