gcp-org-escalation

GCP organization-level privilege escalation — cross-project pivoting, org policy bypass, service account impersonation chains, Terraform state secrets, and GKE cluster compromise. Escalate from single-project access to org-wide control.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/gcp-org-escalation/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with comprehensive executable commands and a clear branched decision flow, but it is monolithic — all content inlined in one large file with no progressive disclosure — and batch/destructive operations lack explicit validation gates.

Suggestions

Add explicit validation checkpoints between destructive or batch steps, e.g. verify an impersonation token resolves before pivoting, and confirm IAM permission on a target project before bulk enumerating its resources.

Split bulk reference material (Tools & Resources, Detection Signatures, per-primitive deep-dives) into separate files under references/ and signal them from SKILL.md so the body acts as an overview.

Factor the repeated cross-project enumeration loop into a single reusable snippet or script to remove the duplicated blocks across sections 4, 5, and 6.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with terse code comments and no over-explanation of GCP/IAM/Terraform concepts, but the cross-project enumeration loop is repeated verbatim across sections 4, 5, and 6 and could be factored out.	4 / 5
Actionability	Fully executable, copy-paste-ready gcloud/gsutil/kubectl/curl commands with concrete arguments covering the common cases across all five primitives.	5 / 5
Workflow Clarity	The Decision Gate and Error Handling sections give a clear branched sequence, but batch enumeration loops and destructive actions lack explicit validation checkpoints between steps, so the destructive/batch cap holds at 3.	3 / 5
Progressive Disclosure	Well-organized into sections, but at ~360 lines everything is inlined in a single file with no bundle references; the simple-skill exception (under 50 lines) does not apply, and content like the tool table and detection signatures could live in separate reference files.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, enumerating five concrete escalation primitives in a clear niche. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness at 3.

Suggestions

Add an explicit trigger clause, e.g. 'Use when escalating GCP access from a compromised project to org-wide control, or when the user mentions cross-project pivoting, service account impersonation, org policy bypass, or Terraform state secrets.'

Include the spelled-out synonym 'google cloud' alongside 'GCP' so the description matches users who type the full name.

Add a common-synonym trigger term like 'lateral movement' to broaden natural phrasing coverage.

Dimension	Reasoning	Score
Specificity	Lists five concrete escalation primitives — 'cross-project pivoting, org policy bypass, service account impersonation chains, Terraform state secrets, and GKE cluster compromise' — giving comprehensive coverage of the domain, matching the anchor for multiple specific concrete actions.	5 / 5
Completeness	Has a clear 'what' (the five primitives) but no explicit 'Use when...' trigger clause; the second sentence states purpose rather than a trigger condition, so per the missing-trigger cap completeness stays at 3.	3 / 5
Trigger Term Quality	Strong natural keywords (GCP, privilege escalation, cross-project, service account impersonation, org policy, Terraform state, GKE), but missing a few common synonyms a user might say such as 'google cloud' spelled out and 'lateral movement'.	4 / 5
Distinctiveness Conflict Risk	A clear niche (GCP organization-level escalation) with distinct, specific triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/cloud/gcp-org-escalation/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.