From f79ff8f1b7aabf38a35e85052299fd821b67b665 Mon Sep 17 00:00:00 2001 From: Vikram Ruppa-Kasani Date: Mon, 8 Jun 2026 14:39:54 -0700 Subject: [PATCH 1/2] Rename security-assessment skill to gcs-security-assessment --- PERMISSIONS.md | 4 ++-- README.md | 8 ++++---- gcs-security-assessment-role.yaml | 2 +- .../SKILL.md | 2 +- .../examples/sample_assessment.md | 0 .../references/baseline_security.md | 0 .../references/bucket_classification.md | 0 .../references/phases/baseline.md | 0 .../references/phases/classification.md | 0 .../references/phases/discover.md | 0 .../references/phases/output.md | 0 .../references/phases/toxic_analysis.md | 0 .../references/saif_risk_factors.md | 0 .../references/telemetry_signals.md | 0 .../references/toxic_combinations.md | 0 .../scripts/cloud_rest_helpers_nodeps.py | 6 +++--- .../scripts/evaluate_project_security_posture.py | 2 +- .../scripts/fetch_bucket_telemetry.py | 2 +- .../scripts/fetch_object_telemetry.py | 2 +- .../scripts/list_datasets.py | 2 +- .../scripts/preflight_permissions.py | 2 +- .../scripts/validation.py | 0 22 files changed, 16 insertions(+), 16 deletions(-) rename skills/{security-assessment => gcs-security-assessment}/SKILL.md (99%) rename skills/{security-assessment => gcs-security-assessment}/examples/sample_assessment.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/baseline_security.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/bucket_classification.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/phases/baseline.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/phases/classification.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/phases/discover.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/phases/output.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/phases/toxic_analysis.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/saif_risk_factors.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/telemetry_signals.md (100%) rename skills/{security-assessment => gcs-security-assessment}/references/toxic_combinations.md (100%) rename skills/{security-assessment => gcs-security-assessment}/scripts/cloud_rest_helpers_nodeps.py (98%) rename skills/{security-assessment => gcs-security-assessment}/scripts/evaluate_project_security_posture.py (99%) rename skills/{security-assessment => gcs-security-assessment}/scripts/fetch_bucket_telemetry.py (99%) rename skills/{security-assessment => gcs-security-assessment}/scripts/fetch_object_telemetry.py (99%) rename skills/{security-assessment => gcs-security-assessment}/scripts/list_datasets.py (98%) rename skills/{security-assessment => gcs-security-assessment}/scripts/preflight_permissions.py (99%) rename skills/{security-assessment => gcs-security-assessment}/scripts/validation.py (100%) diff --git a/PERMISSIONS.md b/PERMISSIONS.md index 97b2f01..b57a43f 100644 --- a/PERMISSIONS.md +++ b/PERMISSIONS.md @@ -4,9 +4,9 @@ This guide documents the Google Cloud IAM permissions used by the skills in this repository. All access is **read-only**β€”the skills never mutate your resources. More skills (and their permission requirements) will be added here over time. -## Security Assessment Skill +## GCS Security Assessment Skill -The Security Assessment skill performs a **read-only** security posture +The GCS Security Assessment skill performs a **read-only** security posture assessment of Google Cloud Storage projects and buckets. It reads bucket and object state via Storage Insights β†’ BigQuery and gathers project-level posture via REST. It never mutates target resources. diff --git a/README.md b/README.md index 5691b56..c028588 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ resources. - [Installation](#installation) - [Available Skills](#available-skills) - [Prerequisites](#prerequisites) -- [Security Assessment Skill](#security-assessment-skill) +- [GCS Security Assessment Skill](#gcs-security-assessment-skill) - [Required Permissions](#required-permissions) - [Authentication](#authentication) - [Usage Examples](#usage-examples) @@ -44,7 +44,7 @@ Gemini CLI, Claude Code, Codex, and Antigravity CLI. ## Available Skills -- [**Security Assessment**](#security-assessment-skill) β€” Assesses the +- [**GCS Security Assessment**](#gcs-security-assessment-skill) β€” Assesses the security posture of Google Cloud Storage projects and buckets, identifying toxic combinations of vulnerabilities and checking SAIF compliance. @@ -61,9 +61,9 @@ Ensure you have the following: * **A compatible coding agent**, such as Gemini CLI, Claude Code, Codex, or Antigravity CLI. -## Security Assessment Skill +## GCS Security Assessment Skill -The Security Assessment skill is grounded in Google's +The GCS Security Assessment skill is grounded in Google's [Secure AI Framework (SAIF)](https://saif.google/secure-ai-framework/saif-map). Rather than emitting isolated static alerts, it correlates real telemetry signals gathered from your project to surface **toxic combinations** of diff --git a/gcs-security-assessment-role.yaml b/gcs-security-assessment-role.yaml index 20d74b9..7cb7732 100644 --- a/gcs-security-assessment-role.yaml +++ b/gcs-security-assessment-role.yaml @@ -1,5 +1,5 @@ title: "GCS Security Assessment (Read-Only)" -description: "Read-only access for the GCS security-assessment skill." +description: "Read-only access for the GCS Security Assessment skill." stage: "GA" includedPermissions: # Bucket & object assessment (Storage Insights telemetry) diff --git a/skills/security-assessment/SKILL.md b/skills/gcs-security-assessment/SKILL.md similarity index 99% rename from skills/security-assessment/SKILL.md rename to skills/gcs-security-assessment/SKILL.md index 680ef1b..d5cc618 100644 --- a/skills/security-assessment/SKILL.md +++ b/skills/gcs-security-assessment/SKILL.md @@ -1,5 +1,5 @@ --- -name: security-assessment +name: gcs-security-assessment description: >- Assesses security posture, evaluates risks, and checks SAIF compliance for Google Cloud Storage buckets or projects. Use when the user requests security scans, vulnerability checks, or SAIF assessments. Don't use when: The user is asking about non-GCS resources (Compute Engine, GKE, etc.), investigating a live production outage, or asking general security questions not tied to a specific project or bucket. diff --git a/skills/security-assessment/examples/sample_assessment.md b/skills/gcs-security-assessment/examples/sample_assessment.md similarity index 100% rename from skills/security-assessment/examples/sample_assessment.md rename to skills/gcs-security-assessment/examples/sample_assessment.md diff --git a/skills/security-assessment/references/baseline_security.md b/skills/gcs-security-assessment/references/baseline_security.md similarity index 100% rename from skills/security-assessment/references/baseline_security.md rename to skills/gcs-security-assessment/references/baseline_security.md diff --git a/skills/security-assessment/references/bucket_classification.md b/skills/gcs-security-assessment/references/bucket_classification.md similarity index 100% rename from skills/security-assessment/references/bucket_classification.md rename to skills/gcs-security-assessment/references/bucket_classification.md diff --git a/skills/security-assessment/references/phases/baseline.md b/skills/gcs-security-assessment/references/phases/baseline.md similarity index 100% rename from skills/security-assessment/references/phases/baseline.md rename to skills/gcs-security-assessment/references/phases/baseline.md diff --git a/skills/security-assessment/references/phases/classification.md b/skills/gcs-security-assessment/references/phases/classification.md similarity index 100% rename from skills/security-assessment/references/phases/classification.md rename to skills/gcs-security-assessment/references/phases/classification.md diff --git a/skills/security-assessment/references/phases/discover.md b/skills/gcs-security-assessment/references/phases/discover.md similarity index 100% rename from skills/security-assessment/references/phases/discover.md rename to skills/gcs-security-assessment/references/phases/discover.md diff --git a/skills/security-assessment/references/phases/output.md b/skills/gcs-security-assessment/references/phases/output.md similarity index 100% rename from skills/security-assessment/references/phases/output.md rename to skills/gcs-security-assessment/references/phases/output.md diff --git a/skills/security-assessment/references/phases/toxic_analysis.md b/skills/gcs-security-assessment/references/phases/toxic_analysis.md similarity index 100% rename from skills/security-assessment/references/phases/toxic_analysis.md rename to skills/gcs-security-assessment/references/phases/toxic_analysis.md diff --git a/skills/security-assessment/references/saif_risk_factors.md b/skills/gcs-security-assessment/references/saif_risk_factors.md similarity index 100% rename from skills/security-assessment/references/saif_risk_factors.md rename to skills/gcs-security-assessment/references/saif_risk_factors.md diff --git a/skills/security-assessment/references/telemetry_signals.md b/skills/gcs-security-assessment/references/telemetry_signals.md similarity index 100% rename from skills/security-assessment/references/telemetry_signals.md rename to skills/gcs-security-assessment/references/telemetry_signals.md diff --git a/skills/security-assessment/references/toxic_combinations.md b/skills/gcs-security-assessment/references/toxic_combinations.md similarity index 100% rename from skills/security-assessment/references/toxic_combinations.md rename to skills/gcs-security-assessment/references/toxic_combinations.md diff --git a/skills/security-assessment/scripts/cloud_rest_helpers_nodeps.py b/skills/gcs-security-assessment/scripts/cloud_rest_helpers_nodeps.py similarity index 98% rename from skills/security-assessment/scripts/cloud_rest_helpers_nodeps.py rename to skills/gcs-security-assessment/scripts/cloud_rest_helpers_nodeps.py index 99e818e..eb7f851 100644 --- a/skills/security-assessment/scripts/cloud_rest_helpers_nodeps.py +++ b/skills/gcs-security-assessment/scripts/cloud_rest_helpers_nodeps.py @@ -58,7 +58,7 @@ def bigquery_labels(skill: str, script: str) -> dict[str, str]: (https://cloud.google.com/bigquery/docs/labels-intro#requirements). Args: - skill: Identifier for the calling skill (e.g., "security-assessment"). + skill: Identifier for the calling skill (e.g., "gcs-security-assessment"). script: Identifier for the calling script (e.g., "fetch-bucket-telemetry"). Returns: @@ -395,7 +395,7 @@ def get_authorized_session( also stamped so requests are billed/quota-attributed to that project. Args: - skill: Identifier for the calling skill (e.g., "security-assessment"). + skill: Identifier for the calling skill (e.g., "gcs-security-assessment"). script: Identifier for the calling script (e.g., "fetch-bucket-telemetry"). project_id: Optional GCP project ID for billing/quota attribution. When set, stamped as the ``X-Goog-User-Project`` header on every request. @@ -469,7 +469,7 @@ def execute_bigquery_query( project_id: The GCP project ID. payload: The JSON query payload. session: Authorized session for REST requests. - skill: Identifier for the calling skill (e.g., "security-assessment"). + skill: Identifier for the calling skill (e.g., "gcs-security-assessment"). script: Identifier for the calling script (e.g., "fetch-bucket-telemetry"). Returns: diff --git a/skills/security-assessment/scripts/evaluate_project_security_posture.py b/skills/gcs-security-assessment/scripts/evaluate_project_security_posture.py similarity index 99% rename from skills/security-assessment/scripts/evaluate_project_security_posture.py rename to skills/gcs-security-assessment/scripts/evaluate_project_security_posture.py index b2d9625..14901f4 100644 --- a/skills/security-assessment/scripts/evaluate_project_security_posture.py +++ b/skills/gcs-security-assessment/scripts/evaluate_project_security_posture.py @@ -25,7 +25,7 @@ # plane, so it needs a longer timeout than per-region/global Model Armor calls. _MODEL_ARMOR_TEMPLATES_TIMEOUT_SECONDS = 30 -_SKILL = "security-assessment" +_SKILL = "gcs-security-assessment" _SCRIPT = "evaluate-project-security-posture" diff --git a/skills/security-assessment/scripts/fetch_bucket_telemetry.py b/skills/gcs-security-assessment/scripts/fetch_bucket_telemetry.py similarity index 99% rename from skills/security-assessment/scripts/fetch_bucket_telemetry.py rename to skills/gcs-security-assessment/scripts/fetch_bucket_telemetry.py index 4c8576b..d88f990 100644 --- a/skills/security-assessment/scripts/fetch_bucket_telemetry.py +++ b/skills/gcs-security-assessment/scripts/fetch_bucket_telemetry.py @@ -9,7 +9,7 @@ import cloud_rest_helpers_nodeps import validation -_SKILL = "security-assessment" +_SKILL = "gcs-security-assessment" _SCRIPT = "fetch-bucket-telemetry" diff --git a/skills/security-assessment/scripts/fetch_object_telemetry.py b/skills/gcs-security-assessment/scripts/fetch_object_telemetry.py similarity index 99% rename from skills/security-assessment/scripts/fetch_object_telemetry.py rename to skills/gcs-security-assessment/scripts/fetch_object_telemetry.py index 4734fcb..e963e69 100644 --- a/skills/security-assessment/scripts/fetch_object_telemetry.py +++ b/skills/gcs-security-assessment/scripts/fetch_object_telemetry.py @@ -9,7 +9,7 @@ import cloud_rest_helpers_nodeps import validation -_SKILL = "security-assessment" +_SKILL = "gcs-security-assessment" _SCRIPT = "fetch-object-telemetry" diff --git a/skills/security-assessment/scripts/list_datasets.py b/skills/gcs-security-assessment/scripts/list_datasets.py similarity index 98% rename from skills/security-assessment/scripts/list_datasets.py rename to skills/gcs-security-assessment/scripts/list_datasets.py index 73864aa..cb85b21 100644 --- a/skills/security-assessment/scripts/list_datasets.py +++ b/skills/gcs-security-assessment/scripts/list_datasets.py @@ -14,7 +14,7 @@ import cloud_rest_helpers_nodeps _TIMEOUT_SECONDS = 10 -_SKILL = "security-assessment" +_SKILL = "gcs-security-assessment" _SCRIPT = "list-datasets" diff --git a/skills/security-assessment/scripts/preflight_permissions.py b/skills/gcs-security-assessment/scripts/preflight_permissions.py similarity index 99% rename from skills/security-assessment/scripts/preflight_permissions.py rename to skills/gcs-security-assessment/scripts/preflight_permissions.py index 5ef0f47..4c4fc09 100644 --- a/skills/security-assessment/scripts/preflight_permissions.py +++ b/skills/gcs-security-assessment/scripts/preflight_permissions.py @@ -18,7 +18,7 @@ _BIGQUERY_API = "https://bigquery.googleapis.com/bigquery/v2/projects" _STORAGE_INSIGHTS_API = "https://storageinsights.googleapis.com/v1/projects" -_SKILL = "security-assessment" +_SKILL = "gcs-security-assessment" _SCRIPT = "preflight-permissions" diff --git a/skills/security-assessment/scripts/validation.py b/skills/gcs-security-assessment/scripts/validation.py similarity index 100% rename from skills/security-assessment/scripts/validation.py rename to skills/gcs-security-assessment/scripts/validation.py From c02fc40fb38b1ce14d7584a61382c8ccf426bc5c Mon Sep 17 00:00:00 2001 From: Vikram Ruppa-Kasani Date: Mon, 8 Jun 2026 15:00:59 -0700 Subject: [PATCH 2/2] Address review: add GCS to preflight skill description --- .../gcs-security-assessment/scripts/preflight_permissions.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/skills/gcs-security-assessment/scripts/preflight_permissions.py b/skills/gcs-security-assessment/scripts/preflight_permissions.py index 4c4fc09..c0cb031 100644 --- a/skills/gcs-security-assessment/scripts/preflight_permissions.py +++ b/skills/gcs-security-assessment/scripts/preflight_permissions.py @@ -1,4 +1,4 @@ -"""Preflight permission check for the security assessment skill. +"""Preflight permission check for the GCS security assessment skill. Probes prerequisites the assessment depends on and emits a structured report. Required checks gate the assessment; recommended checks downgrade it to a @@ -341,7 +341,7 @@ def run_preflight(*, project_id: str, dataset_name: str) -> Mapping[str, Any]: def main() -> None: parser = argparse.ArgumentParser( description=( - "Preflight permission check for the security assessment skill." + "Preflight permission check for the GCS security assessment skill." ) ) parser.add_argument("--project_id", required=True, help="GCP project ID")