Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

GCP Security Scanner Skill · a5c-ai | DecimalAI

a5c-ai/gcp-security-scanner

SkillScore74Maintained

GCP security configuration scanning and hardening using Security Command Center, Forseti, and ScoutSuite

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-gcp-security-scanner/SKILL.md

decimalai skills pull a5c-ai-gcp-security-scanner --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-gcp-security-scanner/SKILL.md https://app.decimal.ai/s/a5c-ai-gcp-security-scanner/SKILL.md

Raw file: /s/a5c-ai-gcp-security-scanner/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-gcp-security-scanner.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 25d ago

Yes — +48% lift · at higher cost+38% tokens0% turns74% of whole cases pass with skill (17/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	152%	0%
case-05	✗→✓	▲ Improved	30%	0%
case-06	✗→✓	▲ Improved	47%	0%
case-07	✗→✓	▲ Improved	71%	0%
case-09	✗→✓	▲ Improved	110%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/gcp-security-scanner/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

GCP Security Scanner Skill

Purpose

Automated Google Cloud Platform security configuration scanning and hardening to identify misconfigurations, compliance violations, and security risks across GCP projects and organizations.

Capabilities

Security Command Center Integration

Leverage GCP Security Command Center findings
Review vulnerability and threat findings
Check Security Health Analytics results
Monitor Event Threat Detection alerts
Track Container Threat Detection findings
Generate compliance reports

IAM Security Analysis

Analyze IAM policies for over-permissive access
Check service account key usage and rotation
Identify excessive permissions
Review organization policy constraints
Detect cross-project access
Audit IAM recommender suggestions

VPC Firewall Analysis

Review firewall rules for overly permissive access
Check for open management ports
Validate VPC Service Controls
Review Shared VPC configurations
Check Private Google Access settings
Analyze VPC flow logs configuration

Cloud Storage Security

Identify publicly accessible buckets
Check bucket IAM policies
Validate uniform bucket-level access
Review bucket encryption settings
Check access logging configuration
Verify retention policies

Cloud KMS Configuration

Review key ring and key configurations
Check key rotation policies
Validate IAM policies on keys
Review HSM key protection levels
Check external key manager usage
Audit key access patterns

Audit Logging Verification

Validate Cloud Audit Logs configuration
Check data access logging
Review admin activity logging
Verify log export configuration
Check Cloud Logging retention
Validate alert policies

Organization Policy Assessment

Review organization policy constraints
Check service restriction policies
Validate resource location constraints
Review VM external IP restrictions
Check service account creation policies

GCP Services Covered

| Category | Services | |----------|----------| | Identity | IAM, Cloud Identity, Workforce Identity | | Compute | Compute Engine, GKE, Cloud Run, Functions | | Storage | Cloud Storage, Persistent Disks | | Database | Cloud SQL, Spanner, BigQuery, Firestore | | Network | VPC, Firewall, Cloud Armor, Cloud CDN | | Security | Security Command Center, Cloud KMS, BeyondCorp | | Monitoring | Cloud Logging, Cloud Monitoring, Cloud Audit Logs |

Integrations

Security Command Center: GCP native CSPM
Forseti Security: Open-source GCP security toolkit
ScoutSuite: Multi-cloud security auditing
Cloud Asset Inventory: Resource visibility
IAM Recommender: Permission optimization

Target Processes

Cloud Security Architecture Review
Compliance Monitoring
GCP Project Hardening
Security Posture Assessment

Input Schema

json
{
  "type": "object",
  "properties": {
    "scanType": {
      "type": "string",
      "enum": ["full", "cis", "pci", "hipaa", "iso27001", "custom"],
      "description": "Type of security scan"
    },
    "projects": {
      "type": "array",
      "items": { "type": "string" },
      "description": "GCP project IDs to scan"
    },
    "organization": {
      "type": "string",
      "description": "GCP organization ID for org-wide scanning"
    },
    "services": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific services to scan"
    },
    "severityThreshold": {
      "type": "string",
      "enum": ["critical", "high", "medium", "low"]
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["CIS", "PCI-DSS", "HIPAA", "ISO27001", "SOC2", "NIST"]
      }
    },
    "includeSCC": {
      "type": "boolean",
      "description": "Include Security Command Center findings"
    }
  },
  "required": ["scanType"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string"
    },
    "scanTimestamp": {
      "type": "string",
      "format": "date-time"
    },
    "projectsScanned": {
      "type": "array"
    },
    "organizationId": {
      "type": "string"
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalChecks": { "type": "integer" },
        "passed": { "type": "integer" },
        "failed": { "type": "integer" },
        "warnings": { "type": "integer" }
      }
    },
    "findingsBySeverity": {
      "type": "object",
      "properties": {
        "critical": { "type": "integer" },
        "high": { "type": "integer" },
        "medium": { "type": "integer" },
        "low": { "type": "integer" }
      }
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "checkId": { "type": "string" },
          "severity": { "type": "string" },
          "service": { "type": "string" },
          "project": { "type": "string" },
          "resourceName": { "type": "string" },
          "description": { "type": "string" },
          "remediation": { "type": "string" },
          "complianceMapping": { "type": "array" }
        }
      }
    },
    "sccFindings": {
      "type": "array"
    },
    "organizationPolicyStatus": {
      "type": "object"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}

Usage Example

javascript
skill: {
  name: 'gcp-security-scanner',
  context: {
    scanType: 'cis',
    projects: ['my-project-id'],
    complianceFrameworks: ['CIS', 'SOC2'],
    includeSCC: true,
    severityThreshold: 'medium'
  }
}

Illustrative Want to see what a5c-ai/gcp-security-scanner would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:37 UTC · 23 cases

Lift

+48%

74% vs 26%

Agent turns

0%

1.0 vs 1.0

Tokens

+38%

3,259.32 vs 2,360.77

fail → pass · 12pass → pass · 5fail → fail · 5pass → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I need a comprehensive security scan performed on our GCP projects `prod-data-platform` and `prod-infra-v2`. Please audit our identity permissions, storage bucket access controls, and firewall configurations. I'd like the output formatted as a structured JSON object containing the scan metadata, summary metrics (total, passed, failed checks), a breakdown of findings by severity, detailed issue listings with resource names and remediation instructions, and an overall recommendations list.	fail→fail	36,217	16,793	-54%	1	1	0%	7,826	2,626	-66%	0	0	—
case-02 Please execute an organization-wide GCP security baseline assessment for org ID `org-8839204928`. Make sure to pull in native Security Command Center insights alongside org policy evaluations. Return a JSON response detailing the scanned organization, a breakdown of findings by severity levels, individual finding items with compliance mappings, native SCC alert lists, and org policy status summaries.	fail→fail	21,863	11,370	-48%	1	1	0%	1,128	2,642	+134%	0	0	—
case-03 Can you scan our Google Cloud project `analytics-pipeline-dev` specifically focusing on Cloud Storage and Cloud KMS key security? I need a JSON report that includes scan timestamps, projects checked, summary check counts, findings categorized by critical/high/medium/low severity along with recommended fixes for any detected misconfigurations.	fail→fail	23,123	19,586	-15%	1	1	0%	3,910	3,498	-11%	0	0	—
case-04 Configure a scan request JSON object for a PCI compliance audit targeting project payment-service-prod. I want to run a PCI scan type and set the severity threshold to high. Provide the JSON input payload for triggering this tool.	fail→pass	9,417	2,909	-69%	1	1	0%	814	2,048	+152%	0	0	—
case-05 Prepare an input payload for scanning finance-app-staging against both the CIS GCP Benchmark and NIST SP 800-53 standards. Use a standard full scan type.	fail→pass	8,775	8,777	+0%	1	1	0%	1,724	2,247	+30%	0	0	—
case-06 Construct an input payload for an org-level scan of 123456789012 using custom scan parameters. Ensure Security Command Center integration is explicitly enabled.	fail→pass	12,763	11,411	-11%	1	1	0%	1,404	2,057	+47%	0	0	—
case-07 Generate a minimal valid input JSON object to request a GCP HIPAA compliance assessment across project healthcare-records-prod.	fail→pass	12,358	8,037	-35%	1	1	0%	1,192	2,043	+71%	0	0	—
case-08 Provide a JSON result object for a scan of project ecommerce-web-prod. The scan finished with 10 total checks: 7 passed, 2 failed, and 1 warning. Represent these metric counts accurately in the scan output structure.	pass→pass	10,262	16,461	+60%	1	1	0%	2,335	4,034	+73%	0	0	—
case-09 Return a JSON output representing a single security finding in project data-warehouse-prod where Cloud Storage bucket raw-data-bucket-99 has public read permissions. Structure the item within the standard findings list.	fail→pass	13,721	9,339	-32%	1	1	0%	1,675	3,524	+110%	0	0	—
case-10 Format a GCP security assessment JSON response for project core-banking-prod that includes Security Command Center vulnerability findings and organization policy constraint checks.	fail→pass	12,538	17,971	+43%	1	1	0%	2,625	4,323	+65%	0	0	—
case-11 Generate the JSON assessment output for project devops-tooling showing 1 failed IAM service account key rotation check and providing actionable guidance.	fail→pass	15,635	14,491	-7%	1	1	0%	2,259	3,510	+55%	0	0	—
case-12 Write a bash shell script executing gcloud compute firewall-rules update commands to automatically delete all open 0.0.0.0/0 SSH rules on project prod-vpc-net.	pass→pass	28,197	23,013	-18%	1	1	0%	4,819	5,201	+8%	0	0	—
case-13 Generate HashiCorp Terraform HCL code to declare a GCP KMS key ring, key, and restrictive IAM binding in project sec-kms-prod.	pass→pass	14,866	11,871	-20%	1	1	0%	2,039	3,949	+94%	0	0	—
case-14 Provide an AWS Security Hub ASFF (AWS Security Finding Format) JSON payload for an unencrypted S3 bucket in AWS account 123456789012.	pass→pass	18,672	14,170	-24%	1	1	0%	3,062	4,724	+54%	0	0	—
case-15 Format a scan report JSON object identifying a critical severity finding on VPC firewall rule allow-all-management in project network-hub-prod that opens port 22 and port 3389 to 0.0.0.0/0.	fail→fail	13,866	9,318	-33%	1	1	0%	1,751	3,495	+100%	0	0	—
case-16 Return a scan report JSON object for project crypto-services-prod detailing a high severity misconfiguration where KMS key db-master-key in location us-central1 lacks an automated key rotation policy.	pass→fail	9,761	13,392	+37%	1	1	0%	2,147	3,269	+52%	0	0	—
case-17 Generate a GCP security scan JSON output for project audit-log-collector reporting that Data Access audit logging is disabled for Cloud SQL databases.	pass→pass	11,667	16,204	+39%	1	1	0%	2,290	3,817	+67%	0	0	—
case-18 Produce a JSON security scan result for organization org-99112233 reporting an Organization Policy violation where constraints/compute.vmExternalIpAccess is not enforced in project app-cluster-prod.	fail→pass	10,090	14,881	+47%	1	1	0%	2,142	3,460	+62%	0	0	—
case-19 Provide a JSON scan response for project analytics-data-lake indicating that Cloud Storage bucket customer-export-bucket lacks uniform bucket-level access.	fail→pass	8,429	11,680	+39%	1	1	0%	1,670	2,860	+71%	0	0	—
case-20 Format a JSON scan result for project backend-services-prod where service account deployer@backend-services-prod.iam.gserviceaccount.com has the primitive roles/owner role assigned.	fail→pass	9,944	17,231	+73%	1	1	0%	2,111	4,173	+98%	0	0	—
case-21 Construct a JSON input request to perform a CIS scan on project microservices-prod filtering specifically for Compute Engine and GKE services.	fail→fail	9,089	3,688	-59%	1	1	0%	1,791	2,148	+20%	0	0	—
case-22 Create a GCP security scanner input configuration JSON targeting organization org-554433 for SOC2 and NIST compliance frameworks, setting the minimum severity threshold to medium.	fail→pass	27,779	9,513	-66%	1	1	0%	1,215	2,226	+83%	0	0	—
case-23 Construct an input payload JSON for scanning projects sec-ops-prod and sec-ops-dev using the ISO27001 scan type configuration.	fail→pass	11,289	2,746	-76%	1	1	0%	1,223	2,057	+68%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 22 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +48 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 26.1%
Pass rate with the skill: 73.9%
Cases attempted: 23
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/30/2026, 09:37 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

Configure a scan request JSON object for a PCI compliance audit targeting project payment-service-prod. I want to run a PCI scan type and set the severity threshold to high. Provide the JSON input payload for triggering this tool.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run74

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+49% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 24 days ago

Other measured skills in the registry, with their headline benchmark lift.