What does this skill do, and when should you use it?
This skill focuses on the Security pillar of the Google Cloud Well-Architected Framework. It evaluates IAM, network security, data protection, supply-chain security, security operations, AI security, compliance, and privacy considerations. It asks workload-specific questions and applies stated security principles, Google Cloud product examples, and a validation checklist. It is intended for teams performing structured security reviews of Google Cloud architectures.
Analyzes a workload using Security-pillar design principles and recommendations; asks assessment questions covering security by design, zero trust, shift-left security, preemptive defense, AI security, AI for security, and regulatory compliance; checks controls such as IAM, network perimeters, encryption, logging, vulnerability scanning, and Binary Authorization; and produces actionable recommendations plus an architecture validation checklist.
- A cloud architect uses it to define security requirements and review threat-modeling considerations for a new Google Cloud application.
- A security team uses it to assess identity, network, data-protection, and security-operations controls in an existing Google Cloud environment.
- A platform engineering team uses it to review security scanning, dependency management, and trusted-image deployment in a CI/CD pipeline.
- An AI workload team uses it to examine model security, training-data privacy, tamper resistance, and governance requirements.
- A compliance team uses it to structure questions about regulatory obligations, audit evidence, and privacy management in Google Cloud.
How do you install this skill?
- This is a static source review; the skill was not executed, its links were not verified, and outputs were not tested.
- Treat generated guidance as preliminary architecture-review material and have qualified Google Cloud and compliance practitioners validate it against organizational constraints.
- Mainland-China reachability is not documented; some grounding documents depend on Google Cloud documentation sites that may be difficult to access from some networks.
- The skill does not define a standard output format, non-fit boundaries, data-handling rules, or a skill-specific maintenance and change process.
The repository collection can be installed with:
npx skills add google/skills
The installer allows selection of specific skills. The source does not document a separate command for installing or targeting only google-cloud-waf-security.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/google/skills.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/cloud/google-cloud-waf-security" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
After installation, submit a workload-specific security review request, for example: "Assess this workload against the Security pillar of the Google Cloud Well-Architected Framework. Ask for missing security, compliance, and privacy constraints first, then review IAM, network security, data protection, CI/CD, and security operations and provide remediation guidance." The source documents no additional commands, scripts, or tool calls.
What are this skill's strengths and limitations?
- Covers security by design, zero trust, shift-left security, preemptive defense, AI security, and compliance and privacy.
- Names concrete Google Cloud products including IAM, Cloud Armor, VPC Service Controls, KMS, Security Command Center, and Binary Authorization.
- Provides workload-assessment questions and a validation checklist for structured reviews.
- Directly targets security assessment of Google Cloud workloads.
- Its scope is the Security pillar of the Google Cloud Well-Architected Framework, not a general cloud-security or full penetration-testing tool.
- The source provides no evidence of automated scanning, executable scripts, a test suite, or concrete integrations.
- The usefulness of its recommendations depends on the workload details and organizational constraints supplied by the user.
- The source does not specify operating cost, permission requirements, or detailed failure-handling procedures.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| Google Cloud WAF Security Advisor this page ✓ Google · Official | 54 · Use with care | ★ 21k | 12d ago | Apache-2.0 |
| Google Cloud Reliability Architect ✓ Google · Official | 57 · Use with care | ★ 21k | 12d ago | Apache-2.0 |
| Google Cloud Operational Excellence Advisor ✓ Google · Official | 53 · Use with care | ★ 21k | 12d ago | Apache-2.0 |
| Google Cloud Performance Advisor ✓ Google · Official | 50 · Use with care | ★ 21k | 12d ago | Apache-2.0 |
| Google Cloud Sustainability Advisor ✓ Google · Official | 48 · Use with care | ★ 21k | 12d ago | Apache-2.0 |
How did FollowSkills review this skill?
The skill only produces security guidance and assessment questions; it performs no cloud actions, requests no credentials, and discloses no collection or exfiltration flow, so external-effect and permission risk is low. It lacks explicit user confirmation, sensitive-data handling, data-flow disclosure, rollback guidance, and clear applicability boundaries, so 7 points are deducted.
The material is internally coherent and organized into principles, products, assessment questions, and a validation checklist, making the intended path understandable from static review. However, there are no scripts, tests, input validation, abnormal-input handling, or failure messages, and key paths cannot be reproduced statically, so the score is limited.
The metadata clearly targets security assessment of Google Cloud workloads and covers IAM, networking, data, operations, AI, and compliance. Non-fit ranges, invocation conditions, input/output contracts, and Chinese-language support are not specified; environment-fit and semantic-trigger evidence are therefore incomplete.
The document uses a readable progression from overview to principles, products, questions, and checklist. The repository README provides installation, Apache-2.0 licensing, contribution, and issue-reporting paths. Skill-specific versioning, changelog, maintenance ownership, examples, FAQ, dependency notes, and known limitations are missing, warranting the deduction.
The question bank and checklist can structure a security review across several relevant domains. However, there is no standardized deliverable template, example output, or verified representative result; the user must still perform substantial interpretation and validation, so static evidence supports only limited effectiveness.
The skill cites multiple Google Cloud documentation paths, while the supplied README, license, and pinned revision provide some traceability. There are no committed tests, CI coverage, independent reproduction, or cross-source corroboration, and recommendations are not individually tied to evidence, so the score remains below the static maximum.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →