How to use the Filestore Auditing agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This one is named google-cloud-filestore-auditing and is built around a main SKILL.md file plus reference notes and a Python script.

Once installed, the agent can review a Google Cloud project's Filestore file shares (managed network file storage). It reports which shares lack recent backups, which NFS export rules are overly open (such as 0.0.0.0/0 access or missing ROOT_SQUASH), and whether zone isolation settings meet reliability guidelines. The output is a scorecard and an inventory table.

• Finds Filestore instances and backups across the project's locations.
• Flags unprotected instances and stale backups against the reference thresholds.
• Flags NFS export risks: 0.0.0.0/0 exposure, missing ROOT_SQUASH and default open VPC exports.
• Checks Physical Zone Isolation (PZI) and Physical Zone Separation (PZS) status.
• Asks for your confirmation before creating any backups.

Install the skill from the ZIP download

Download the ZIP for the skill from this page. Then choose one of the two install locations below, depending on whether you want the skill available everywhere or only in one project.

For a personal install that applies to all your work, unzip the download into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. The skill folder should contain SKILL.md, the references/ folder and the scripts/ folder.

• Personal: ~/.claude/skills/
• Project only: .claude/skills/ inside your project folder
• Claude apps: upload the skill under Settings → Capabilities → Skills

Set up Google Cloud access before the first run

The skill calls gcloud and needs your Google Cloud identity to be authenticated. Install the Google Cloud CLI, then log in. The skill's own setup steps use both a user login and application default credentials, so run both.

Make sure the target project has an active Cloud Billing account attached, and that the Filestore API (file.googleapis.com) is enabled. The skill's quick start includes commands for both checks.

• Read-only audits need the roles/file.viewer IAM role.
• Creating backups needs roles/file.editor or roles/file.admin.
• Optional Filestore MCP server access needs roles/mcp.toolUser.
• Python 3 is needed to run scripts/filestore_audit.py.

Trigger the skill with natural requests

You do not need to type the skill name. Describe the task in plain language that matches the skill's purpose, and include the project ID. The skill asks you for the project ID if you leave it out, so it does not audit the wrong project in a multi-project account.

Ask for a read-only review when you only want findings. Ask for backup creation only when you are ready to confirm specific instances, because the agent will pause for your approval before running any create step.

• "Audit the Filestore instances in project my-project-id for missing backups."
• "Check our Filestore NFS export rules for 0.0.0.0/0 access and missing ROOT_SQUASH in project my-project-id. Do not execute commands."
• "Explain why NO_ROOT_SQUASH is risky for Filestore."
• "Does our Filestore fleet meet PZI requirements for disaster recovery?"

Read the output: scorecard and inventory table

The skill's audit rules define a severity classification, a health grade and a standard inventory table. Start with the executive scorecard for the overall picture, then use the priority findings and the instance inventory to decide what to fix first.

Treat the output as a review aid. The findings depend on what the agent could read: if IAM permissions are missing, the audit fails or returns partial data, and you should check the permissions before trusting a clean result.

Safety notes: scripts, network access and backup creation

This skill runs scripts and uses the network. scripts/filestore_audit.py calls gcloud through subprocess, and the skill calls Google Cloud APIs. Review the script and confirm the account you authenticate with is the one you intend to audit before running it.

The skill can create backups once you confirm. For that reason, avoid using it against production projects unless someone reviews each proposed backup. The skill is not meant for Cloud Storage buckets, Persistent Disk or NetApp Volumes, and using it there would give wrong results.

• Use a read-only role (roles/file.viewer) for routine audits.
• Review every backup list the agent proposes before confirming.
• Do not use the skill for Cloud Storage, Persistent Disk or NetApp Volumes.
• Ask for the project ID explicitly in multi-project environments.

Tips for getting useful results

Give the agent a single project per request and a default region if you have one. The skill's quick start suggests us-central1 as an example default region, but you can use your own. For conceptual questions, you can ask about NFS export risks or zone isolation without running any commands; the skill answers those from its reference notes.

• Name one project per request to keep results clean.
• Ask conceptual questions separately from audit requests.
• Keep the reference files in place; the agent reads them to apply the rules.
• Re-run the audit on a schedule if you need periodic health checks.