# Gcloud

> Use for GCP control-plane validation during authorized pentests. Trigger on credentialed Google Cloud review, project and IAM scope checks, storage exposure review, and verifying what an approved identity can access.

- Skill: `timsonner/gcloud` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/gcloud`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/gcloud/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/gcloud

---


# gcloud

## Purpose

Use this skill for tightly scoped GCP control-plane validation with approved account or service-account access.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to confirm the effective scope of an approved GCP identity.
- Need to inspect projects, IAM posture, or exposed resources.
- Need a low-impact retest after GCP remediation.

## Avoid When

- Project or identity boundaries are unclear.
- Commands would change state without explicit approval.

## Inputs

- Approved project or organization scope
- Authorized account or service account
- Read-only versus mutating boundaries

## Procedure

1. Confirm the active account and project context.
2. Query only the services relevant to the current hypothesis.
3. Keep validation read-oriented unless stronger actions are explicitly approved.
4. Tie material exposure to project and business context.
5. Preserve the exact project and identity scope for retest.

## Command Syntax

Replace sample projects and resources with approved in-scope values.

```bash
# Authenticate
gcloud auth login

# List authenticated accounts
gcloud auth list

# Get current project
gcloud config get-value project

# List all projects
gcloud projects list

# List GCS buckets
gcloud storage buckets list

# List bucket contents
gcloud storage ls gs://contoso-prod-backup --project contoso-prod

# List Compute Engine instances
gcloud compute instances list

# Get IAM policy for a project
gcloud projects get-iam-policy contoso-prod

# List service accounts
gcloud iam service-accounts list

# Access a Secret Manager secret
gcloud secrets versions access latest --secret=db-password
```

## Evidence to Capture

- Effective GCP identity and project scope
- Material resource exposure or IAM boundary issues
- Exact project and account context used

## Safety Boundaries

- Default to read-only validation.
- Do not create, modify, or delete resources without explicit written approval.