Skip to content
Get packs

GCP IAM Permissions Auditor

Audit Google Cloud access rights for overly broad roles, risky service account keys and public exposure.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent knows a structured method for reviewing who and what can access a Google Cloud organization or project. It walks through listing permissions, finding broad primitive roles (Owner, Editor), spotting service accounts with user-managed keys, checking for resources open to allUsers, and reviewing Google's IAM Recommender suggestions for removing unused access. It then reports findings and suggests how to narrow permissions. It does not change anything by itself, since the instructions are mainly read-only gcloud queries plus a Python helper.

Great for

  • Cloud security engineers preparing an access review or compliance audit of a GCP organization
  • DevOps or platform teams trying to reduce the blast radius of leaked service account credentials
  • Developers who want a guided checklist for finding over-permissioned accounts in their own project

Skip it if

  • Auditing VPC firewall rules or network controls, which the skill itself says to handle with other tools
  • Real-time detection of suspicious IAM activity, which needs a monitoring service such as SCC Event Threat Detection rather than a point-in-time audit
  • Running against production organizations without authorisation or a clear scope, since the queries read sensitive access data and any follow-up permission changes can break workloads

Try asking

  • “Audit my GCP organization for primitive roles like Owner and Editor and list who holds them”
  • “Find all user-managed service account keys in project my-prod-project and tell me which are old”
  • “Show every resource in our organization that is accessible to allUsers or allAuthenticatedUsers”
  • “Use IAM Recommender to suggest roles we can remove from our service accounts”
Step-by-step guide: how to use GCP IAM Permissions AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    auditing-gcp-iam-permissions.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip auditing-gcp-iam-permissions.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip auditing-gcp-iam-permissions.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Start with read-only steps (listing bindings and keys) and review the output before running any mark-claimed or permission-change commands.
  • Replace ORG_ID and PROJECT_ID placeholders carefully and confirm the target before running, since queries will hit live cloud accounts.
  • Read scripts/agent.py before executing it so you know which APIs it calls and with which credentials.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.