Agent skill · google
google-cloud-scc-query
Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Google Cloud Security Command Center. Use when retrieving details for a security finding by its name, validating finding scope (e.g., verifying findingClass is TOXIC_COMBINATION, VULNERABILITY, EXTERNAL_EXPOSURE, or THREAT), or fetching finding details for triage. Don't use to draft remediations, apply patches, or execute configurations.
What it needs
About 5k tokens when loaded.
What this skill does
Google Cloud Security Command Center Query Skill Provides guidelines and read-only gcloud CLI command patterns for querying and retrieving security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Google Cloud Security Command Center. [!IMPORTANT] There is NO gcloud scc findings describe command (Invalid choice: 'describe'). To retrieve details for a specific finding by its name, always use gcloud scc findings list with a filter on name. -------------------------------------------------------------------------------- Core Execution Rules 1. Read-Only & Zero-Speculation (Parent Scope Required): Keep all executions strictly read-only. Every gcloud scc findings list or group command strictly requires an explicit {parent} scope (organizations/{id}, projects/{id}, or folders/{id}). If the parent scope is missing from the prompt and cannot be inferred from a full finding name, DO NOT run any gcloud commands (do not execute queries without parent, and never inspect gcloud config). Halt immediately before executing commands and ask the user for the parent resource scope. 2. Bounded Execution & No Runaway Loops: Limit tool calls to what is strictly necessary to complete the query (typically 1 call for direct queries, or 2 calls for List → Deep Dive workflows). If a command fails due to permission/auth errors, or if a specific finding query returns [], halt immediately. Do not attempt blind brute-force retries with different flags, and never search the local workspace for credentials. 3. Immediate Halt on Errors: If any command fails with PERMISSIONDENIED, IAMPERMISSIONDENIED, credential expiration, or network timeouts, halt immediately and report the verbatim error message. Do not search the workspace for credentials or run diagnostic loops. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills google/google-cloud-scc-query