[REVIEW] gcp-review: add BigQuery authorized view policy drift gates

[stmr]

Skill Being Reviewed

Skill name: gcp-review
Skill path: skills/cloud/gcp-review/

False Positive Analysis

Benign code that triggers a false positive:

Authorized views, row access policies, and dataset IAM are checked as one boundary.

Why this is a false positive:
The current review guidance can push an agent to flag this pattern without first proving the attacker-controlled path, tenant boundary, or effective runtime behavior. The review should require evidence before classification.

Coverage Gaps

Missed variant 1:

View filters rows but direct dataset/table IAM grants bypass it.

Why it should be caught:
This is a realistic failure mode for gcp-review. It changes the effective security boundary without matching the simpler examples currently emphasized by the skill.

Missed variant 2:

Policy tag masking differs between query path and export path.

Why it should be caught:
This variant commonly appears in production systems and needs explicit reviewer prompts so agents do not stop at static configuration review.

Edge Cases

BigQuery access paths multiply through views, routines, and exports.

Remediation Quality

• Fix resolves the vulnerability
• Fix doesn't introduce new security issues
• Fix doesn't break functionality
• Issues found: Remediation guidance should add an evidence gate for the specific boundary, a benign exception pattern, and a regression check. Without those, fixes may be either cosmetic or over-broad.

Comparison to Other Tools

Tool	Catches this?	Notes
Semgrep	Partial	Can catch static patterns, but not effective policy, ownership, or runtime propagation without custom rules.
CodeQL	Partial	Strong for code/data-flow cases, weaker for cloud/control-plane and process evidence unless modeled.
Other: manual review	Yes	Human review can verify effective behavior, exception ownership, and operational evidence.

Overall Assessment

Strengths:
The skill gives useful practitioner framing and asks for concrete evidence instead of generic advice.

Needs improvement:
Need BigQuery effective data access checks.

Priority recommendations:

1. Add a checklist item for BigQuery authorized view policy drift evidence.
2. Add one benign exception example so reviewers avoid noisy findings.
3. Add one regression or verification step that proves the effective boundary after remediation.

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms
• Preferred payment method: PayPal samik4184@gmail.com

[JamesJi79]

/attempt

[JamesJi79]

Implemented in PR #2698.

Gate file: skills/cloud/gcp-review/gates/bigquery-authorized-view-drift-gate.md

This gate adds bigquery authorized view policy drift gate.