Skip to content
Get packs

Guide · Agent skill

How to use the Compliance Environment Assessor agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The Compliance Environment Assessor is an agent skill that lets an AI agent inspect an existing Google Cloud folder or project, list its resources and effective Organization Policies, and compare them with sovereign data and compliance frameworks such as EU Data Boundary, FedRAMP, DoD IL4/IL5, ITAR and CJIS. This guide explains what the skill does, how to install it, how to ask for it in plain language, and what it needs and does not do. By the end you will be able to install the skill and run a read-only pre-flight check on an environment you already have.

Compliance Environment Assessorgoogle/skills · Apache-2.0

Quick start

  1. 1Install the Google Cloud CLI. Install and initialize gcloud, then set your project with gcloud config set project PROJECT_ID.
  2. 2Enable the required APIs. Enable cloudasset, orgpolicy, assuredworkloads and cloudsecuritycompliance on your administrative project.
  3. 3Authenticate. Run gcloud auth login and gcloud auth application-default login with an identity that can read assets, Org Policies and frameworks.
  4. 4Install the skill. Unzip the downloaded ZIP into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  5. 5Export frameworks.json. Create the frameworks.json file from the Assured Workloads Frameworks Library using gcloud compliance-manager frameworks list.
  6. 6Ask for an assessment. Ask the agent to assess a named folder or project in plain language, for example to check EU sovereignty readiness.

What does the skill make the agent do?

The skill turns a general-purpose agent into a read-only assessor for Google Cloud environments. It discovers resource telemetry and effective Org Policies for a folder (folders/{folder_id}) or project (projects/{project_id}), then evaluates that environment against sovereign data boundary and compliance standards. It can also recommend which Assured Workloads framework fits the environment.

The skill is designed to report readiness notes, not to change anything. The source describes its output as pre-flight readiness recommendations and potential drift indicators, not as certified compliance results or deployment blockers.

  • Lists resources in a folder or project using gcloud asset search-all-resources
  • Reads effective Organization Policies
  • Checks three Org Policy parameter sets: resource locations, service usage restrictions and CMEK encryption requirements
  • Suggests which Assured Workloads framework fits the folder
  • Hands rule checks to two bundled Python scripts rather than guessing

How do you install the skill?

You can install the skill in one of three ways. Download the ZIP file from this page and unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill only for that project. Alternatively, upload the skill in the Claude apps under Settings → Capabilities → Skills.

After installing, the skill folder should contain SKILL.md, two files in scripts/ (evaluate_control_rules.py and validate_workload_payload.py) and two files in references/ (attribution.md and gcloud-commands.md).

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into .claude/skills/ inside your project
  • App install: Settings → Capabilities → Skills in the Claude apps

What do you need before you start?

The skill needs the Google Cloud CLI, a working authenticated session, Python 3 and access to a Google Cloud organization. Your identity must be allowed to read assets, Org Policies and Assured Workloads frameworks. You also need a frameworks.json file exported from the Assured Workloads Frameworks Library, which the agent creates with the list command below.

The source lists these administrative setup steps: set your project, enable the required APIs, and log in. Replace PROJECT_ID with your own project ID.

  • Google Cloud CLI (gcloud), installed and authenticated
  • Python 3 to run the bundled scripts
  • Access to a Google Cloud organization with permission to read assets, Org Policies and Assured Workloads frameworks
  • A frameworks.json export from the Assured Workloads Frameworks Library
gcloud config set project PROJECT_ID && gcloud services enable cloudasset.googleapis.com orgpolicy.googleapis.com assuredworkloads.googleapis.com cloudsecuritycompliance.googleapis.com && gcloud auth login && gcloud auth application-default login

How do you trigger the skill with a natural request?

You do not need to type a command name. Ask the agent in plain language and name the folder or project you care about. The skill's description lists the kinds of requests it is built for, and these match its use cases closely.

If you ask for something outside its scope, such as deploying a framework or writing remediation scripts, the skill is designed not to handle it. Use separate tooling and review for those tasks.

  • assess my environment for compliance
  • which Assured Workloads framework should I use?
  • check if my folder is ready for EU sovereignty
  • evaluate compliance posture for folders/123 or projects/xyz
  • discover compliance gaps before deployment

What does the agent check and report?

The client-side check covers only three Org Policy parameter sets: Resource Locations, Service Usage Restrictions and CMEK Encryption Requirements. Complex Continuous Evaluation Service rules and REST API rules are evaluated server-side by CES after a framework is deployed, so this skill does not assess them.

The skill uses the frameworks.json file as its catalog and fetches it once per session. Frameworks that include the technical support restriction need a paid sovereign or regulated support subscription; frameworks such as US and EU Data Boundary use standard commercial support. Key Access Justifications variants are recommended only when you explicitly ask for KAJ or EKM, or when you need to choose between matching regional variants.

  • Resource Locations (constraints/gcp.resourceLocations)
  • Service Usage Restrictions (constraints/gcp.restrictServiceUsage)
  • CMEK Encryption Requirements (constraints/gcp.restrictNonCmekServices)
  • Support model for each framework, including whether a paid support subscription applies

What are the safety limits and what does the skill run?

The skill runs in a strictly read-only tier. It uses read queries such as gcloud asset search-all-resources, gcloud compliance-manager frameworks list, gcloud compliance-manager cloud-controls describe and gcloud org-policies describe --effective. The skill's instructions forbid mutating commands, including framework-deployments create, org-policies set-policy and gcloud resource-manager operations.

The skill runs scripts and uses the network. It executes the two bundled Python scripts with --frameworks-file=frameworks.json, and it calls Google Cloud through gcloud to read metadata. Because it reads resource telemetry and Org Policy data, do not use it in an environment where you cannot share that metadata with an AI agent.

Every gcloud command the agent runs is tagged with a usage attribution variable set inline on that command. The tag identifies only the skill and its version and carries no user data. The skill's references say not to use gcloud config set for this tag.

  • Read-only: no deployments, policy changes or resource-manager edits
  • Runs two bundled Python scripts
  • Uses the network through gcloud and Google Cloud APIs
  • Not a formal audit report and not a certified assessment
CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:assuredworkloads-environment-assessor)" gcloud <command> [flags]

What tips help you get useful results?

Name a specific folder or project in your request, such as folders/123 or projects/xyz, so the agent knows exactly which scope to read. Keep your frameworks.json file from the Frameworks Library so the agent does not need to rebuild it, and ask the agent to reuse it within the same session.

Read the output as a list of things to look at before deployment. Treat every finding as a readiness note to verify, not as a verdict, and review anything about support or KAJ choices with the people who own those decisions.

  • Give the agent a folder or project ID up front
  • Generate frameworks.json once and reuse it in the session
  • Ask about one framework at a time when comparing EU and US options
  • Verify findings in the console or with your own review before acting

What people use it for

  • Checking whether a folder that already holds workloads is ready for EU sovereignty requirements before a framework is applied
  • Comparing EU and US data boundary frameworks for a folder to see which one fits
  • Getting a read-only first look at compliance gaps in a project before planning a deployment
  • Reviewing effective Org Policies on a folder against the three high-confidence parameter sets

Frequently asked questions

How do I install the compliance environment assessor skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.

Is the Compliance Environment Assessor skill free?

The skill's documentation states that the discovery queries it runs are free read-only metadata queries and incur $0 in Google Cloud charges. Check the licence in the source repository, which is Apache-2.0, and your own billing setup for anything else.

What do I need to run the assuredworkloads-environment-assessor skill?

You need the Google Cloud CLI installed and authenticated, Python 3 to run the bundled scripts, access to a Google Cloud organization with read permissions, and a frameworks.json export from the Assured Workloads Frameworks Library.

Does the skill change my Google Cloud settings?

No. The skill is designed to be read-only. Its instructions forbid mutating commands such as org-policies set-policy and framework-deployments create.

Can I use this skill for a formal audit report?

No. The skill excludes formal audit reports and remediation scripts, so its output should not be treated as a certified assessment. Use separate tooling and review for audits.

Why does the agent say findings are readiness notes and not violations?

Client-side checks cover only three Org Policy parameter sets. Other rules are evaluated server-side by the Continuous Evaluation Service after deployment, so the skill labels its client-side results as pre-flight readiness recommendations or drift indicators.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits cloud and compliance engineers who want a read-only first look at an existing Google Cloud folder or project and help choosing an Assured Workloads framework. It is a poor fit if you need live policy changes, framework deployment, a formal audit report or remediation scripts, or if you cannot share resource metadata with an AI agent. Pick separate deployment and audit tooling for those jobs.

Download the skill