Guide · Agent skill
How to use the Security Command Center Remediation agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to use the google-cloud-scc-remediation skill, an agent skill that helps an AI agent fix Google Cloud Security Command Center (SCC) findings. It is for cloud security and platform engineers who triage SCC findings and want a reviewable plan before any change reaches a project. By the end you will know what the skill does, how to install it, how to phrase a request that triggers it, and what the approval step looks like.
Security Command Center Remediationgoogle/skills · Apache-2.0 Download the skill Quick start
- 1Download the skill. Download the google-cloud-scc-remediation ZIP from this page.
- 2Unzip it into the skills folder. Unzip the file into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload it in the Claude apps. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload the ZIP.
- 4Check your gcloud setup. Make sure the Google Cloud SDK is installed, you are authenticated, and you have access to the findings and target project.
- 5Ask with a finding. Describe the SCC finding, its category and the project in a plain request asking for a fix.
- 6Review the plan. Read the commands, verification steps, rollback steps and dependency warnings the agent presents.
- 7Approve or revise. Reply with explicit approval for the steps you accept. The agent will only execute after you approve.
What is an agent skill, and what does this one do?
An agent skill is a folder of instructions and reference files that an AI agent loads when a task matches the skill's description. This skill is for Google Cloud Security Command Center findings, such as an over-permissive IAM role, a misconfigured resource, a vulnerability, or a toxic combination of issues that form an attack path.
When triggered, the skill tells the agent to route the finding to a matching playbook based on the finding's category, then draft a remediation plan. The plan includes exact commands, verification steps and rollback steps. The agent must show you that plan and wait for your explicit approval before changing anything in your cloud project.
- IAM findings: playbook for primitive roles, over-privileged service accounts, unused roles and unrotated service account keys.
- Misconfiguration findings: playbook for public Cloud Storage buckets, public IP addresses, open firewall rules, open SSH or RDP ports and KMS keys without rotation.
- Vulnerability findings: playbook for OS and software vulnerabilities and GKE runtime OS vulnerabilities, such as patches, base image upgrades and node pool upgrades.
- Toxic combinations: multi-domain attack paths that span IAM, network and resource configuration.
How do you install the skill?
Download the skill ZIP from the skill's page on this directory, then unzip it. Put the resulting folder in one of these locations, depending on how you use your agent: ~/.claude/skills/ for your personal skills, or .claude/skills/ inside a specific project if you want the skill to apply only to that project.
If you use the Claude apps instead, you can upload the ZIP there under Settings, then Capabilities, then Skills.
- Personal install: unzip into ~/.claude/skills/.
- Project install: unzip into the .claude/skills/ folder of your project.
- Claude apps: upload the ZIP under Settings → Capabilities → Skills.
How do you trigger the skill with a natural request?
You do not need a special command. Describe the finding in plain language and ask for a fix, remediation or mitigation. The skill's description matches requests that ask to fix, remediate or mitigate a Security Command Center finding, or to address attack paths.
Include the finding's details where you can, such as its category, the affected project and the resource. The agent uses the category first to choose a playbook, so a precise category helps. Requests that only ask for a general IAM policy review, with no SCC finding, do not trigger this skill.
- Example request: Fix the OPEN_SSH_PORT finding on the bastion VM in project my-project.
- Example request: Remediate this PUBLIC_BUCKET_ACL finding and show me the rollback steps first.
- Example request: Address the attack path in this toxic combination finding and plan the changes.
What do you need before you start?
The skill expects the Google Cloud SDK (gcloud) with an authenticated account. You also need access to the Security Command Center findings and the target project. Terraform is needed only if a configuration change is applied that way. Google Cloud REST API or MCP access is needed only if you use those instead of gcloud.
Because the skill runs scripts and uses the network, review the files in the skill folder before installing it in an environment that holds sensitive projects.
- Google Cloud SDK (gcloud), authenticated.
- Access to the SCC findings and the target project.
- Terraform, if changes are applied through it.
- Google Cloud REST API or MCP access, if used instead of gcloud.
What does the approval step look like?
Before any mutating gcloud, Terraform or API command runs, the agent must present a structured plan and the exact command or configuration diff, then ask whether you approve. It must end its turn there and wait for your next message. If you approve only part of the plan, or the plan changes, the agent presents the updated plan and asks again.
Each mutating step in the plan should list the change, a verification command (a gcloud describe or list check), and a rollback command, or a statement that the step cannot be undone, such as deleting a service account key. The plan also states what could break and asks you to confirm nothing depends on the change, for example cross-project dependencies or CI/CD pipelines before a project-level role binding is revoked.
- Read the proposed commands and the target project before approving.
- Check the dependency warnings, such as other traffic a firewall rule allows.
- Approve only the steps you have checked. The agent will ask again if the plan changes.
What safety notes should you know?
The skill is designed to propose the narrowest fix that resolves the finding. It prefers reversible changes, such as disabling a key before deleting it, and resource-level changes over project, folder or organization-level changes. It is also told not to bundle unrelated fixes, and to mention them separately instead.
The skill does not automate fixes for active runtime threats. For those, it gives containment and investigation guidance, so an incident responder should lead. Unattended or scheduled pipelines are not a good fit: when no user is present, the skill stops at the plan and does not execute anything.
- Every mutating command must name its target project explicitly with --project or a full resource path.
- Usage attribution: the skill asks the agent to tag gcloud commands through an environment variable set inline on each command, and not to use gcloud config set.
Tips for getting good results
Give the agent the finding's category, the project ID and the resource name. These let the agent pick the right playbook and confirm the active gcloud account and project match the finding before it plans anything.
Read the rollback steps before approving. If a step is marked as not undoable, decide whether that is acceptable before you say yes.
- Start with one finding at a time to keep each plan narrow and easy to review.
- If the finding is not in a listed category, the skill falls back to general guidance rather than forcing a playbook.
- Ask for the plan only first if you want to review before any approval is given.
What people use it for
- Triaging a public Cloud Storage bucket finding and checking who reads it before making it private.
- Removing or narrowing a primitive role binding on a service account after checking CI/CD dependencies.
- Planning a firewall change for an open SSH or RDP port with a rollback command ready.
- Reviewing a toxic combination that links an IAM role to a misconfigured resource, one step at a time.
- Drafting a patch or node pool upgrade plan for a GKE runtime OS vulnerability finding.
Frequently asked questions
How do I install the google-cloud-scc-remediation skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings, then Capabilities, then Skills.
What do I need to use this skill?
You need the Google Cloud SDK (gcloud) with an authenticated account and access to the Security Command Center findings and the target project. Terraform is needed only if you apply changes through it, and REST API or MCP access only if you use those instead of gcloud.
Will the agent change my cloud project automatically?
No. The skill requires the agent to show a remediation plan with exact commands and wait for your explicit approval before any mutating command runs. It also stops at the plan when no interactive user is present.
Is the skill free to use?
The skill is licensed under Apache-2.0. Check your Google Cloud account for any charges on the services you use, since this page does not state pricing.
Does this skill work for active attacks or incidents?
Not as an automated fixer. For runtime threat detections, the skill gives containment and investigation guidance, so an incident responder should lead the response.
What is the difference between this skill and asking an agent to fix IAM directly?
This skill routes each finding to a matching playbook and requires a verification and rollback step for every change. It excludes general IAM policy questions that have no Security Command Center finding behind them.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits cloud security and platform engineers who triage Security Command Center findings and want a documented plan with rollback steps before anything changes. It is a poor fit for unattended pipelines expecting automatic fixes, for active incident response where a responder should lead, or for general IAM questions without a finding.
Download the skill