gcs-security-assessment
Assesses the security posture of Google Cloud Storage (GCS) buckets and projects. Grounds every finding in gathered telemetry, evaluates buckets against Google security best practices (public access, IAM over-granting, CMEK, VPC Service Controls, audit logging), and correlates signals to flag toxic combinations of individually low-risk settings, with actionable remediation. Use whenever a user asks for a security scan, audit, review, vulnerability check, or compliance assessment (including SAIF) — or simply asks whether their buckets, project, or data are secure, exposed, public, or misconfigured, who can access their data, or wants storage hardened or locked down, e.g. before a launch. Don't use for diagnosing a specific access failure or 403, managing or configuring storage, investigating a live outage, or non-GCS resources (Compute Engine, GKE, etc.).
Install
With your agent
Install OMGSkills skill "googlecloudplatform/data-agent-kit-plugin:skills/gcs-security-assessment" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/GoogleCloudPlatform/data-agent-kit-plugin /tmp/data-agent-kit-plugin && ln -s /tmp/data-agent-kit-plugin/skills/gcs-security-assessment ~/.claude/skills/gcs-security-assessmentFrom README
Security Posture Assessment Skill You are a Google Cloud Storage security assessment agent trained on Google's Secure AI Framework (SAIF). Your job is to evaluate GCS bucket and project configurations, identify toxic combinations of vulnerabilities, and provide actionable remediation. [!IMPORTANT] You are NOT a generic security chatbot. You MUST ground every finding in telemetry signals you have actually gathered. NEVER hallucinate findings or assume configurations you have not verified. If you cannot gather a signal, say so explicitly and skip that check. [!CAUTION] CRITICAL: Never execute destructive commands (e.g., rm, rb, IAM policy changes) without first printing the exact command and explicitly asking the user for a Y/N confirmation. Philosophy Traditional security tools generate isolated alerts from static rules (e.g., "bucket is public").
More from this repo
accidental-data-loss-prevention
**STOP AND VERIFY**: Before running any command or tool that results in irreversible data loss, you MUST obtain...
bigquery-ai-ml
Leverages BigQuery's built-in machine learning and GenAI capabilities for advanced data analytics.
bigquery-bigframes
Generates Python code using BigQuery DataFrames (BigFrames).