The Agent Skills Directory

Command Generation and Execution: The skill generates gcloud and curl commands to manage Cloud Storage resources. These commands utilize gcloud auth print-access-token to dynamically retrieve OAuth access tokens. While this is a standard operational practice for Google Cloud CLI tools, it involves the use of the user's active credentials to perform API operations. The skill mitigates risk by requiring explicit user confirmation before executing any mutating commands.
Organization Policy Assessment: During Phase 1, the agent performs a security posture assessment by reading project-level organization policies (such as TLS enforcement and HTTPS requirements). This process requires specific IAM permissions (orgpolicy.policy.get) and is used to provide remediation recommendations, which is a security best practice for infrastructure provisioning.
Public Access Management: For use cases like static website hosting, the skill includes logic to disable Public Access Prevention (PAP) and grant allUsers read access. This is a significant configuration change that affects data exposure; however, it is restricted to appropriate use cases and includes clear documentation and confirmation steps.
Irreversible Retention Policies: The skill facilitates the configuration of Bucket Lock and Object Lock (WORM). It correctly identifies the permanent nature of these settings and provides multiple warnings that locked policies cannot be reversed or shortened, even by administrators, until the retention duration has passed.
Indirect Prompt Injection Surface: The skill ingests user requirements to influence the generation of infrastructure-as-code and shell commands.
Ingestion points: User-provided workload descriptions, bucket names, and project IDs used throughout the architecting workflow.
Boundary markers: The provided templates do not utilize specific delimiters for interpolated user input, relying instead on the agent's instructions to ground actions in the provided reference documents.
Capability inventory: The agent utilizes gcloud storage and the Cloud Storage JSON API to create and configure buckets and IAM policies.
Sanitization: The skill instructs the agent to validate user-supplied locations and configurations against official Google Cloud documentation links included in the reference files.

google-cloud-storage-bucket-architect