# gcs-security-assessment

> Claude/Codex skill by [@googlecloudplatform](https://omgskills.com/library/googlecloudplatform/index.md) · 226 stars · Updated 2026-10-23

Assesses the security posture of Google Cloud Storage (GCS) buckets and projects. Grounds every finding in gathered telemetry, evaluates buckets against Google security best practices (public access, IAM over-granting, CMEK, VPC Service Controls, audit logging), and correlates signals to flag toxic combinations of individually low-risk settings, with actionable remediation. Use whenever a user asks for a security scan, audit, review, vulnerability check, or compliance assessment (including SAIF) — or simply asks whether their buckets, project, or data are secure, exposed, public, or misconfigured, who can access their data, or wants storage hardened or locked down, e.g. before a launch. Don't use for diagnosing a specific access failure or 403, managing or configuring storage, investigating a live outage, or non-GCS resources (Compute Engine, GKE, etc.).

## Install

```sh
git clone https://github.com/GoogleCloudPlatform/data-agent-kit-plugin /tmp/data-agent-kit-plugin && ln -s /tmp/data-agent-kit-plugin/skills/gcs-security-assessment ~/.claude/skills/gcs-security-assessment
```

## From README

Security Posture Assessment Skill You are a Google Cloud Storage security assessment agent trained on Google's Secure AI Framework (SAIF). Your job is to evaluate GCS bucket and project configurations, identify toxic combinations of vulnerabilities, and provide actionable remediation. \[!IMPORTANT\] You are NOT a generic security chatbot. You MUST ground every finding in telemetry signals you have actually gathered. NEVER hallucinate findings or assume configurations you have not verified. If you cannot gather a signal, say so explicitly and skip that check. \[!CAUTION\] CRITICAL: Never execute destructive commands (e.g., rm, rb, IAM policy changes) without first printing the exact command and explicitly asking the user for a Y/N confirmation. Philosophy Traditional security tools generate isolated alerts from static rules (e.g., "bucket is public").

## Links

- HTML page: https://omgskills.com/library/googlecloudplatform/data-agent-kit-plugin/skills/gcs-security-assessment/
- GitHub: https://github.com/GoogleCloudPlatform/data-agent-kit-plugin
- Author: [@googlecloudplatform](https://omgskills.com/library/googlecloudplatform/index.md)

## More from this repo

- [accidental-data-loss-prevention](https://omgskills.com/library/googlecloudplatform/data-agent-kit-plugin/skills/accidental-data-loss-prevention/index.md) — \*\*STOP AND VERIFY\*\*: Before running any command or tool that results in irreversible data loss, you MUST obtain...
   - [@googlecloudplatform](https://omgskills.com/library/googlecloudplatform/index.md) · 226 stars
- [bigquery-ai-ml](https://omgskills.com/library/googlecloudplatform/data-agent-kit-plugin/skills/bigquery-ai-ml/index.md) — Leverages BigQuery's built-in machine learning and GenAI capabilities for advanced data analytics.
   - [@googlecloudplatform](https://omgskills.com/library/googlecloudplatform/index.md) · 226 stars
- [bigquery-bigframes](https://omgskills.com/library/googlecloudplatform/data-agent-kit-plugin/skills/bigquery-bigframes/index.md) — Generates Python code using BigQuery DataFrames (BigFrames).
   - [@googlecloudplatform](https://omgskills.com/library/googlecloudplatform/index.md) · 226 stars