# Google/Skills Best Practices: 8 Guidelines for Secure, Maintainable Agent Integration > Secure your google/skills agent integration with 8 best practices. Learn to use the installer, manage skills, and leverage plugin bridges for maintainable LLM applications. - Repository: [Google/skills](https://github.com/google/skills) - Tags: best-practices - Published: 2026-08-14 --- **Use the official `npx` installer, select only needed skills, treat skill files as immutable documentation, and leverage plugin bridges for your LLM harness to ensure stable, secure integration with the google/skills repository.** The **google/skills** repository provides reusable, Markdown-driven "Agent Skills" that enable AI agents to perform tasks on Google Cloud and related products. Following established best practices for google/skills ensures your environment remains secure, up-to-date, and aligned with Google's evolving recommendations. ## Install via the Official `npx` Command Always use the canonical installation path to guarantee version compatibility with your skill harness. ```bash npx skills add google/skills ``` This command, documented in [`README.md`](https://github.com/google/skills/blob/main/README.md), pulls the exact version packaged for your harness and eliminates manual cloning errors that can introduce configuration drift. ## Select Individual Skills During Installation The `npx` prompt allows you to pick only the skills you need. This practice: - **Minimizes bundle size** by excluding irrelevant capabilities - **Reduces surface area** for outdated documentation - **Keeps your skill set focused** on your specific workload Accept only what you need when the interactive selector appears. ## Treat Skill Files as Immutable Documentation Each skill's core logic lives in a [`SKILL.md`](https://github.com/google/skills/blob/main/SKILL.md) file alongside optional `references/`, `scripts/`, and `assets/` directories. Editing these files directly creates maintenance risk. **Do not modify published skills.** The repository is under active internal development; changes are vetted by Google teams. If you require custom behavior, fork the repository instead. The [`SKILL.md`](https://github.com/google/skills/blob/main/SKILL.md) specification in [`skills/cloud/google-cloud-recipe-auth/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/google-cloud-recipe-auth/SKILL.md) illustrates this immutable structure. ## Use Published Plugin Bridges for LLM Harnesses Each major LLM platform has a dedicated integration path that handles authentication, versioning, and runtime dependencies automatically. | Harness | Installation Command | |---------|-------------------| | **Claude** | `claude plugin marketplace add google/skills` then `claude plugin install google/skills@google-plugins` | | **Codex** | Similar plugin marketplace workflow | | **Antigravity CLI** | Corresponding CLI commands in `plugins/` directory | These bridges are maintained in the `plugins/` directory and provide seamless integration without manual configuration. ## Never Expose Secrets in Skill Definitions The google/skills repository follows strict security conventions: - Skills reference **Application Default Credentials (ADC)** and **service accounts** - No embedded keys or hardcoded credentials - Authentication patterns defined in [`skills/cloud/google-cloud-recipe-auth/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/google-cloud-recipe-auth/SKILL.md) Align with this policy to prevent accidental credential leakage in your environment. ## Report Issues Rather Than Patching Directly Contributions are gated to internal Google teams. If you encounter: - Stale SDK references - Security anti-patterns - Documentation errors Open an issue via the **GitHub Issue Tracker** as specified in [`CONTRIBUTING.md`](https://github.com/google/skills/blob/main/CONTRIBUTING.md). This ensures proper handling by repository owners and maintains public trust in the codebase. ## Stay Up-to-Date with Periodic Updates Skills evolve alongside Google Cloud releases. Re-run the installation command periodically: ```bash npx skills update google/skills ``` Newer versions contain updated best-practice guidance, security patches, and bug fixes. The [`README.md`](https://github.com/google/skills/blob/main/README.md) installation section documents this maintenance workflow. ## Leverage Reference Material for Deep Dives Each skill includes supplementary documentation in its `references/` directory. For example, [`skills/cloud/google-cloud-recipe-auth/references/client-library-usage.md`](https://github.com/google/skills/blob/main/skills/cloud/google-cloud-recipe-auth/references/client-library-usage.md) provides: - Detailed best-practice notes - Security guidance - Extended usage examples These files serve as authoritative sources without cluttering the main [`SKILL.md`](https://github.com/google/skills/blob/main/SKILL.md) narrative. ## Summary - **Install** with `npx skills add google/skills` for version-aligned packages - **Curate** your selection to match workload requirements - **Preserve** skill file integrity—fork rather than edit - **Integrate** via official plugin bridges for Claude, Codex, and Antigravity CLI - **Secure** credentials through ADC and service accounts, never embedded keys - **Report** issues through GitHub rather than submitting patches - **Update** regularly to capture latest Google Cloud guidance - **Reference** supplemental documentation for implementation details ## Frequently Asked Questions ### How do I install google/skills for the first time? Run `npx skills add google/skills` in your terminal. This executes the official installer, presents an interactive skill selector, and configures the selected skills for your harness. The process is documented in [`README.md`](https://github.com/google/skills/blob/main/README.md) and avoids the version mismatches common with manual cloning. ### Can I modify a skill file to suit my specific needs? No—treat skill files as immutable documentation. The repository is actively maintained by internal Google teams, and local edits quickly become out-of-sync with official guidance. Fork the repository if you require customized behavior, or submit a feature request through the GitHub Issue Tracker. ### What authentication method does google/skills recommend? Skills use **Application Default Credentials (ADC)** and **service account** patterns defined in [`skills/cloud/google-cloud-recipe-auth/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/google-cloud-recipe-auth/SKILL.md). No skill embeds actual credentials or keys. This approach aligns with Google Cloud security best practices and prevents accidental secret exposure in your codebase.