agentsclimarketplace
Sign in

Gcp security

Skill jpantsjoha/googlecloud-plugin/skills/gcp-security

GCP security enforcer. Reviews designs and implementations against the GCP Well-Architected Framework security pillar, OWASP Top 10, and GCP-specific risk patterns. Enforces least-privilege IAM, secrets management, no hardcoded credentials, and security-by-design. Also reviews solution-designer output for cross-cloud security gaps. Must clear the security gate before any implementation begins. Use when the user mentions: security review, IAM review, least privilege, vulnerability, public bucket, default service account, security posture, compliance GCP, OWASP GCP. Use this to review and gate; use iam instead to author or change bindings.From its SKILL.md

Install
npx -y skills add jpantsjoha/googlecloud-plugin --skill gcp-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.6 KB, as published. Nobody here has run it

GCP Security

Tier 3 — cross-cutting security enforcer. Reviews both the solution-designer output (cross-vendor security gaps) and the GCP architect's HLD/LLD (GCP-specific risks) before any implementation begins.

Gate Responsibility

Security Gate — blocks implementation if any of the following:

  • IAM roles are over-permissive (not least-privilege)
  • Secrets, credentials, or API keys appear in code, config, or skill references
  • GCP-specific risks unaddressed: public storage buckets, default service accounts in use, unauthenticated Cloud Run endpoints without intent
  • Well-Architected Framework security pillar not addressed in the HLD
  • Cross-vendor security boundaries undefined (if multi-cloud)

Review Checklist

IAM

  • Custom roles or predefined roles scoped to minimum required permissions
  • No default compute service account used for application workloads
  • Workload Identity used for GKE pods (not SA key files)
  • Service account keys absent from code or repos
  • IAM conditions applied where scope can be narrowed further

Secrets & Credentials

  • No secrets in environment variables committed to source control
  • Secret Manager used for all sensitive config
  • No hardcoded credentials in Terraform, scripts, or skills
  • SA key files referenced by path only — values never recorded

Network

  • VPC firewall rules deny-by-default; only necessary ingress/egress open
  • Private Google Access enabled where public internet not required
  • Cloud Armor configured for public-facing endpoints
  • No 0.0.0.0/0 ingress rules without documented justification

Storage & Data

  • Cloud Storage buckets not publicly accessible unless explicitly intended
  • Uniform bucket-level access enforced
  • CMEK (Customer-Managed Encryption Keys) evaluated for sensitive data
  • BigQuery datasets not publicly shared

GCP-Specific Risks

  • No legacy metadata server access from untrusted workloads
  • OS Login enabled for GCE instances
  • Container images scanned (Artifact Registry vulnerability scanning)
  • Cloud Run services — auth required unless public by design

References

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.