Skills gcp-cloud-run
📦
gcp-cloud-run
Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Build Production-Ready Cloud Run Applications
Cloud Run projects often fail on scaling, startup, networking, and resource constraints. This skill provides deployment patterns and troubleshooting guidance for resilient serverless services.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "gcp-cloud-run" from https://skillstore.io/skills/sickn33-gcp-cloud-run.md and its manifest at https://skillstore.io/api/skills/sickn33-gcp-cloud-run/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "gcp-cloud-run". Plan a Node.js API deployment with low cold-start latency.
Expected outcome:
- Use a small production image and run as a non-root user.
- Enable startup CPU boost and begin with one minimum instance.
- Measure latency before adjusting concurrency, CPU, and memory.
- Add readiness behavior and graceful SIGTERM handling.
Using "gcp-cloud-run". Explain why a service fails after writing a large temporary file.
Expected outcome:
Cloud Run stores temporary files in memory. Stream the object or use Cloud Storage, then size memory for unavoidable temporary data.
Using "gcp-cloud-run". Review a Pub/Sub push integration.
Expected outcome:
- Authenticate push delivery with a dedicated service account.
- Validate the token audience and calling identity.
- Return success only after durable processing.
- Configure retries and a dead-letter topic.
Security Audit
High Riskv5 • 7/23/2026 Open versioned report
All 164 static matches are false positives caused by Markdown fences, illustrative template literals, and benign cloud configuration examples. Three semantic risks remain in the examples: unauthenticated Pub/Sub processing, callback URL SSRF, and reflected HTML injection.
1
Files scanned
1,384
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Unauthenticated Pub/Sub Message Processing
The push handler treats message shape as verification but validates no OIDC token, audience, issuer, or service account. A public endpoint could accept forged events.
The subscription example configures no authenticated push identity, and the handler checks only for a message field before processing.
High
User-Controlled Callback URL Enables SSRF
The endpoint accepts callback_url from request data and posts processing results without validating scheme, host, or resolved IP. Attackers could target internal services.
The caller directly controls the URL passed to httpx, and no allowlist or network-range validation appears before the outbound request.
Medium
Reflected HTML Injection in HTTP Example
The HTTP function inserts a query or body value into res.send without escaping it. Express can treat string responses as HTML and render attacker input.
The source and response sink are adjacent and contain no output encoding or explicit plain-text content type.
Risk Factors
⚙️ External commands (50)
SKILL.md:36-59 SKILL.md:59-61 SKILL.md:61-95 SKILL.md:95-97 SKILL.md:97-99 SKILL.md:99-130 SKILL.md:130-163 SKILL.md:163-170 SKILL.md:170-172 SKILL.md:172-174 SKILL.md:174-190 SKILL.md:190-192 SKILL.md:192-199 SKILL.md:199-200 SKILL.md:200-201 SKILL.md:201-207 SKILL.md:207-209 SKILL.md:209-232 SKILL.md:232-242 SKILL.md:242-246 SKILL.md:246-250 SKILL.md:250-254 SKILL.md:254-258 SKILL.md:258-270 SKILL.md:270-274 SKILL.md:274-292 SKILL.md:292-296 SKILL.md:296-302 SKILL.md:302-319 SKILL.md:319-337 SKILL.md:337-341 SKILL.md:341-359 SKILL.md:359-363 SKILL.md:363-372 SKILL.md:372-374 SKILL.md:374-382 SKILL.md:382-399 SKILL.md:399-408 SKILL.md:408-410 SKILL.md:410-441 SKILL.md:441-445 SKILL.md:445-461 SKILL.md:461-464 SKILL.md:464-468 SKILL.md:468-476 SKILL.md:476-484 SKILL.md:484-491 SKILL.md:491-493 SKILL.md:493-502 SKILL.md:502-517
🌐 Network access (6)
📁 Filesystem access (6)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-gcp-cloud-run/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-gcp-cloud-run?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-gcp-cloud-run?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-gcp-cloud-run/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-gcp-cloud-run.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). gcp-cloud-run security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-gcp-cloud-run/audits/5BibTeX citation
@techreport{sickn33-sickn33-gcp-cloud-run-2026,
author = {sickn33},
title = {gcp-cloud-run security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-gcp-cloud-run/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gcp-cloud-run security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-gcp-cloud-run/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-gcp-cloud-run:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
70
Spec Compliance
What You Can Build
Deploy an Application Service
Create a container, health endpoint, deployment configuration, and scaling plan for an existing web application.
Build a Serverless Platform Pattern
Connect Cloud Run with Pub/Sub, Cloud SQL, Secret Manager, or Cloud Tasks using production-oriented configuration.
Resolve Cloud Run Failures
Investigate cold starts, memory exhaustion, connection resets, startup failures, and timeout mismatches.
Try These Prompts
Prepare a Basic Deployment
Prepare a Cloud Run deployment plan for my [language] service in [region]. Include container requirements, PORT handling, health checks, and a gcloud command.
Create an Event Handler
Design a Cloud Run Function for [event source]. Include deployment settings, payload handling, retries, authentication, and failure behavior.
Tune Performance and Cost
Review this workload profile: [traffic, latency, CPU, memory]. Recommend concurrency, minimum instances, CPU allocation, memory, timeouts, and measurement steps.
Review a Production Architecture
Assess this Cloud Run architecture: [details]. Identify reliability, IAM, secret, network, database, scaling, and observability risks. Prioritize concrete remediations.
Best Practices
- Measure workload behavior before changing concurrency, instance, CPU, or memory settings.
- Use least-privilege service accounts and Secret Manager for sensitive configuration.
- Validate authentication, inputs, retries, timeouts, and shutdown behavior before production deployment.
Avoid
- Do not copy placeholder commands into production without reviewing project, region, identity, and exposure settings.
- Do not store large working files in temporary storage without accounting for memory.
- Do not accept unauthenticated events or caller-controlled callback destinations without strict validation.
Frequently Asked Questions
Does this skill deploy resources automatically?
No. It supplies implementation and command guidance that must be reviewed and run in an authorized GCP environment.
Which runtimes are covered?
The examples focus on Node.js and Python, with container patterns that can support other Cloud Run runtimes.
Does it cover Cloud Run Functions?
Yes. It includes HTTP, Pub/Sub, and Cloud Storage event patterns for second-generation functions.
Can it help reduce cold starts?
Yes. It covers image size, startup CPU boost, minimum instances, lazy initialization, and memory or CPU sizing.
Does it replace a security review?
No. IAM, public access, input validation, secret handling, and outbound network behavior require environment-specific review.
What GCP integrations are included?
It covers Pub/Sub, Cloud Tasks, Cloud SQL, Secret Manager, Cloud Storage, VPC connectors, and Cloud Build.