Guide · Agent skill

How to use the Workload Manager Basics agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

The Workload Manager Basics skill teaches an AI agent how to work with Google Cloud Workload Manager, a service that checks cloud projects against best-practice rules. This guide explains what an agent skill is, how to install this one, how to ask for its help in plain language, and what you need before it produces real results. After following it, you will be able to get an agent to list rules, define a scope, run an evaluation and read the findings.

Workload Manager Basicsgoogle/skills · Apache-2.0 Download the skill

Quick start

1Download the ZIP. Get the workload-manager-basics ZIP from the skill page on this site.
2Unzip into a skills folder. Extract it to ~/.claude/skills/ for personal use or to .claude/skills/ inside a project.
3Enable the Workload Manager API. Run gcloud services enable workloadmanager.googleapis.com --quiet in a project you control.
4Authenticate locally. Run gcloud auth application-default login so client libraries can use your credentials.
5Assign a least-privileged role. Start with roles/workloadmanager.viewer and add evaluation admin rights only when you need to create or run evaluations.
6Ask for what you need. Describe the outcome in plain language, such as listing SQL Server rules or reviewing violations from an evaluation.

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and reference material that an AI agent loads when a task matches it. This skill covers Workload Manager evaluations: you define a resource scope (project, folder, or organization), choose built-in or custom rules, run an evaluation, then inspect results and scanned resources.

Once installed, the agent knows how to list rules, create and run an evaluation, read the findings and optionally export results to BigQuery. It provides Python and REST examples and points to the IAM roles to use. It does not include scripts of its own.

Built-in rule sets covered in the source: Google Cloud general best practices, SAP, and SQL Server.
Custom organizational rules written in Rego.
Client library (Python and Go examples) and REST API usage.
Explicitly out of scope: routine Compute Engine instance management, VPC configuration and standard IAM auditing.

Install the workload-manager-basics skill

Download the ZIP from the skill page on this site, then unzip it into one of two locations. For a personal setup, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.

Personal install: unzip into ~/.claude/skills/
Project install: unzip into .claude/skills/ in your project root
Claude apps: Settings → Capabilities → Skills, then upload

Prepare Google Cloud before you run anything

The skill needs live access to Google Cloud for real results. Enable the Workload Manager API, then sign in locally with Application Default Credentials so client libraries can authenticate.

Grant the least-privileged role that fits the task. Start with the viewer role for read-only work, and use the evaluation admin or admin roles only when creating, updating, running or deleting evaluations.

Enable the API: gcloud services enable workloadmanager.googleapis.com --quiet
Sign in for client libraries: gcloud auth application-default login
Read-only role: roles/workloadmanager.viewer
Write roles: roles/workloadmanager.evaluationAdmin or roles/workloadmanager.admin
Python 3.9 or later for the Python client

gcloud services enable workloadmanager.googleapis.com --quiet
gcloud auth application-default login

Trigger the skill with natural requests

You do not need special syntax. Describe the outcome you want and mention Workload Manager, evaluations, rules or best practices. The skill is meant to trigger on requests like these, and it asks the agent to read its references before running gcloud, REST or MCP commands.

Phrase requests around the job, for example listing rules for a rule type, running a general best-practice evaluation on a project, or reviewing violations from a previous run.

List the SQL Server rules available in my project and summarise them.
Create and run a Workload Manager evaluation for general best practices on project PROJECT_ID.
Show me the violations from the last evaluation and suggest fixes.
Export the evaluation results to BigQuery.
Write a Python script that runs an SAP evaluation every week.

Run a first working example

The quick example below installs the Python client and lists rules for a project and location. Replace PROJECT_ID and LOCATION with your own values. Ask the agent to adapt it to your evaluation type if you need something other than OTHER.

If authentication or API calls fail, the skill tells the agent to explain the limitation and show the code or REST payload structure rather than retry in a loop.

python3 -m pip install --upgrade google-cloud-workloadmanager

from google.cloud import workloadmanager_v1

project_id = "PROJECT_ID"
location = "LOCATION"
parent = f"projects/{project_id}/locations/{location}"

client = workloadmanager_v1.WorkloadManagerClient()
rules = client.list_rules(
    request=workloadmanager_v1.ListRulesRequest(
        parent=parent,
        evaluation_type=workloadmanager_v1.Evaluation.EvaluationType.OTHER,
    )
)

for rule in rules.rules:
    print(rule.name, rule.display_name, rule.severity)

Safety notes: scripts, network and attribution

This skill runs no scripts of its own, but it does use the network, because real evaluations call the Workload Manager API. Any command the agent runs directly in the terminal is tagged with a usage attribution prefix that identifies the skill and its version and carries no user data. The skill says this tag should appear on gcloud commands and in the User-Agent header of direct REST calls, and that it should never be placed in generated scripts, Terraform or user code.

Review the commands an agent proposes before you approve them, especially any that change resources or grant roles.

Runs scripts: no
Uses network: yes, to call the Workload Manager API
Attribution tag is set inline per command, not with gcloud config set

Tips for getting good results

Start with a read-only task such as listing rules, then move to creating and running an evaluation once permissions are in place. Be specific about the evaluation type and scope so the agent does not guess. If a question goes beyond the skill, the skill directs the agent to the current Workload Manager documentation and client library reference.

Name the scope: project, folder or organization.
Name the evaluation type: general best practices, SAP, SQL Server or custom rules.
Ask for the BigQuery export only if you have a dataset set up for it.
Check the official documentation for fields the skill does not cover.

What people use it for

Listing built-in rules for SQL Server, SAP or general Google Cloud best practices before a migration review.
Creating and running a general best-practice evaluation across a project, folder or organization.
Reviewing violations from an evaluation and turning them into a remediation list.
Exporting evaluation results to BigQuery for reporting over time.
Writing custom Rego rules for organizational policy checks and running them as an evaluation.

Frequently asked questions

How do I install the workload-manager-basics skill?

Download the ZIP from the skill page on this site and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.

Is the workload-manager-basics skill free to use?

The skill is licensed under Apache-2.0, as listed on this page. Running real evaluations still requires a Google Cloud project with the Workload Manager API enabled, and the source notes that live API access requires billing.

What do I need before the skill can produce real results?

You need a Google Cloud project with the Workload Manager API enabled, gcloud authentication through Application Default Credentials, and IAM roles such as roles/workloadmanager.viewer. Python with the google-cloud-workloadmanager package or REST access with a token is also needed.

Does this skill run scripts on my computer?

No. The skill does not include scripts of its own. It does use the network, because evaluations call the Workload Manager API.

What is the difference between this skill and a Workload Manager CLI or MCP server?

The source says there is no public gcloud workload-manager command group and no documented public Workload Manager MCP server. The skill therefore works through the public Python and Go client libraries or the REST API, using gcloud only for authentication, IAM and API enablement.

What should I do if the agent gets 403 or 404 errors?

The skill tells the agent to stop retrying, explain the authentication or resource limitation, and present the correct client library code or REST payload structure. Common causes named in the source include missing API enablement, Context Aware Access token blocks, and missing permissions.

Does this skill manage Compute Engine instances or IAM audits?

No. The skill explicitly excludes routine Compute Engine instance management, VPC configuration and standard IAM auditing, and it does not cover quick security audits of IAM alone.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits cloud engineers who want an agent to automate Workload Manager evaluations, and teams checking general, SAP or SQL Server best practices across projects. It is a poor fit if you have no Google Cloud project or permissions, or if you need instance management, VPC setup or a pure IAM audit.

Download the skill