Guide · Agent skill
How to use the Google Cloud Security Review agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide shows you how to install and use the google-cloud-waf-security agent skill, which lets an AI agent review a Google Cloud workload against the security pillar of Google's Well-Architected Framework. It is written for readers who have never used an agent skill before. By the end you will know what the skill does, how to add it to your agent, how to ask for a review, and where its limits are.
Google Cloud Security Reviewgoogle/skills · Apache-2.0 Download the skill Quick start
- 1Download the skill. Get the google-cloud-waf-security ZIP from the page where you found this guide.
- 2Unzip it into a skills folder. Place the skill folder in ~/.claude/skills/ for personal use or in your project's .claude/skills/ folder for one project.
- 3Or upload it in the Claude apps. Go to Settings → Capabilities → Skills and upload the skill there.
- 4Describe your workload. Tell the agent what the Google Cloud workload does, which services it uses and what you want reviewed.
- 5Answer the agent's questions. The agent asks targeted questions about architecture, security requirements and constraints. Answer them as fully as you can.
- 6Review the prioritized recommendations. Read the fixes, which are linked to named framework principles and Google Cloud products.
- 7Verify before changing anything. Check each recommendation against your own environment and your organisation's policies before applying it.
What is the Google Cloud security review skill?
An agent skill is a folder of instructions that an AI agent loads when a task matches the skill's description. This skill is built around the security pillar of Google Cloud's Well-Architected Framework, a set of published best-practice guidance. Once it is active, the agent asks you about your workload, checks it against the framework's core security principles and a validation checklist, and suggests prioritized fixes.
- Covers identity and access, network security, data protection and security operations.
- Names relevant Google Cloud products such as IAM, Identity-Aware Proxy and Security Command Center.
- Ties each recommendation back to a named framework principle and states the benefit it provides.
- Helps you adapt the recommendations to your own requirements and constraints.
Install the skill from the ZIP download
Download the skill as a ZIP file from the page where you found it. The skill package contains a SKILL.md file and a references/attribution.md file. Unzip it so the skill folder sits in one of the locations below.
For a personal skill that works across your projects, place it in your user skills folder. For a skill that only applies to one project, place it in that project's skills folder. You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: upload the skill under Settings → Capabilities → Skills
Trigger the skill with a natural request
You do not need a special command. The skill is meant to activate when your request matches its description, which covers evaluating workloads, identifying security requirements and giving recommendations for IAM, network security, data protection and operational security. Describe your workload in plain language and say what you want reviewed.
Expect the agent to ask targeted questions before it gives recommendations. Answer what you can. The review is more useful when the agent knows your architecture, security requirements and constraints.
- Review the security posture of my Google Cloud project before we launch.
- Check my workload's IAM setup against Google Cloud security best practices.
- What network security gaps does this Cloud Run service have, based on the Well-Architected Framework?
- Give me a prioritized list of data protection fixes for my Cloud Storage buckets and KMS keys.
Understand what the agent will check
The skill evaluates your workload against a set of core principles. These include security by design, zero trust, shift-left security, preemptive cyber defense, using AI securely and responsibly, using AI for security, meeting regulatory, compliance and privacy needs, and shared responsibility. Each principle links to a grounding document in the Google Cloud architecture framework.
When you ask for a review, the agent should name the principle behind each finding. For example, zero trust is linked to Identity-Aware Proxy and IAM Recommender, while shift-left security is linked to Cloud Build, Binary Authorization and Artifact Registry.
Use the attribution rule when commands run
The skill includes a usage attribution file. It requires the agent to tag any gcloud, REST API or MCP command it runs during the skill's work so that usage can be attributed to the skill and its version. The tag carries no user data. The file says not to use gcloud config set for this tag, because the setting would persist beyond the task. If you see a gcloud command prefixed with the metrics environment variable, this is the reason.
CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:google-cloud-waf-security)" \
gcloud <command> [flags]Know the safety notes before you rely on it
The skill's listing states that it requires nothing beyond the skill itself, does not run scripts and does not use the network. The guidance comes from the skill's written instructions, so the agent reasons about your workload using what you tell it and the framework content it has. It does not scan your environment or read your logs.
Because the agent works from your description, its findings are only as accurate as the information you give it. Verify any recommendation in your own console before changing production settings.
- Runs scripts: no
- Uses network: no
- Requires: nothing listed
What people use it for
- Reviewing a Google Cloud project's IAM setup before launch.
- Getting a structured checklist of network security gaps for a new service.
- Checking data protection choices such as encryption key management and sensitive data handling.
- Planning security operations work, including where Security Command Center fits.
- Explaining to a team why a security control matters, by pointing to the framework principle behind it.
Frequently asked questions
Is the Google Cloud security review skill free?
The skill is published in the google/skills repository under the Apache-2.0 licence. The source material does not list any price for it, so check the repository for current licence terms.
What do I need to run this skill?
The listing says it requires nothing beyond the skill itself. It does not run scripts and does not use the network, so no extra tools are listed as necessary.
Can this skill replace a formal compliance audit?
No. The skill gives guidance rather than a verified assessment, so it is not a substitute for an auditor or a scanning tool. Use it to find gaps and plan fixes before a formal review.
Does the skill work with AWS or Azure?
No. It covers Google Cloud workloads only, so it does not address workloads on other cloud providers.
Can I use it during an active security incident?
It is not designed for that. The guidance is general and not tied to your environment's logs, so it is not suited to incident response on a live breach.
How do I install it if I'm not sure where to put the files?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. Alternatively, upload it in the Claude apps under Settings → Capabilities → Skills.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an engineer, team or architect who wants a structured checklist of IAM, network and data protection gaps before a Google Cloud launch, with each fix tied to a named framework principle. Pick something else if you need a formal compliance audit, a scan of your live environment, coverage of other cloud providers, or help during an active breach.
Download the skill