Guide · Agent skill
How to use the Security Command Center Finding Query agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the google-cloud-scc-query agent skill, which lets an AI agent look up active security findings in Google Cloud's Security Command Center using read-only gcloud CLI commands. It is written for cloud security engineers and analysts who triage findings and have never set up an agent skill before. By the end you will know how to install the skill, phrase a request so it triggers, and what the agent will and will not do.
Security Command Center Finding Querygoogle/skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Confirm gcloud access. Make sure the Google Cloud SDK is installed and authenticated with permission to list Security Command Center findings.
- 4Set the regional endpoint if needed. If Data Residency applies, set the securitycenter API endpoint override for your region before querying.
- 5Ask with a parent scope. Give an organization, folder or project, or a full finding name, along with what you want to know.
- 6Review the result. Read the returned finding details and any error the agent reports verbatim.
What the skill makes the agent do
Once installed, the agent can retrieve security findings from Security Command Center, including external exposures, toxic combinations, vulnerabilities, threats and sensitive data risks. It works through read-only gcloud commands and only analyses the finding data returned by Security Command Center.
The skill is built for triage. It does not draft remediations, apply patches or change configurations.
- Look up the full details of one finding by its name
- List findings matching a filter, such as a finding class
- Check whether a finding belongs to a class like TOXIC_COMBINATION, VULNERABILITY, EXTERNAL_EXPOSURE or THREAT
Install the skill
You can install the skill by downloading the ZIP file from this page and unzipping it into one of two locations. Use ~/.claude/skills/ for a personal install available across your projects, or a project's .claude/skills/ folder to share it with one codebase.
In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Project: unzip into .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Meet the prerequisites
The skill only works against live Security Command Center data, so you need a Google Cloud account and the tools below. The skill runs gcloud commands, so the Google Cloud SDK must be installed and authenticated on the machine where the agent runs.
- Google Cloud SDK (gcloud CLI) installed and authenticated
- Security Command Center access with IAM permissions to list findings at the chosen organization, folder or project
- Access to the Security Command Center API endpoint, including the regional endpoint override if your data must stay in a specific region
Trigger the skill with natural requests
The skill activates when you ask for a specific finding's details, want to verify a finding's class, or want findings fetched for triage. Always include a parent scope: an organization, folder or project. If you give a full finding name, the scope can be read from the name itself.
If you do not give a scope, the agent will stop and ask for one rather than guess. If you give several finding names for a single-finding report, it will ask you to pick one.
- Show me the details for this finding: organizations/123/sources/456/findings/789
- List THREAT findings in project my-project-id
- Check whether this finding is a TOXIC_COMBINATION in folder 555
Data residency and regional endpoints
If Data Residency is enabled, findings are stored in a designated location (us, eu or me-central2), and queries do not return findings from other regions. Set the regional endpoint override before querying, and pass the matching location. Regional finding names include a /locations/{location}/ segment.
To reset to default global routing, unset the override.
gcloud config set api_endpoint_overrides/securitycenter https://securitycenter.eu.rep.googleapis.com/
gcloud config unset api_endpoint_overrides/securitycenterSafety notes: scripts and network
This skill runs scripts and uses the network, because it calls the Security Command Center API through gcloud. It is read-only by design, but you should still review the commands the agent proposes before it runs them.
The skill halts on permission, authentication or network errors and reports the exact error message. It does not search your workspace for credentials or retry with different flags. It also sets a metrics attribution variable inline on each gcloud command, and does not change your persistent gcloud configuration for that purpose.
- Halts on PERMISSION_DENIED, IAM_PERMISSION_DENIED, credential expiry or network timeouts
- Does not query underlying resources such as VMs or buckets referenced in a finding
- Returns no results rather than guessing when a query returns an empty list
Tips for better results
Give the agent the most specific scope you have. A finding name with its full path lets the skill extract the parent and location for you. For listing, a narrow filter keeps output small because the skill uses a field mask to limit returned fields.
For a complete record of one finding, ask for the full details so the agent returns the whole JSON payload.
- Prefer full finding names over short IDs
- Specify the location when your data is regional
- Ask for a finding class filter when triaging by category
What people use it for
- Pull the full JSON for one finding named in an incident ticket
- List current VULNERABILITY findings across a project for weekly triage
- Confirm whether a flagged item is really a TOXIC_COMBINATION before escalating it
- Check external exposure findings within an EU-residency organization
Frequently asked questions
How do I install the google-cloud-scc-query skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.
What do I need before using this skill?
You need the Google Cloud SDK (gcloud CLI) installed and authenticated, plus Security Command Center access with IAM permission to list findings at your chosen organization, folder or project. Without a Google Cloud account the skill cannot reach live data.
Is the google-cloud-scc-query skill free?
The skill is licensed under Apache-2.0. Google Cloud and Security Command Center access are separate and are billed according to your own Google Cloud account.
Can the skill fix or remediate findings?
No. The skill is read-only and is designed for triage. It does not draft remediations, apply patches or change configurations.
Why does the agent ask for an organization, folder or project?
Every findings query needs an explicit parent scope. If you do not provide one and it cannot be read from a full finding name, the agent halts and asks instead of guessing.
What should I do if the skill reports PERMISSION_DENIED?
The skill stops and shows the verbatim error. Check that your account has IAM permission to list findings at the scope you chose, and that your gcloud authentication is current, then ask again.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits cloud security engineers and analysts who need quick, read-only lookups of Security Command Center findings by name or class. It is not the right choice if you want an agent to draft or apply remediations, or if you cannot provide a parent scope or a Google Cloud account with gcloud access.
Download the skill