gcp-cloud-run
Enables the development of serverless applications on GCP, focusing on Cloud Run services and event-driven functions.
Install this skill
Security score
The gcp-cloud-run skill was audited on May 12, 2026 and we found 22 security issues across 5 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 95 | console.log(`Server listening on port ${PORT}`); |
Template literal with variable interpolation in command context
| 170 | res.send(`Hello, ${name}!`); |
Template literal with variable interpolation in command context
| 199 | console.log(`Event: ${cloudEvent.type}`); |
Template literal with variable interpolation in command context
| 200 | console.log(`Bucket: ${file.bucket}`); |
Template literal with variable interpolation in command context
| 201 | console.log(`File: ${file.name}`); |
Template literal with variable interpolation in command context
| 461 | console.log(`Published message ${messageId}`); |
Template literal with variable interpolation in command context
| 502 | host: `/cloudsql/${process.env.INSTANCE_CONNECTION_NAME}`, |
Template literal with variable interpolation in command context
| 583 | name: `projects/${projectId}/secrets/${name}/versions/latest` |
Webhook reference - potential data exfiltration
| 161 | **When to use**: Simple event handlers,Pub/Sub message processing,Cloud Storage triggers,HTTP webhooks |
Webhook reference - potential data exfiltration
| 1211 | ## Handle long-running with webhooks |
Access to .env file
| 93 | const PORT = process.env.PORT || 8080; |
Access to .env file
| 498 | user: process.env.DB_USER, |
Access to .env file
| 499 | password: process.env.DB_PASS, |
Access to .env file
| 500 | database: process.env.DB_NAME, |
Access to .env file
| 502 | host: `/cloudsql/${process.env.INSTANCE_CONNECTION_NAME}`, |
Access to .env file
| 571 | const apiKey = process.env.API_KEY; |
Buffer.from base64 decode
| 182 | ? JSON.parse(Buffer.from(message.data, 'base64').toString()) |
Buffer.from base64 decode
| 426 | ? JSON.parse(Buffer.from(message.data, 'base64').toString()) |
External URL reference
| 406 | --push-endpoint https://my-service-xxx.run.app/pubsub \ |
External URL reference
| 759 | response = await client.get("https://api.example.com/data") |
External URL reference
| 836 | "url": "https://my-service.run.app/process", |
External URL reference
| 1258 | "url": "https://worker.run.app/process", |