# Operations Prohibited by the gcloud CLI Skill: Security Boundaries Explained > Discover the security boundaries of the gcloud CLI skill. Learn which gcloud operations are prohibited and understand its reference-only functionality. Explore essential security measures. - Repository: [Google/skills](https://github.com/google/skills) - Tags: security - Published: 2026-09-02 --- **The gcloud CLI skill is strictly prohibited from executing any gcloud commands and can only provide reference information, requiring users to manually run all commands themselves.** The **gcloud CLI skill** in the `google/skills` repository functions exclusively as a knowledge-base agent for Google Cloud Platform guidance. Unlike execution-based tools, this skill operates under a strict architectural contract that forbids any direct interaction with cloud resources. Understanding these prohibited operations is essential for developers building secure AI agents and for users who need to know why they must manually copy-paste every command. ## Core Prohibition: No Command Execution The foundational restriction is absolute: **the skill must never run gcloud commands**. According to [`skills/cloud/gcloud/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gcloud/SKILL.md), the skill "does not execute any gcloud CLI commands" under any circumstances. This prohibition exists because the skill lacks the context to verify user intent before triggering potentially destructive changes in live GCP environments. ### Resource Modification Restrictions Any operation that creates, updates, or deletes GCP resources is strictly forbidden. This includes: - **Compute Engine instances** – The skill cannot run `gcloud compute instances create` or similar lifecycle commands - **Cloud SQL databases** – Automated deletion or configuration changes through `gcloud sql instances delete` are blocked - **Storage buckets and objects** – Commands like `gcloud storage buckets create` remain purely informational - **Networking components** – Firewall rules, VPCs, and load balancers must be configured manually by the user These restrictions prevent accidental resource provisioning that could incur costs or disrupt production systems without explicit human confirmation. ### IAM and Authentication Limits The skill is prohibited from handling identity and access management operations that could compromise security posture: - **Modifying IAM policies** – Commands such as `gcloud projects add-iam-policy-binding` are explained but never executed - **Token generation** – The skill cannot invoke `gcloud auth print-access-token` or any credential-related commands - **Service account impersonation** – Automated authentication flows that generate temporary credentials are strictly off-limits This ensures that sensitive credential handling remains under direct user control, preventing privilege escalation through AI automation. ### Financial and Batch Operation Constraints Additional restrictions protect against unexpected billing and system overload: - **Charge-inducing operations** – Any command that could incur costs without explicit user approval is prohibited - **Batch automation** – Running scripts that invoke `gcloud` in loops or parallel execution modes is forbidden to prevent resource exhaustion and unintended side-effects - **Background processes** – The skill cannot daemonize or schedule recurring gcloud operations ## How the Skill Safely Handles Dangerous Operations Rather than executing commands, the skill implements **critical-instruction warnings** that mirror patterns found throughout the repository. ### Critical Warning Patterns The [`skills/cloud/spanner-basics/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/spanner-basics/SKILL.md) file demonstrates the required safety pattern: destructive commands are gated behind explicit user confirmation prompts. When discussing dangerous operations, the skill must output warnings formatted as: ```markdown > **CRITICAL:** The following command will delete a Cloud SQL instance. > Do you want to proceed? (yes/no) If you answer **yes**, run: ``` gcloud sql instances delete my-instance ``` ``` The skill itself never executes the deletion, even after confirmation. ### User Confirmation Workflows Safe interaction follows a three-step pattern: 1. **Explanation** – Describe what the command does and its potential impact 2. **Warning** – Display explicit CRITICAL notices for destructive actions 3. **Instruction** – Provide the exact command text for manual user execution This workflow appears consistently across related skills, including [`skills/cloud/agent-platform-endpoint-management/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/agent-platform-endpoint-management/SKILL.md), which contains similar "strictly prohibited from executing" notices for endpoint-management operations. ## Source Code Implementation The prohibition is enforced through documentation and system prompts defined in these key files: - **[`skills/cloud/gcloud/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/gcloud/SKILL.md)** – Core skill definition establishing the non-execution policy - **[`skills/cloud/spanner-basics/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/spanner-basics/SKILL.md)** – Reference implementation of CRITICAL warning patterns for destructive operations - **[`skills/cloud/agent-platform-endpoint-management/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/agent-platform-endpoint-management/SKILL.md)** – Extended example of execution restrictions in cloud management contexts - **[`plugins/cloud/google-cloud-developer/skills/gcloud/SKILL.md`](https://github.com/google/skills/blob/main/plugins/cloud/google-cloud-developer/skills/gcloud/SKILL.md)** – Plugin-specific reinforcement of the same architectural constraints Together, these files establish that the gcloud CLI skill helps users **understand** and **compose** commands, but **never runs them**. ## Summary - **Zero execution policy** – The gcloud CLI skill cannot and must not execute any gcloud commands, regardless of user requests - **Resource protection** – Creation, modification, or deletion of GCP resources, IAM policies, and project settings requires manual user execution - **Credential isolation** – Authentication flows and token generation remain strictly manual processes - **Safety patterns** – Critical warnings and confirmation prompts from files like [`skills/cloud/spanner-basics/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/spanner-basics/SKILL.md) provide templates for safe user guidance - **Manual execution required** – All commands are presented as formatted text for copy-paste execution only ## Frequently Asked Questions ### Can the gcloud CLI skill create a VM instance for me? No, the skill cannot create VM instances or any other GCP resources. It can provide the exact command syntax, such as `gcloud compute instances create my-vm --zone us-central1-a`, but you must copy and paste this command into your terminal to execute it manually. ### Why can't the gcloud skill authenticate to GCP automatically? Automatic authentication is prohibited because credential handling involves sensitive security operations. The skill may suggest running `gcloud auth login` or `gcloud auth application-default login`, but you must execute these commands yourself to maintain control over your credentials and access tokens. ### What happens if I ask the skill to delete a production database? The skill will refuse to execute the deletion and instead display a **CRITICAL** warning similar to patterns in [`skills/cloud/spanner-basics/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/spanner-basics/SKILL.md). It will explain the consequences and provide the command text (e.g., `gcloud sql instances delete production-db`) only after warning you that the operation is destructive, requiring you to manually run the command if you choose to proceed. ### Is the gcloud skill allowed to show me my current project configuration? Yes, displaying information and explaining configuration commands is permitted. The skill can describe how to view configurations using `gcloud config list` or `gcloud projects describe`, but it will not execute these commands to retrieve live data from your environment. You must run the informational commands yourself to see actual project state.