The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes gcloud and terraform commands to survey and verify cloud infrastructure. It includes an enumerate feature allowing users to specify supplementary gcloud commands in a manifest file. This execution is strictly controlled by a validation engine (validate_native_spec) that enforces read-only verbs (e.g., list, describe, get) and prevents the use of dangerous flags that could be used to manipulate or hide data.
[INTEGRITY_CHECK]: The skill includes a dedicated integrity module (scripts/integrity.py) that generates SHA256 digests for all "frozen" verification scripts. The audit tools (coverage.py and verify_plan.py) stamp these digests and input hashes into their output, ensuring that verification results are attributable to specific tool versions and specific inputs, preventing silent modification of the audit logic.
[DATA_CONFIDENTIALITY]: The operational contract (references/operating-contract.md) and agent protocol (SKILL.md) establish a non-negotiable boundary for organizational data. They explicitly forbid the publication of GCP identifiers, principals, or resource counts to public repositories and mandate the deletion of sensitive local artifacts like .tfstate and *.tfplan files once verification is complete.
[LEAST_PRIVILEGE]: The skill is designed to operate using a dedicated read-only identity. It requires only viewer-level IAM roles (e.g., roles/cloudasset.viewer, roles/resourcemanager.organizationViewer) and provides clear guidance on maintaining a read-only posture to prevent accidental environmental mutation.

fabric-importer