gcloud

Name: gcloud
Author: google

15kstars1.1kforks

How to install gcloud?

google/skills/gcloud

$npx -y skills add google/skills --skill gcloud

Installs into the current project.

Summary

Interacts with Google Cloud services using the gcloud CLI safely and efficiently. Covers command validation, data reduction, safety guardrails with a denylist, and workflows for discovery and investigation. You MUST read this skill before invoking any gcloud command. Use when man

Files · 1

View on GitHub

SKILL.md

1	# gcloud CLI Skill for AI Agents
2
3	This document provides essential guidelines and best practices for AI agents
4	interacting with the Google Cloud SDK (`gcloud` CLI). Following these rules is
5	critical to avoid hallucinated commands, flags, flag values, and positional
6	argument syntax, prevent destructive actions, and minimize context window usage.
7
8	## Getting Started
9
10	### 1. Installation
11
12	If the `gcloud` executable is missing, refer to the official
13	[Google Cloud CLI Installation Guide](https://docs.cloud.google.com/sdk/docs/install-sdk.md.txt)
14	to install it on your platform (Linux, macOS, Windows, etc.).
15
16	### 2. Authorization
17
18	Authenticate the CLI with Google Cloud. Choose the flow that matches your
19	running environment:
20
21	* User Account (Interactive): Run `gcloud auth login`. Follow the browser
22	prompts to sign in.
23	* User Account (Headless Flow): If operating on a terminal without a web
24	browser (e.g. containers, remote SSH), append the `--no-browser` flag:
25	`gcloud auth login --no-browser`. Copy the URL, sign in on another machine,
26	and return the authentication code.
27	* Application Default Credentials (ADC): To authenticate code calls from
28	local applications or SDK libraries, set up ADC via `gcloud auth
29	application-default login` (append `--no-browser` for headless
30	environments).
31	* Service Account (Best for Detached/Headless Automation): Authenticate
32	directly using a JSON key file. Ideal for fully automated, background tasks
33	and pipelines: `gcloud auth activate-service-account
34	--key-file=path/to/key.json`. Note that some organizations may restrict
35	access to JSON key files for security reasons.
36	* **Service Account Impersonation (Preferred for Local Pair-Programming
37	Agents)**: Leverage the human developer's existing user credentials to
38	assume a service account identity. Best for local development assistants to
39	avoid insecure private keys on human workstations: `gcloud config set
40	auth/impersonate_service_account SERVICE_ACCT_EMAIL`
41
42	Separation of Privilege (Critical): Both service account approaches ensure the
43	agent's permissions remain strictly distinct from the human user's wide access
44	limits (enforcing least privilege), and ensure actions are properly audited
45	under the agent's focused identity. *(Impersonation requires
46	`roles/iam.serviceAccountTokenCreator`)*.
47
48	For more detailed strategies and authentication types (such as Workload Identity
49	Federation), see
50	[Authorizing the gcloud CLI](https://docs.cloud.google.com/sdk/docs/authorizing.md.txt).
51
52	## Core Principles
53
54	### 1. Explicit Command Validation (Mandatory)
55
56	Your internal knowledge of `gcloud` may be stale or prone to hallucination
57	(e.g., hallucinating commands, flags, flag values, or positional argument
58	syntax). You are FORBIDDEN from executing commands until you have validated
59	the exact syntax at the leaf level.
60
61	* Action: Always call `gcloud help <command>` for the exact command you
62	intend to run (e.g., `gcloud help compute instances create`).
63	* Verify: Ensure the command, flags, flag values, and positional argument
64	syntax are valid for that specific leaf command before attempting execution.
65	Validation is not transitive from parent groups.
66
67	### 2. Data Reduction Strategies
68
69	To save context window space and reduce latency, always minimize the volume of
70	data returned by `gcloud`.
71
72	* Projection: Use `--format=json(key1, key2, ...)` to select only the
73	specific fields needed for your task. To understand the advanced projection
74	and formatting syntax, refer to `gcloud topic projections` and `gcloud topic
75	formats`.
76
77	* Limiting: Use `--limit=N` to cap the number of resources returned.
78
79	* Filtering: Use `--filter` to narrow down results server-side. Prioritize
80	`:` for pattern matching and never quote the right side of the colon. Treat
81	the entire filter flag as a singular string without quoting or escaping
82	characters. To study the filter expression syntax, refer to `gcloud topic
83	filters`.
84
85	* Schema Discovery: Unconstrained resource lists can quickly exhaust your
86	context window with redundant data. To prevent this, discover a resource's
87	schema before executing queries. If you are unsure of the JSON key path for
88	projecting fields (`--format`) or filtering (`--filter`), run the targeted
89	resource's list command (if supported) with a single-item limi

People who liked this also viewed

6 picks

Type

gcloud

15kstars1.1kforks

View on GitHub

How to install gcloud?

google/skills/gcloud

$npx -y skills add google/skills --skill gcloud

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# gcloud CLI Skill for AI Agents
2
3	This document provides essential guidelines and best practices for AI agents
4	interacting with the Google Cloud SDK (`gcloud` CLI). Following these rules is
5	critical to avoid hallucinated commands, flags, flag values, and positional
6	argument syntax, prevent destructive actions, and minimize context window usage.
7
8	## Getting Started
9
10	### 1. Installation
11
12	If the `gcloud` executable is missing, refer to the official
13	[Google Cloud CLI Installation Guide](https://docs.cloud.google.com/sdk/docs/install-sdk.md.txt)
14	to install it on your platform (Linux, macOS, Windows, etc.).
15
16	### 2. Authorization
17
18	Authenticate the CLI with Google Cloud. Choose the flow that matches your
19	running environment:
20
21	* User Account (Interactive): Run `gcloud auth login`. Follow the browser
22	prompts to sign in.
23	* User Account (Headless Flow): If operating on a terminal without a web
24	browser (e.g. containers, remote SSH), append the `--no-browser` flag:
25	`gcloud auth login --no-browser`. Copy the URL, sign in on another machine,
26	and return the authentication code.
27	* Application Default Credentials (ADC): To authenticate code calls from
28	local applications or SDK libraries, set up ADC via `gcloud auth
29	application-default login` (append `--no-browser` for headless
30	environments).
31	* Service Account (Best for Detached/Headless Automation): Authenticate
32	directly using a JSON key file. Ideal for fully automated, background tasks
33	and pipelines: `gcloud auth activate-service-account
34	--key-file=path/to/key.json`. Note that some organizations may restrict
35	access to JSON key files for security reasons.
36	* **Service Account Impersonation (Preferred for Local Pair-Programming
37	Agents)**: Leverage the human developer's existing user credentials to
38	assume a service account identity. Best for local development assistants to
39	avoid insecure private keys on human workstations: `gcloud config set
40	auth/impersonate_service_account SERVICE_ACCT_EMAIL`
41
42	Separation of Privilege (Critical): Both service account approaches ensure the
43	agent's permissions remain strictly distinct from the human user's wide access
44	limits (enforcing least privilege), and ensure actions are properly audited
45	under the agent's focused identity. *(Impersonation requires
46	`roles/iam.serviceAccountTokenCreator`)*.
47
48	For more detailed strategies and authentication types (such as Workload Identity
49	Federation), see
50	[Authorizing the gcloud CLI](https://docs.cloud.google.com/sdk/docs/authorizing.md.txt).
51
52	## Core Principles
53
54	### 1. Explicit Command Validation (Mandatory)
55
56	Your internal knowledge of `gcloud` may be stale or prone to hallucination
57	(e.g., hallucinating commands, flags, flag values, or positional argument
58	syntax). You are FORBIDDEN from executing commands until you have validated
59	the exact syntax at the leaf level.
60
61	* Action: Always call `gcloud help <command>` for the exact command you
62	intend to run (e.g., `gcloud help compute instances create`).
63	* Verify: Ensure the command, flags, flag values, and positional argument
64	syntax are valid for that specific leaf command before attempting execution.
65	Validation is not transitive from parent groups.
66
67	### 2. Data Reduction Strategies
68
69	To save context window space and reduce latency, always minimize the volume of
70	data returned by `gcloud`.
71
72	* Projection: Use `--format=json(key1, key2, ...)` to select only the
73	specific fields needed for your task. To understand the advanced projection
74	and formatting syntax, refer to `gcloud topic projections` and `gcloud topic
75	formats`.
76
77	* Limiting: Use `--limit=N` to cap the number of resources returned.
78
79	* Filtering: Use `--filter` to narrow down results server-side. Prioritize
80	`:` for pattern matching and never quote the right side of the colon. Treat
81	the entire filter flag as a singular string without quoting or escaping
82	characters. To study the filter expression syntax, refer to `gcloud topic
83	filters`.
84
85	* Schema Discovery: Unconstrained resource lists can quickly exhaust your
86	context window with redundant data. To prevent this, discover a resource's
87	schema before executing queries. If you are unsure of the JSON key path for
88	projecting fields (`--format`) or filtering (`--filter`), run the targeted
89	resource's list command (if supported) with a single-item limi

People who liked this also viewed

6 picks

Type