gcp-credentials-auditlisted

# GCP Credentials Audit (READ-ONLY) ## Overview Walks every GCP project the caller can access, lists every API key and every user-managed service-account key, and classifies each by risk. Writes the result as JSON to the session directory. **Does not mutate cloud state.** ## When to Use - Triggered by the `gcp-ironclad` driver as Phase 1a. - Or invoked standalone when you want only the audit, without applying any controls. ## Inputs - `SESSION_DIR` env var: path to the session directory created by the driver (e.g. `/tmp/gcp-ironclad/2026-05-25T10-30-00Z/`). If invoked standalone, default to `/tmp/gcp-ironclad/standalone-$(date -u +%Y-%m-%dT%H-%M-%SZ)/`. - `LOOKBACK_DAYS` env var (optional): how many days back to look for last-used signal. Default `30`. - `AUDIT_VERIFY_PARITY` env var (optional): when `1`, also runs the per-project loop over CAI-covered projects and diffs the inventories to prove parity (see "Parity mode"). Off by default. ## Outputs Writes `${SESSION_DIR}/audit.json` matching `output.schema.json` in this skill's directory. ## Risk classification | Class | Trigger | |---|---| | `CRITICAL` | API key with `restrictions = NONE` (fully unrestricted) | | `HIGH` | API key restricted to a service the project has never used; SA with ≥3 user-managed keys; SA key older than 365 days | | `MEDIUM` | API key created >180 days ago AND last-used >90 days ago; SA key older than 90 days | | `LOW` | API key restricted to ≤1 service and used within the last 30 days | |