Google Cloud gcloud CLI Safety Skill
Helps agents manage and troubleshoot Google Cloud resources through validated, scoped gcloud commands.
The skill requires leaf-level command validation, explicit project and location scoping, non-interactive execution, and authorization before destructive or high-risk operations. These are meaningful safeguards, warranting a moderately strong score. Points are deducted because it still recommends service-account JSON keys, gives no concrete credential or sensitive-output handling or revocation/rollback procedure, and the dry-run rule does not cover every command; data-flow disclosure is limited.
Command validation, single-command execution, bounded queries, and schema discovery provide a reasonably coherent operational path, and the document is mostly internally consistent. Points are deducted because there are no scripts, tests, compatibility matrix, or concrete failure messages; several rules depend on whether an individual command supports a flag, while abnormal-input handling and recovery guidance are thin. Static calibration caps this below 10.
The intended audience and use cases are clear: managing resources, querying configuration, and troubleshooting through gcloud, while excluding client-library and raw REST/gRPC development. Discovery, location selection, and data reduction are also addressed. Points are deducted because input/output contracts, trigger boundaries, and service-specific differences remain underspecified, with no Chinese-language or mainland-China reachability guidance; use may be constrained by access to Google Cloud services and credentials.
The document is organized into installation, authorization, principles, guardrails, workflows, and a quick reference, and the supplied repository context provides installation, Apache-2.0 licensing, contribution channels, and official provenance. Points are deducted because the skill itself lacks a version, changelog, named maintenance owner, dependency versions, FAQ, and systematic troubleshooting; a statement that the repository is under active development is not a defined update commitment.
For users with gcloud installed, valid permissions, and a known project context, the validation, scoping, limiting, and formatting rules can directly reduce mistakes and context cost, so the core task is plausibly supported. Points are deducted because no representative outputs, test results, or comparative evidence are supplied; users must still determine service-specific commands, parameters, and permissions, and output completeness depends on follow-up judgment. Static calibration caps this below 7.
The source provides auditable command rules, templates, denylist entries, and references to official documentation, while the repository context supplies license and index traceability. Points are deducted because there is no committed test suite, CI coverage, execution record, or third-party reproduction evidence; key safety assertions are not independently verified within the supplied files. Static calibration caps this below 5.
- Do not treat service-account JSON keys as the default or best option; prefer short-lived credentials, workload identity, or controlled impersonation, with explicit key storage, incident response, and revocation procedures.
- The mandatory dry-run rule cannot apply universally to gcloud commands; verify support per command and use human confirmation or another reversible preview when dry-run is unavailable.
- The files do not establish reliable mainland-China access to the Google Cloud control plane or referenced documentation; validate network, proxy, authentication, and organizational-policy conditions before deployment.
- No test or execution evidence is supplied, so command templates should not be assumed to work across all gcloud versions, services, and permission configurations.
What does this skill do, and when should you use it?
This skill is for agents that manage Google Cloud resources, query configurations, or investigate issues through the gcloud CLI. It requires leaf-level command validation before execution and promotes explicit project and location scoping, output reduction, and non-interactive commands. It also defines least-privilege authentication guidance, dry-run expectations, and a denylist for high-risk operations. It is not intended for Google Cloud client-library code or raw REST/gRPC API interactions.
Guides agents through Google Cloud SDK setup and authentication using user accounts, headless login, application default credentials, service accounts, or service-account impersonation. Before running a target command, it requires gcloud help <command> to validate the exact command, flags, values, and positional syntax. It scopes operations with project and location flags, reduces results with --limit, --filter, and --format, and uses limited list commands for schema discovery. It requires single, non-interactive commands and a preceding --dry-run when supported, while restricting deletion, IAM changes, billing, organization, KMS, and certain infrastructure-manager operations.
- A cloud platform engineer needs a concise, filtered view of resources in a specific Google Cloud project and wants the resource schema discovered first.
- A local pair-programming agent needs audited service-account impersonation instead of storing a private key on a developer workstation.
- An operations engineer is investigating a regional or zonal resource issue and needs explicit location discovery before querying resources.
- An automation agent is preparing an infrastructure-changing gcloud command and must validate syntax, inspect a dry run when available, and avoid unauthorized destructive actions.
What are this skill's strengths and limitations?
- Provides concrete safeguards for syntax validation, project and location scoping, data reduction, and non-interactive execution.
- Sets explicit restrictions for IAM, deletion, billing, organization, and KMS operations.
- Documents several authentication paths, including headless login and service-account impersonation.
- Its scope is limited to gcloud CLI workflows, not Google Cloud client libraries or raw REST/gRPC APIs.
- The source provides no test suite, platform-validation matrix, or detailed client compatibility evidence.
- Successful operation depends on correct project, location, and permission choices supplied by the user or environment.
How do you install this skill?
The README documents collection-level installation only: run npx skills add google/skills, then select the desired skills during installation. The source does not document a separate command for installing only skills/cloud/gcloud, nor any additional setup steps. Using this skill also requires the gcloud executable from the Google Cloud SDK.
How do you use this skill?
After installing it in an Agent Skills-compatible client, use a request such as “Use gcloud to list running Compute Engine instances in PROJECT_ID, returning only name and ID, and validate the command first.” The skill must be read before invoking gcloud. Validate the exact leaf command with gcloud help <command>; resource queries and changes should specify --project=<PROJECT_ID>, add required --region, --zone, or --location flags, and use --quiet, --limit, --filter, or --format as appropriate.
How does this skill compare with similar options?
Compared with Google Cloud client-library code or direct REST/gRPC API calls, this skill is specifically scoped to resource management, querying, and investigation through the gcloud CLI. The source provides no broader feature or performance comparison.