gcloud Skill for Claude Code: Safer Google Cloud Commands

Google's skill that makes your AI agent look up each gcloud command first, keep output small and ask before risky changes.

Installs: 11.7K; on skills.sh
Stars: 21.8K; on GitHub
Files: 3; besides SKILL.md
Updated: Nov 2026; last repo commit

The gcloud skill is a rulebook for any task that runs the gcloud command line tool. Before the agent proposes a command, it must run gcloud help on that exact command. It must add a project and location to each command, pass --quiet, and cap every list with --limit, --filter or --format. Where a command supports --dry-run or --validate-only, it must run that first.

It also lists commands the agent must not run on its own. Those are IAM changes, enabling APIs, installing the gcloud CLI or its components, any gcloud * delete, gcloud billing, gcloud organizations, gcloud kms and gcloud infra-manager deployments apply. The skill does not install gcloud and does not sign you in. You need the CLI set up first, or the remote Cloud CLI MCP server described in its reference file.

Good for

Developers who let an agent run gcloud commands against real Google Cloud projects
Teams that want deletes, billing and IAM changes to need a person's approval
Anyone whose agent keeps inventing gcloud flags that do not exist

Install gcloud

Claude Code

Copy this prompt.

Install the gcloud skill in Claude Code. Run this command:

claude plugin marketplace add google/skills
claude plugin install google-cloud-developer@google-plugins

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Developer Knowledge API key.

Pick one route. The google-cloud-developer plugin adds 5 skills (finding-google-skills, gcloud, google-cloud-recipe-auth, google-cloud-recipe-onboarding, retrieving-developer-knowledge), a routing rules file and a Developer Knowledge MCP server config that needs an API key, per the plugin folder in the repo tree. The skills CLI route installs just gcloud. The skill needs the gcloud CLI on your machine.

From the project README. Source.

What's in the skill

When it loads

Provides safety-critical validation, guardrails, and data reduction for gcloud CLI operations across Google Cloud Platform (GCP) services and infrastructure. Use when planning, generating, constructing, proposing, describing, or executing any gcloud CLI commands - including when answering questions about gcloud syntax, or formatting flags. Don't use when writing Google Cloud client library code or raw REST/gRPC API requests.

Sections in SKILL.md

Usage Attribution
Execution Modes
Core Principles
1. Explicit Command Validation (Mandatory)
2. Data Reduction Strategies (Mandatory)
3. Execution Constraints
4. Project and Location Scoping (Critical)
Safety & Guardrails
Prohibited Operations (Denylist)
Execution Guidelines
Structured Workflows
Discovery Workflow
Quick Reference / Cheat Sheet
Reference Directory

Key facts

Author: Google (google/skills)
Repo: google/skills, folder skills/cloud/gcloud
Installs on skills.sh: 11,704 as of 2026-11-02
GitHub stars: 21,764 for the whole google/skills repo, 2026-11-02
License: Apache-2.0
Last repo commit: 2026-11-01
What is inside: 4 files: SKILL.md and 3 reference guides (attribution, CLI usage, MCP usage)

What it includes

Runs gcloud help on the exact command before suggesting it.
The agent must run gcloud help for the final command, not just its parent group, and may not use web search for gcloud syntax.
Runs code · Check help first
Every list command gets --limit, --filter or --format.
To learn the field names first, it runs a list with a limit of one item in JSON, then builds the filter or format from that.
Runs code · Cap list output
Plans follow a fixed order: help, parameters, dry run, authorization.
Step 1 checks help, step 2 checks the flags and whether --dry-run or --validate-only exists, step 3 proposes the dry run, step 4 proposes the real command or asks for approval.
Read · Four-step plan
Names commands the agent must not run without your approval.
IAM changes, enabling APIs, installing gcloud or its components, gcloud delete, billing, organizations, kms and infra-manager deployments apply.
Read · Denylist
Adds --project and a region, zone or location to commands.
This avoids running against whichever project happens to be active and avoids interactive region prompts.
Runs code · Project and location flags
Prefixes each gcloud command with an environment variable that labels the skill.
The reference file says the tag identifies the skill and its version and carries no user data. If you ask to turn it off, the agent drops it.
Runs code · Usage attribution tag
Optional route that runs gcloud through Google's hosted server instead of your shell.
The mcp-usage reference describes a run_gcloud_command tool at cloudcli.googleapis.com that needs the Cloud CLI Execution API enabled and the MCP Tool User role.
Runs code · Cloud CLI remote MCP server

From the official docs

Permissions

Medium risk

The agent runs gcloud commands as the account you signed in with, so a mistake could change or delete cloud resources. Use a test project or a limited account, and read each command before you approve it.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It runs real commands on your cloud account
Anything gcloud can do for your signed-in account, the agent can attempt. Use a limited account or a test project and approve changes yourself. github.com
It passes --quiet, which skips confirmation prompts
SKILL.md tells the agent to pass --quiet on all execution commands, and its own example is a delete with --quiet. gcloud then accepts safe defaults or fails instead of prompting, so a delete prompt will not stop it. SKILL.md also says destructive actions must be explicitly authorized by you, which makes your approval before the agent runs a command the only check. github.com
Delete and IAM limits are written rules
The skill tells the agent not to run deletes, billing, KMS, organization or IAM commands without your approval. Do not rely on that alone for production projects. github.com
Commands carry a usage label
Each gcloud command gets a variable naming the skill and version. Ask the agent to omit it if you do not want it. github.com
Remote MCP route needs an API and a role
Using it requires enabling the Cloud CLI Execution API on a project and holding the MCP Tool User role. Commands then run on Google's side. github.com
The plugin route adds an MCP server and an API key
The google-cloud-developer plugin bundles a streamable-HTTP MCP server at developerknowledge.googleapis.com that reads DEVELOPERKNOWLEDGE_API_KEY from your environment, plus 4 other skills. Use the skills CLI line to install only gcloud. github.com

Technical details

Turning on read-only	The skill has no read-only switch. Give the signed-in account only viewer roles if you want read-only behavior.
Talks to	Google Cloud APIs, through the gcloud CLI. cloudcli.googleapis.com/mcp, only if you use the remote MCP route in the reference file
Sign-in and keys	Uses the sign-in your gcloud CLI already has. The CLI reference also describes service account key files and impersonation as options.
Data retention	The skill itself bundles no scripts. The attribution file says its usage tag identifies only the skill and version and carries no user data.
Scopes	Runs gcloud commands in your shell as whichever account gcloud is signed in with Can run state-changing commands, with delete, billing, organizations, kms, IAM changes, API enabling and installs reserved for your approval

Questions

What does the gcloud skill do?

It sets rules for an AI agent that runs Google Cloud's gcloud command line tool. The agent has to check each command's help page, limit output, scope commands to a project and ask you before risky actions.

How do I install the gcloud skill?

Use the install box at the top of this page. The skills CLI line installs only gcloud. The google-cloud-developer plugin also contains it, but adds 4 other skills, a routing rules file and a Developer Knowledge MCP server config that needs an API key you create.

Does it install gcloud or sign me in?

No. The skill tells the agent to stop and ask you before installing the gcloud CLI or any component. Sign-in is yours to do, for example with gcloud auth login, which the CLI reference describes.

Can the agent still delete things?

Only with your approval. The skill puts gcloud * delete, billing, organization, KMS and IAM commands on a list the agent must not run on its own. It is a written rule for the agent, so keep your own cloud permissions tight too.

Is it safe to use?

It makes an agent more careful, but the agent still runs real commands as whichever account gcloud is signed in with. Use a project or account with only the access you want it to have, and read each command before you approve it.

What is the usage tag in my commands?

The skill's attribution file tells the agent to prefix each gcloud command with CLOUDSDK_METRICS_REQUEST_ATTRIBUTION, set to a label naming the skill. The file says it carries no user data, and that you can ask the agent to leave it out.

How is it different from the Google Cloud MCP server?

The skill is instructions that guide commands run in your own shell. Its mcp-usage file also describes Google's remote Cloud CLI MCP server as a second way to run gcloud, which needs the Cloud CLI Execution API enabled.

Information

updated Nov 2, 2026

Repository: google/skills
Folder: skills/cloud/gcloud

google/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

https://github.com/google/skills/blob/HEAD/skills/cloud/gcloud/SKILL.md · github.com
google/skills README · github.com
google-cloud-developer plugin README · github.com
google-cloud-developer .mcp.json · github.com
https://github.com/google/skills/blob/HEAD/skills/cloud/gcloud/references/cli-usage.md · github.com
https://github.com/google/skills/blob/HEAD/skills/cloud/gcloud/references/mcp-usage.md · github.com
https://github.com/google/skills/blob/HEAD/skills/cloud/gcloud/references/attribution.md · github.com