gcp-svc-account-impersonation

GCP service account impersonation chain — IAM `roles/iam.serviceAccountTokenCreator`, `roles/iam.serviceAccountUser`, `actAs` on Cloud Functions / Cloud Run / Compute Engine. Pivot from low-priv SA to org-admin via chained impersonation.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/gcp-svc-account-impersonation/SKILL.md

Quality

Content

87%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an excellent lean, executable runbook with strong conciseness and actionability, but its destructive operations lack validation checkpoints, capping workflow clarity. Adding verify/confirm steps before destructive actions would raise the score.

Suggestions

Insert validation checkpoints before destructive pivots, e.g. confirm the target SA's effective permissions with test-iam-permissions before minting a key or deploying a backdoored function.

Add an explicit verify step after each impersonation primitive (e.g. 'Confirm token scope/identity with `gcloud auth list` / decode the JWT') so the operator can detect a failed or limited pivot before proceeding.

Flag which primitives are high-fidelity/detectable (key creation, setMetadata+reset) earlier in each subsection rather than only in the trailing OPSEC section, so detection cost informs action choice inline.

Dimension	Reasoning	Score
Conciseness	The body is lean and command-driven: terse one-line context followed by executable blocks, with no padding explaining GCP/IAM concepts Claude already knows. Every token earns its place.	5 / 5
Actionability	Commands are fully executable and copy-paste ready, using real endpoints (iamcredentials.googleapis.com, metadata server) and real gcloud invocations covering the common impersonation primitives and pivots.	5 / 5
Workflow Clarity	Phases are sequenced (enumerate -> impersonate -> cross-project pivot -> OPSEC), but the destructive operations (deploying a backdoored function, modifying VM metadata, minting long-lived keys) have no validation checkpoints or verify/confirm feedback loops, which caps workflow clarity at 3 per the rubric.	3 / 5
Progressive Disclosure	No bundle files exist and none are needed; the single SKILL.md is under ~120 lines with well-organized, clearly headed sections, which per the rubric lets progressive disclosure score 5 for a self-contained skill.	5 / 5
	Total	18 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, action-oriented, and clearly niche, but it lacks any explicit 'when to use' guidance, which caps its completeness. Adding a 'Use when...' clause citing natural trigger phrases would raise the overall score.

Suggestions

Append an explicit trigger clause, e.g. 'Use when the user has a GCP token or service account key and wants to escalate privileges via service account impersonation or actAs.'

Soften the jargon-only keyword set by adding natural user-facing synonyms ('GCP privilege escalation', 'service account token', 'impersonate SA') alongside the IAM role names.

Lead with the concrete capability ('Pivot from low-privilege to org-admin via chained service account impersonation') before the role enumeration so the 'what' is immediately legible.

Dimension	Reasoning	Score
Specificity	Names concrete IAM roles (serviceAccountTokenCreator, serviceAccountUser), actAs on specific compute services, and a low-priv-to-org-admin pivot, giving several specific actions with only minor coverage gaps rather than the full comprehensive catalog that would warrant a 5.	4 / 5
Completeness	The 'what' is clear and concrete (impersonation chain via named roles and services, pivot to org-admin), but there is no explicit 'Use when...' trigger guidance, which per the rubric caps completeness at 3.	3 / 5
Trigger Term Quality	Includes natural terms a user would say (gcp, service account, impersonation, cloud functions/run/compute, actAs) with good coverage, but is jargon-heavy and misses some common synonyms that would push it to a 5.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (GCP service-account impersonation / privilege escalation) with distinct, specific triggers and minimal overlap risk with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/cloud/gcp-svc-account-impersonation/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.