Guide · Agent skill
How to use the GCP IAM Permissions Auditor agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The auditing-gcp-iam-permissions skill gives an AI agent a structured method for reviewing who and what can access a Google Cloud organization or project. It is aimed at cloud security engineers preparing access reviews, DevOps teams trying to limit the damage from leaked service account credentials, and developers who want a checklist for over-permissioned accounts in their own project. After this guide you will know how to install the skill, ask for an audit in plain language, and read what the agent reports back.
GCP IAM Permissions Auditormukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Set up Google Cloud access. Confirm you have roles/iam.securityReviewer and roles/cloudAsset.viewer, and that the Cloud Asset, IAM Recommender and Policy Analyzer APIs are enabled.
- 3Authenticate gcloud. Make sure the gcloud CLI is installed and logged in with an account that has the required access.
- 4Make a scoped request. Ask the agent to audit a named organization or project and state that you are authorised to review it.
- 5Review the workflow output. Let the agent run the enumeration, service account, Recommender and Policy Analyzer steps, then read the findings it reports.
- 6Verify before changing anything. Re-run the key queries yourself and test any suggested narrowing of permissions in a non-production project first.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file of instructions, plus optional reference files and scripts, that an AI agent such as Claude can load when a task matches it. This skill is named auditing-gcp-iam-permissions and comes from the Apache-2.0 licensed mukul975/Anthropic-Cybersecurity-Skills collection.
Once installed, the agent follows a six-step workflow: enumerate IAM bindings across the organization, audit service accounts and their keys, use IAM Recommender to find excess permissions, analyze effective permissions with Policy Analyzer, check for domain-wide delegation and impersonation risks, then generate an audit report with remediation suggestions. It does not change anything by itself. The instructions are mainly read-only gcloud queries plus a Python helper.
- Finds bindings that use primitive roles such as Owner and Editor
- Flags service accounts with user-managed keys
- Finds resources open to allUsers or allAuthenticatedUsers
- Reviews IAM Recommender suggestions for removing unused access
- Reports findings and suggests how to narrow permissions
How do you install the skill?
Download the skill ZIP from the item page on this site and unzip it. For a personal setup, place the skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
After unzipping, the folder should contain SKILL.md, scripts/agent.py and references/api-reference.md. Start a new session so the agent can discover the skill.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
What do you need before running an audit?
The skill assumes a working Google Cloud setup. Check these before you ask for an audit, because the queries will fail without them. The source names the roles and APIs below; it does not give further setup detail, so consult Google's documentation for specifics.
- Python 3 with google-cloud-asset and google-cloud-resourcemanager, plus google-cloud-iam for the helper script
- gcloud CLI installed and authenticated
- Roles roles/iam.securityReviewer and roles/cloudAsset.viewer on the organization or project
- Cloud Asset API, IAM Recommender API and Policy Analyzer API enabled in the project
gcloud services enable cloudasset.googleapis.com
gcloud services enable recommender.googleapis.com
gcloud services enable policyanalyzer.googleapis.comHow do you trigger the skill with a natural request?
You do not need to type a command name. Describe the review you want in plain language and name the scope, such as an organization ID or project ID. The agent should match the request to the skill's description and follow its workflow.
Be specific about what you want checked. Scope matters: the queries read sensitive access data, so state the organization or project you are authorised to review.
- "Audit the IAM permissions in project my-app-prod for overly broad roles."
- "Find every service account in organization 123456789 that has a user-managed key."
- "Which resources in our GCP organization are open to allUsers?"
- "Check who can impersonate the deploy service account in project my-app-dev."
- "Review IAM Recommender suggestions for project my-app-dev and tell me which roles look unused."
What does the skill report, and what should you do with it?
The skill's final step is to generate an audit report and suggest remediation. Treat its output as findings to verify, not as changes to apply. The source says the skill includes IAM Recommender's mark-claimed command, which should only be run after review, and any permission change can break workloads.
Ask the agent to group findings by severity, cite the resource and member for each, and list the gcloud commands it used so you can re-run them yourself.
- Confirm each finding with the original query before acting on it
- Narrow roles in a test project before changing production
- Keep a record of what was reviewed for compliance evidence
What does the skill need to run, and what are the safety notes?
The skill runs scripts and uses the network. Its queries call Google Cloud APIs with your credentials, and the bundled scripts/agent.py helper is a Python file, so read it before running it. The skill is not meant for auditing VPC firewall rules, GKE RBAC, or real-time detection of IAM activity. For those, the skill itself points to other tools such as SCC Event Threat Detection.
Only run audits against organizations where you have authorisation and a clear scope. Read-only queries are still sensitive, and follow-up permission changes can break workloads.
- Runs scripts: yes (Python helper and gcloud commands)
- Uses network: yes (calls to Google Cloud APIs)
- Do not use for VPC firewall rules, GKE RBAC, or real-time IAM threat detection
What people use it for
- Preparing evidence for a compliance access review of a GCP organization
- Finding service accounts that hold Owner or Editor roles across projects
- Locating user-managed service account keys that should be rotated or removed
- Checking whether any storage bucket or resource is exposed to allUsers
- Reviewing IAM Recommender suggestions before narrowing a developer's project access
Frequently asked questions
How do I install the auditing-gcp-iam-permissions skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or .claude/skills/ inside a project. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills instead.
What do I need before the skill works?
You need Python 3 with the google-cloud-asset, google-cloud-resourcemanager and google-cloud-iam packages, an authenticated gcloud CLI, the roles roles/iam.securityReviewer and roles/cloudAsset.viewer, and the Cloud Asset, IAM Recommender and Policy Analyzer APIs enabled.
Is the skill free to use?
The source is licensed under Apache-2.0, as listed on this page. The source does not discuss pricing, so check the licence terms in the repository and any Google Cloud charges for the APIs you use.
Does the skill change my IAM permissions?
Not by itself. The instructions are mainly read-only gcloud queries plus a Python helper, and the agent reports findings and suggests changes. The source does include a mark-claimed command for IAM Recommender, which should only be run after you review a recommendation.
What is the alternative for VPC firewall or real-time IAM monitoring?
The skill says not to use it for VPC firewall rule auditing, GKE RBAC, or real-time IAM threat detection. For firewall rules use network security tools, for GKE RBAC use Kubernetes-specific RBAC tools, and for real-time detection use SCC Event Threat Detection.
Why does my audit fail or return no results?
Check the common causes listed in the requirements: missing roles, APIs that are not enabled, or gcloud not being authenticated. Also confirm the ORG_ID or PROJECT_ID you supplied is correct and that the Python packages are installed.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a cloud security engineer, platform team or developer who wants a guided, mostly read-only checklist for finding over-permissioned accounts, service account keys and public access in Google Cloud. Pick a different tool if you need firewall or GKE RBAC review, real-time IAM alerting, or if you cannot get authorisation for the scope you want to audit.
Download the skill