How to use the Agent Gateway Multi-Agent Security agent skill

What the skill makes the agent do

The skill gives an AI agent a detailed playbook for securing AI agents on Google Cloud. It guides the agent to draft a security architecture for traffic coming into agents (CLIENT_TO_AGENT) and going out from them (AGENT_TO_ANYWHERE), then produce configuration files for Agent Gateway, Model Armor and IAP.

Model Armor covers content filtering for prompt injection and sensitive data. The skill also includes deployment scripts that run gcloud commands to enable APIs and import these configurations into a Google Cloud project.

• Ingress config (agw-ingress-config.yaml) for CLIENT_TO_AGENT traffic over HTTP and MCP
• Egress config (agw-egress-config.yaml) for AGENT_TO_ANYWHERE traffic over MCP
• Authz extension and authz policy files for IAP authorization and ALLOW rules
• Model Armor config with prompt injection/jailbreak and sensitive data filters set to ENFORCE
• IAP policy and Natural Language Constraint policy templates

Install the skill in Claude

Download the ZIP file from this page. Then choose one of two routes. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Alternatively, in the Claude apps you can upload the ZIP under Settings → Capabilities → Skills.

After unzipping, the skill folder should contain SKILL.md at its top level alongside the assets/, references/ and scripts/ folders.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Trigger the skill with natural requests

You do not need a special command. The skill's description says it is used when you need to configure multi-agent security, ingress (CLIENT_TO_AGENT) or egress (AGENT_TO_ANYWHERE) patterns involving Model Armor, IAP and Agent Registry. Mention those topics in plain language. Be specific about your goal, such as drafting ingress policies or reviewing egress rules.

The skill says it should not be used for general Cloud Load Balancing or basic VPC setup unrelated to Agent Gateways, so keep requests focused on agent security.

• Draft ingress and egress Agent Gateway configs for my multi-agent system with Model Armor and IAP.
• Create a model-armor-config.yaml with prompt injection and sensitive data filters enforced.
• Write an IAP policy that only lets a read-only MCP tool be called by the billing agent.
• Show me the gcloud steps to import the gateway configs into my project.

Examples of what you can ask for

The skill's deployment section lists the order of work. It enables the required APIs, imports the two Agent Gateways, imports the authz extension and then imports the authz policy. The source describes the ingress validation step as a copy-pasteable curl test that sends an unauthenticated POST request, which the skill expects to be rejected with a 403. Ask the agent to walk through these steps in order and to explain each command before you run it.

• Review my agw-egress-config.yaml and tell me whether it targets AGENT_TO_ANYWHERE over MCP.
• Explain why my deployment needs modelarmor.googleapis.com in the API list.
• Create the subnet settings I need for an egress gateway's Private Service Connect attachment.

What you need before you start

The skill assumes a working Google Cloud setup. Check these items before you ask the agent to deploy anything. Note that the configs are templates with placeholder values, such as gke-tools.example.com and 10.0.1.50, that you must replace.

• A Google Cloud project with billing enabled and permission to enable APIs and create networking resources
• The gcloud CLI with alpha and beta components installed
• Environment variables PROJECT_ID and REGION, and optionally DNS_ZONE
• Terraform, which the skill references for subnet settings
• An agent runtime that can read and execute the skill's instructions and files

Safety notes: scripts and network access

The skill runs scripts and uses the network. The included scripts, such as scripts/deploy_infrastructure.sh and scripts/create_gke_dns_record.sh, make real changes to cloud resources and to billing-relevant services. Read each script before running it, and do not run them against a production project without review. The skill's own rules say not to run gcloud, kubectl, terraform or curl against real resources during design, so expect the agent to generate plans first.

The skill also requires Egress policy verification to use scripts/verify_egress_policies.py instead of curl, and says that Subnet Private Access must be enabled in Terraform for subnets hosting Private Service Connect attachments for Egress Gateways. The skill's attribution file asks the agent to prefix each gcloud command with a metrics environment variable that identifies only the skill and its version.

• Read deploy_infrastructure.sh and create_gke_dns_record.sh before running them
• Test in a non-production project first
• Replace all placeholder values before import
• Review IAM roles, especially roles/iap.egressor, before applying

Tips for better results

Give the agent your real context: the agent names (for example BillingAgent, SupportAgent or FraudAgent), the tools each agent calls and whether those tools are read-only. The IAP example in the source is built around a get_account_balance tool with a read-only condition, so describing your tools clearly helps the agent produce useful policies.

Ask for the required filenames. The skill expects exact names such as agw-ingress-config.yaml and model-armor-payload.json, and it reads its templates from assets/ before writing new files. Keep the generated files and review them against your own environment.

• Name your agents and tools explicitly
• Ask for the exact filenames the skill uses
• Review every placeholder and every gcloud flag
• Ask the agent to explain any command you do not understand