Operations Prohibited by the gcloud CLI Skill: Security Boundaries Explained

The gcloud CLI skill is strictly prohibited from executing any gcloud commands and can only provide reference information, requiring users to manually run all commands themselves.

The gcloud CLI skill in the google/skills repository functions exclusively as a knowledge-base agent for Google Cloud Platform guidance. Unlike execution-based tools, this skill operates under a strict architectural contract that forbids any direct interaction with cloud resources. Understanding these prohibited operations is essential for developers building secure AI agents and for users who need to know why they must manually copy-paste every command.

Core Prohibition: No Command Execution

The foundational restriction is absolute: the skill must never run gcloud commands. According to skills/cloud/gcloud/SKILL.md, the skill "does not execute any gcloud CLI commands" under any circumstances. This prohibition exists because the skill lacks the context to verify user intent before triggering potentially destructive changes in live GCP environments.

Resource Modification Restrictions

Any operation that creates, updates, or deletes GCP resources is strictly forbidden. This includes:

• Compute Engine instances – The skill cannot run gcloud compute instances create or similar lifecycle commands
• Cloud SQL databases – Automated deletion or configuration changes through gcloud sql instances delete are blocked
• Storage buckets and objects – Commands like gcloud storage buckets create remain purely informational
• Networking components – Firewall rules, VPCs, and load balancers must be configured manually by the user

These restrictions prevent accidental resource provisioning that could incur costs or disrupt production systems without explicit human confirmation.

IAM and Authentication Limits

The skill is prohibited from handling identity and access management operations that could compromise security posture:

• Modifying IAM policies – Commands such as gcloud projects add-iam-policy-binding are explained but never executed
• Token generation – The skill cannot invoke gcloud auth print-access-token or any credential-related commands
• Service account impersonation – Automated authentication flows that generate temporary credentials are strictly off-limits

This ensures that sensitive credential handling remains under direct user control, preventing privilege escalation through AI automation.

Financial and Batch Operation Constraints

Additional restrictions protect against unexpected billing and system overload:

• Charge-inducing operations – Any command that could incur costs without explicit user approval is prohibited
• Batch automation – Running scripts that invoke gcloud in loops or parallel execution modes is forbidden to prevent resource exhaustion and unintended side-effects
• Background processes – The skill cannot daemonize or schedule recurring gcloud operations

How the Skill Safely Handles Dangerous Operations

Rather than executing commands, the skill implements critical-instruction warnings that mirror patterns found throughout the repository.

Critical Warning Patterns

The skills/cloud/spanner-basics/SKILL.md file demonstrates the required safety pattern: destructive commands are gated behind explicit user confirmation prompts. When discussing dangerous operations, the skill must output warnings formatted as:

> **CRITICAL:** The following command will delete a Cloud SQL instance.  
> Do you want to proceed? (yes/no)

If you answer **yes**, run:

gcloud sql instances delete my-instance

The skill itself never executes the deletion, even after confirmation.

User Confirmation Workflows

Safe interaction follows a three-step pattern:

1. Explanation – Describe what the command does and its potential impact
2. Warning – Display explicit CRITICAL notices for destructive actions
3. Instruction – Provide the exact command text for manual user execution

This workflow appears consistently across related skills, including skills/cloud/agent-platform-endpoint-management/SKILL.md, which contains similar "strictly prohibited from executing" notices for endpoint-management operations.

Source Code Implementation

The prohibition is enforced through documentation and system prompts defined in these key files:

• skills/cloud/gcloud/SKILL.md – Core skill definition establishing the non-execution policy
• skills/cloud/spanner-basics/SKILL.md – Reference implementation of CRITICAL warning patterns for destructive operations
• skills/cloud/agent-platform-endpoint-management/SKILL.md – Extended example of execution restrictions in cloud management contexts
• plugins/cloud/google-cloud-developer/skills/gcloud/SKILL.md – Plugin-specific reinforcement of the same architectural constraints

Together, these files establish that the gcloud CLI skill helps users understand and compose commands, but never runs them.

Summary

• Zero execution policy – The gcloud CLI skill cannot and must not execute any gcloud commands, regardless of user requests
• Resource protection – Creation, modification, or deletion of GCP resources, IAM policies, and project settings requires manual user execution
• Credential isolation – Authentication flows and token generation remain strictly manual processes
• Safety patterns – Critical warnings and confirmation prompts from files like skills/cloud/spanner-basics/SKILL.md provide templates for safe user guidance
• Manual execution required – All commands are presented as formatted text for copy-paste execution only

Frequently Asked Questions

Can the gcloud CLI skill create a VM instance for me?

No, the skill cannot create VM instances or any other GCP resources. It can provide the exact command syntax, such as gcloud compute instances create my-vm --zone us-central1-a, but you must copy and paste this command into your terminal to execute it manually.

Why can't the gcloud skill authenticate to GCP automatically?

Automatic authentication is prohibited because credential handling involves sensitive security operations. The skill may suggest running gcloud auth login or gcloud auth application-default login, but you must execute these commands yourself to maintain control over your credentials and access tokens.

What happens if I ask the skill to delete a production database?

The skill will refuse to execute the deletion and instead display a CRITICAL warning similar to patterns in skills/cloud/spanner-basics/SKILL.md. It will explain the consequences and provide the command text (e.g., gcloud sql instances delete production-db) only after warning you that the operation is destructive, requiring you to manually run the command if you choose to proceed.

Is the gcloud skill allowed to show me my current project configuration?

Yes, displaying information and explaining configuration commands is permitted. The skill can describe how to view configurations using gcloud config list or gcloud projects describe, but it will not execute these commands to retrieve live data from your environment. You must run the informational commands yourself to see actual project state.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}