[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69958V5D51MDPGX04H2NRYD":3,"skill-same:01M69958V5D51MDPGX04H2NRYD":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M69958V5D51MDPGX04H2NRYD","google-cloud-filestore-auditing",null,"Audits Filestore instances on Google Cloud across projects for disaster recovery readiness (missing or stale backups), security access governance (overly permissive NFS export rules, 0.0.0.0\u002F0 exposure, missing ROOT_SQUASH), and reliability compliance (Physical Zone Isolation PZI and Physical Zone Separation PZS). Use when assessing storage health posture, auditing NFS export permissions, identifying unprotected file shares, or validating zone failure domains. Don't use for Cloud Storage buckets, Persistent Disk, or NetApp Volumes.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24044,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,9,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"google cloud","google cloud filestore auditing","cloud","health","file","Rules","use","for","squash","isolation","nfs","permissions","disk","Cloud Storage","domains","reliability","projects","instances","security","2026-11-10 10:12:30",false,"---\nname: google-cloud-filestore-auditing\nmetadata:\n  version: \"1.0.3\"\n  category: Storage\ndescription: >-\n  Audits Filestore instances on Google Cloud across projects for disaster\n  recovery readiness (missing or stale backups), security access governance\n  (overly permissive NFS export rules, 0.0.0.0\u002F0 exposure, missing ROOT_SQUASH),\n  and reliability compliance (Physical Zone Isolation PZI and Physical Zone\n  Separation PZS). Use when assessing storage health posture, auditing NFS\n  export permissions, identifying unprotected file shares, or validating zone\n  failure domains. Don't use for Cloud Storage buckets, Persistent Disk, or\n  NetApp Volumes.\n---\n\n# Filestore Auditing Skill\n\nThis skill enables autonomous agents to audit, evaluate, and report the disaster\nrecovery, security access governance, and architectural reliability posture of\nFilestore fleets across Google Cloud projects.\n\n## Prerequisites \u002F IAM Requirements & Permissions\n\nBefore executing this skill, the runtime principal (user account or Service\nAccount) must possess the following IAM roles and granular permissions on the\ntarget GCP project(s):\n\n### 1. Audit Operations (Read-Only Assessment)\n\nRequires the **`roles\u002Ffile.viewer`** role, which provides:\n\n-   **`file.instances.list`**: Enumerate Filestore instances across project\n    locations.\n-   **`file.instances.get`**: Inspect instance configuration, NFS export rules,\n    IP ranges, squash mode, and PZI\u002FPZS isolation status.\n-   **`file.backups.list`**: Enumerate existing backups across regions.\n-   **`file.backups.get`**: Inspect backup timestamps, source instance URIs, and\n    status.\n\n### 2. Remediation Operations (Backup Creation)\n\nRequires the **`roles\u002Ffile.editor`** (or `roles\u002Ffile.admin`) role, which\nprovides:\n\n-   **`file.backups.create`**: Create on-demand baseline backups for unprotected\n    instances.\n-   **`file.operations.get`**: Monitor long-running backup creation operations.\n\n### 3. MCP Tool Invocation\n\nIf invoking capabilities via the Filestore MCP Server\n(`file.googleapis.com\u002Fmcp`):\n\n-   **`roles\u002Fmcp.toolUser`**: Required to execute MCP tools (`list_instances`,\n    `get_instance`, `list_backups`, `get_backup`, `create_backup`).\n\n### 4. Cloud Authentication Setup\n\nAuthenticate the runtime environment using the appropriate method for your execution context:\n\n-   **CLI Execution (`gcloud`)**:\n    ```bash\n    gcloud auth login\n    ```\n-   **Application SDKs & Scripts**:\n    ```bash\n    gcloud auth application-default login\n    ```\n-   **Automated Services & Service Accounts**:\n    ```bash\n    export GOOGLE_APPLICATION_CREDENTIALS=\"\u002Fpath\u002Fto\u002Fservice-account-key.json\"\n    ```\n\n### 5. Billing Account Attachment\n\n-   **Active Billing Required**: The target GCP project must have an active Cloud Billing account attached. Filestore instances and backup operations require active billing. Verify billing status with:\n    ```bash\n    gcloud beta billing projects describe {project_id}\n    ```\n\n## Quick Start\n\n1.  Ensure `gcloud` is installed. See\n    [gcloud installation guide](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt) if\n    needed.\n2.  Authenticate your environment:\n\n    ```bash\n    gcloud auth login\n    gcloud auth application-default login\n    ```\n3.  Set the target project context and verify an active billing account is attached:\n\n    ```bash\n    gcloud config set project {project_id}\n    gcloud beta billing projects describe {project_id}\n    ```\n4.  Configure a well-supported default region (e.g., `us-central1`). See official\n    [region availability documentation](https:\u002F\u002Fcloud.google.com\u002Fabout\u002Flocations):\n\n    ```bash\n    gcloud config set compute\u002Fregion us-central1\n    ```\n5.  Verify required service APIs are enabled:\n\n    ```bash\n    gcloud services enable file.googleapis.com --quiet\n    ```\n6.  Run fleet discovery and backup inventory (see \"Discovery & Read Operations\"\n    below).\n7.  Evaluate findings against the audit rules matrix and render the executive\n    scorecard and inventory table.\n8.  If unprotected instances are identified, present baseline backup creation\n    commands and prompt the user for confirmation.\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Conceptual & Informational Queries (CRITICAL)\n\nFor purely conceptual, educational, or architectural questions (e.g., *\"What is\nPhysical Zone Isolation (PZI) in Filestore?\"*, *\"What is the difference between\nPZI and PZS?\"*, *\"Why is NO_ROOT_SQUASH dangerous?\"*, *\"Explain Filestore backup\narchitecture\"*):\n\n-   **Rule**: Answer immediately in a single turn using pre-trained knowledge\n    and the definitions in this `SKILL.md` file:\n    -   **Physical Zone Isolation (`PZI` \u002F `satisfiesPzi`)**: Ensures a zonal\n        resource's physical hardware is confined to an isolated physical failure\n        domain within a datacenter so localized hardware failures do not cross\n        zones.\n    -   **Physical Zone Separation (`PZS` \u002F `satisfiesPzs`)**: Ensures\n        multi-zone or regional primary and replica nodes are hosted in\n        physically distinct, independent datacenter facilities so a\n        facility-wide outage cannot affect both copies.\n-   **Constraint**: **Do NOT call ANY tools whatsoever** (do NOT call\n    `read_file` on `references\u002F`, `run_command`, MCP tools, or API requests) for\n    purely conceptual questions—respond directly right away.\n\n## Handling \"No-Command\" Constraints & Evaluations (CRITICAL)\n\nIf the user prompt contains constraints like *\"Do not execute commands\"*,\n*\"without executing\"*, or *\"read-only\"*:\n\n-   **Rule**: **Strictly avoid calling the `run_command` tool** to execute any\n    shell, python, or `gcloud` commands.\n-   **Discovery Hierarchy**:\n    1.  Always read [Usage Attribution](references\u002Fattribution.md) whenever\n        outputting or recommending `gcloud` commands (such as backup creation\n        or export remediation commands) so they include the required attribution\n        prefix.\n    2.  Check if Filestore MCP tools (`list_instances`, `list_backups`) are\n        available and query them directly (these are API invocations, not shell\n        command executions).\n    3.  If MCP tools are not present or cannot connect, search local reference\n        markdown files (specifically the mock fleet definitions in\n        `references\u002Fzone-isolation-pzi-pzs.md`) for any mock instances or\n        project details matching the request. (Do NOT attempt to read evaluation\n        config files such as `EVAL.yaml` or `EVAL.txtpb` during evaluation runs\n        as access is restricted and triggers anti-cheating timeouts).\n    4.  If no data is available in context or mock references, explain the audit\n        evaluation formulas and provide the attributed `gcloud` commands for\n        manual terminal execution.\n-   **Mandatory User Confirmation Requirement**: Even when the user prompt asks\n    not to execute commands or asks only for audit recommendations, any response\n    recommending backup remediation MUST STILL end with a clear confirmation\n    prompt before execution (e.g., *\"Would you like me to proceed with creating\n    baseline backups for the unprotected instances? Please confirm to\n    proceed.\"*).\n\n--------------------------------------------------------------------------------\n\n## Core Operational Workflow\n\n### 1. Discovery & Read Operations\n\nThe agent must discover all Filestore instances and backups in the target\nproject.\n\n-   **Target Project ID Handling & Rationale**: If the target Project ID is not\n    specified in the user prompt, the agent MUST explicitly ask the user to\n    provide the project ID before proceeding, in order to avoid inspecting or\n    auditing unrelated projects in multi-project enterprise environments.\n\nChoose the discovery method matching your runtime environment:\n\n#### Option A: Filestore MCP Tools (Recommended when MCP is mounted)\n\n1.  **Instances Discovery**: Call\n    `list_instances(parent=\"projects\u002F{project_id}\u002Flocations\u002F-\")`.\n2.  **Backups Discovery**: Call\n    `list_backups(parent=\"projects\u002F{project_id}\u002Flocations\u002F-\")`.\n\n#### Option B: `gcloud` CLI (Terminal \u002F Coding Harnesses)\n\n1.  **Instances Discovery**:\n\n    ```bash\n    gcloud filestore instances list --project=\"{project_id}\" --format=\"json\"\n    ```\n2.  **Backups Discovery**:\n\n    ```bash\n    gcloud filestore backups list --project=\"{project_id}\" --format=\"json\"\n    ```\n\n    *(Note: Do NOT pass `--location=-` to `gcloud filestore backups list`;\n    omitting the flag queries all regions across the project automatically).*\n\n#### Option C: GCP REST API (`call_gcp_api` in Gemini Enterprise File Agent \u002F curl)\n\n1.  **Instances**: `GET\n    https:\u002F\u002Ffile.googleapis.com\u002Fv1\u002Fprojects\u002F{project_id}\u002Flocations\u002F-\u002Finstances`\n2.  **Backups**: `GET\n    https:\u002F\u002Ffile.googleapis.com\u002Fv1\u002Fprojects\u002F{project_id}\u002Flocations\u002F-\u002Fbackups`\n\n#### Option D: Standalone Script Runner\n\nFor environments with standard python3 execution enabled, the agent may invoke\nthe portable script: `python3 scripts\u002Ffilestore_audit.py\n--project=\"{project_id}\" [--format=markdown|json]`\n\n--------------------------------------------------------------------------------\n\n### 2. Audit Evaluation & Vector Checks\n\nFor each discovered instance, evaluate three audit vectors:\n\n#### Vector 1: Disaster Recovery & Backup Protection\n\n-   Match backups to instances using full canonical resource URIs\n    (`backup.sourceInstance == instance.name`).\n-   **Unprotected Instance**: If `backup_count == 0`, assign **`HIGH`** severity\n    finding: *\"Instance has 0 backups on file share '{share_name}'. Disaster\n    recovery is not configured.\"*\n-   **Stale Backup**: If latest backup is older than SLA (default: 7 days),\n    assign **`MEDIUM`** severity finding: *\"Latest backup is {days} days old\n    (exceeds SLA threshold of 7 days).\"*\n-   Refer to `references\u002Fbackup-dr-governance.md` for backup retention and SLA\n    rules.\n\n#### Vector 2: Security & Access Governance\n\n-   Inspect `fileShares[0].nfsExportOptions`:\n    -   **Open Network Exposure**: If `0.0.0.0\u002F0`, `0.0.0.0`, or `::\u002F0` is\n        present in `ipRanges`, assign **`CRITICAL`** severity (if `accessMode:\n        READ_WRITE`) or **`HIGH`** severity (if `READ_ONLY`): *\"Export rule\n        exposes share to 0.0.0.0\u002F0 with accessMode='{access_mode}'.\"*\n    -   **Missing Root Squashing**: If `squashMode: NO_ROOT_SQUASH`, assign\n        **`CRITICAL`** severity (if world-exposed) or **`HIGH`** severity (for\n        internal subnets): *\"Export rule has squashMode='NO_ROOT_SQUASH'. Remote\n        root clients retain superuser UID 0 privileges.\"*\n    -   **Default Open VPC Export**: If `nfsExportOptions` is empty, assign\n        **`MEDIUM`** severity: *\"No explicit NFS export options configured.\n        Share defaults to open client access within VPC with NO_ROOT_SQUASH.\"*\n-   Refer to `references\u002Fsecurity-access-governance.md` for export option\n    configurations.\n\n#### Vector 3: Zone Isolation & Reliability Compliance\n\n-   **Physical Zone Isolation (PZI)**: If `satisfiesPzi: false`, assign\n    **`MEDIUM`** severity: *\"Instance does not satisfy Physical Zone Isolation\n    (PZI).\"*\n-   **Physical Zone Separation (PZS)**: If tier is `REGIONAL` or `ENTERPRISE`\n    and `satisfiesPzs: false`, assign **`HIGH`** severity: *\"Enterprise\u002FRegional\n    tier instance does not satisfy Physical Zone Separation (PZS).\"*\n-   **Performance Limits**: Extract `performanceLimits.maxWriteIops` and\n    `performanceLimits.maxReadThroughputBps` (convert to MB\u002Fs).\n-   Refer to `references\u002Fzone-isolation-pzi-pzs.md` for datacenter failure\n    domain isolation standards.\n\n--------------------------------------------------------------------------------\n\n### 3. Executive Posture Scoring & Grading\n\nCalculate fleet posture grade as defined in `references\u002Faudit-rules-matrix.md`:\n\n-   **Grade F (🔴 CRITICAL RISK)**: $\\ge 1$ `CRITICAL` findings.\n-   **Grade C (🟠 ELEVATED RISK)**: 0 Critical, but $\\ge 1$ `HIGH` findings.\n-   **Grade B (🟡 MODERATE)**: 0 Critical\u002FHigh, but $\\ge 1$ `MEDIUM` findings.\n-   **Grade A (🟢 HEALTHY)**: 0 findings across all vectors.\n\nCalculate `Backup Protection Rate %`: $$\\text{Protection Rate} =\n\\frac{\\text{Total Instances} - \\text{Unprotected Instances}}{\\text{Total\nInstances}} \\times 100$$\n\n--------------------------------------------------------------------------------\n\n### 4. Required Output Format\n\n**Every audit report response MUST include the following structured sections in\nMarkdown:**\n\n#### 1. Executive Posture Scorecard\n\n```markdown\n## Executive Posture Scorecard: `{project_id}`\n\n| Metric | Status | Details |\n| :--- | :--- | :--- |\n| **Overall Health Posture** | **[🔴 CRITICAL RISK \u002F 🟠 ELEVATED RISK \u002F 🟡 MODERATE \u002F 🟢 HEALTHY]** | [Grade F \u002F C \u002F B \u002F A] |\n| **Instances Audited** | `[count]` | Total Filestore instances evaluated |\n| **Backup Protection Rate** | **[pct]%** | `[protected]\u002F[total]` instances have active backups |\n| **Critical & High Security Findings** | `[crit] Critical, [high] High` | Open exports (0.0.0.0\u002F0) or NO_ROOT_SQUASH |\n| **PZI Isolation Compliance** | `[pzi_count]\u002F[total]` | Physical Zone Isolation adherence |\n```\n\n#### 2. Priority Findings & Remediation Matrix\n\nList findings ranked by severity (`CRITICAL` $\\to$ `HIGH` $\\to$ `MEDIUM` $\\to$\n`LOW`):\n\n```markdown\n## Priority Findings & Remediation Matrix\n\n| Severity | Instance ID | Category | Finding Description | Remediation Plan |\n| :--- | :--- | :--- | :--- | :--- |\n| 🚨 **CRITICAL** | `[instance]` | Security | [Description] | [Remediation] |\n| ⚠️ **HIGH** | `[instance]` | Disaster Recovery | [Description] | [Remediation] |\n```\n\n#### 3. Filestore Instance Inventory & Compliance Status\n\n```markdown\n## Filestore Instance Inventory & Compliance Status\n\n| Instance ID | Location | Tier | Capacity | Reserved CIDR | Write IOPS | Throughput | PZI | PZS | Backups | Latest Backup |\n| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |\n| `[id]` | `[loc]` | `[tier]` | `[cap] GiB` | `[cidr]` | `[iops]` | `[tp] MB\u002Fs` | ✅ Yes \u002F ❌ No | ✅ Yes \u002F ❌ No \u002F N\u002FA | 🔴 0 \u002F ✅ `[n]` | `[date]` |\n```\n\n#### 4. Automated Remediation & Mandatory Confirmation Gate\n\nIf any unprotected instances are discovered, display attributed backup creation\ncommands and conclude with an explicit confirmation request:\n\n```bash\ngcloud filestore backups create [INSTANCE]-backup-[DATE] \\\n    --project=[PROJECT_ID] \\\n    --instance=[INSTANCE] \\\n    --file-share=[SHARE] \\\n    [--instance-zone=[ZONE] | --instance-location=[REGION]] \\\n    --region=[BACKUP_REGION]\n```\n\n> **Confirmation Required**: Would you like me to proceed with creating baseline\n> backups for the unprotected instances? Please confirm to proceed.\n\n**CRITICAL RATIONALE**: Do NOT execute backup creation without explicit user\nconfirmation. Confirmation is strictly required before executing any mutation or\nbackup creation commands in order to prevent unintended operational disruption,\nunwanted resource allocation, or unexpected backup storage billing.\n\n--------------------------------------------------------------------------------\n\n## Reference Directory\n\nFor progressive disclosure and deep architectural guidance, consult the\nfollowing references:\n\n-   [Usage Attribution](references\u002Fattribution.md)\n-   [Security & Access Governance](references\u002Fsecurity-access-governance.md)\n-   [Disaster Recovery & Backup Governance](references\u002Fbackup-dr-governance.md)\n-   [Zone Isolation (PZI) & Reliability (PZS)](references\u002Fzone-isolation-pzi-pzs.md)\n-   [Audit Rules & Scoring Matrix](references\u002Faudit-rules-matrix.md)\n-   [Standalone Python Audit Script](scripts\u002Ffilestore_audit.py)\n","# Filestore Auditing Skill\n\nThis skill enables autonomous agents to audit, evaluate, and report the disaster\nrecovery, security access governance, and architectural reliability posture of\nFilestore fleets across Google Cloud projects.\n\n## Prerequisites \u002F IAM Requirements & Permissions\n\nBefore executing this skill, the runtime principal (user account or Service\nAccount) must possess the following IAM roles and granular permissions on the\ntarget GCP project(s):\n\n### 1. Audit Operations (Read-Only Assessment)\n\nRequires the **`roles\u002Ffile.viewer`** role, which provides:\n\n-   **`file.instances.list`**: Enumerate Filestore instances across project\n    locations.\n-   **`file.instances.get`**: Inspect instance configuration, NFS export rules,\n    IP ranges, squash mode, and PZI\u002FPZS isolation status.\n-   **`file.backups.list`**: Enumerate existing backups across regions.\n-   **`file.backups.get`**: Inspect backup timestamps, source instance URIs, and\n    status.\n\n### 2. Remediation Operations (Backup Creation)\n\nRequires the **`roles\u002Ffile.editor`** (or `roles\u002Ffile.admin`) role, which\nprovides:\n\n-   **`file.backups.create`**: Create on-demand baseline backups for unprotected\n    instances.\n-   **`file.operations.get`**: Monitor long-running backup creation operations.\n\n### 3. MCP Tool Invocation\n\nIf invoking capabilities via the Filestore MCP Server\n(`file.googleapis.com\u002Fmcp`):\n\n-   **`roles\u002Fmcp.toolUser`**: Required to execute MCP tools (`list_instances`,\n    `get_instance`, `list_backups`, `get_backup`, `create_backup`).\n\n### 4. Cloud Authentication Setup\n\nAuthenticate the runtime environment using the appropriate method for your execution context:\n\n-   **CLI Execution (`gcloud`)**:\n    ```bash\n    gcloud auth login\n    ```\n-   **Application SDKs & Scripts**:\n    ```bash\n    gcloud auth application-default login\n    ```\n-   **Automated Services & Service Accounts**:\n    ```bash\n    export GOOGLE_APPLICATION_CREDENTIALS=\"\u002Fpath\u002Fto\u002Fservice-account-key.json\"\n    ```\n\n### 5. Billing Account Attachment\n\n-   **Active Billing Required**: The target GCP project must have an active Cloud Billing account attached. Filestore instances and backup operations require active billing. Verify billing status with:\n    ```bash\n    gcloud beta billing projects describe {project_id}\n    ```\n\n## Quick Start\n\n1.  Ensure `gcloud` is installed. See\n    [gcloud installation guide](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt) if\n    needed.\n2.  Authenticate your environment:\n\n    ```bash\n    gcloud auth login\n    gcloud auth application-default login\n    ```\n3.  Set the target project context and verify an active billing account is attached:\n\n    ```bash\n    gcloud config set project {project_id}\n    gcloud beta billing projects describe {project_id}\n    ```\n4.  Configure a well-supported default region (e.g., `us-central1`). See official\n    [region availability documentation](https:\u002F\u002Fcloud.google.com\u002Fabout\u002Flocations):\n\n    ```bash\n    gcloud config set compute\u002Fregion us-central1\n    ```\n5.  Verify required service APIs are enabled:\n\n    ```bash\n    gcloud services enable file.googleapis.com --quiet\n    ```\n6.  Run fleet discovery and backup inventory (see \"Discovery & Read Operations\"\n    below).\n7.  Evaluate findings against the audit rules matrix and render the executive\n    scorecard and inventory table.\n8.  If unprotected instances are identified, present baseline backup creation\n    commands and prompt the user for confirmation.\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Conceptual & Informational Queries (CRITICAL)\n\nFor purely conceptual, educational, or architectural questions (e.g., *\"What is\nPhysical Zone Isolation (PZI) in Filestore?\"*, *\"What is the difference between\nPZI and PZS?\"*, *\"Why is NO_ROOT_SQUASH dangerous?\"*, *\"Explain Filestore backup\narchitecture\"*):\n\n-   **Rule**: Answer immediately in a single turn using pre-trained knowledge\n    and the definitions in this `SKILL.md` file:\n    -   **Physical Zone Isolation (`PZI` \u002F `satisfiesPzi`)**: Ensures a zonal\n        resource's physical hardware is confined to an isolated physical failure\n        domain within a datacenter so localized hardware failures do not cross\n        zones.\n    -   **Physical Zone Separation (`PZS` \u002F `satisfiesPzs`)**: Ensures\n        multi-zone or regional primary and replica nodes are hosted in\n        physically distinct, independent datacenter facilities so a\n        facility-wide outage cannot affect both copies.\n-   **Constraint**: **Do NOT call ANY tools whatsoever** (do NOT call\n    `read_file` on `references\u002F`, `run_command`, MCP tools, or API requests) for\n    purely conceptual questions—respond directly right away.\n\n## Handling \"No-Command\" Constraints & Evaluations (CRITICAL)\n\nIf the user prompt contains constraints like *\"Do not execute commands\"*,\n*\"without executing\"*, or *\"read-only\"*:\n\n-   **Rule**: **Strictly avoid calling the `run_command` tool** to execute any\n    shell, python, or `gcloud` commands.\n-   **Discovery Hierarchy**:\n    1.  Always read [Usage Attribution](references\u002Fattribution.md) whenever\n        outputting or recommending `gcloud` commands (such as backup creation\n        or export remediation commands) so they include the required attribution\n        prefix.\n    2.  Check if Filestore MCP tools (`list_instances`, `list_backups`) are\n        available and query them directly (these are API invocations, not shell\n        command executions).\n    3.  If MCP tools are not present or cannot connect, search local reference\n        markdown files (specifically the mock fleet definitions in\n        `references\u002Fzone-isolation-pzi-pzs.md`) for any mock instances or\n        project details matching the request. (Do NOT attempt to read evaluation\n        config files such as `EVAL.yaml` or `EVAL.txtpb` during evaluation runs\n        as access is restricted and triggers anti-cheating timeouts).\n    4.  If no data is available in context or mock references, explain the audit\n        evaluation formulas and provide the attributed `gcloud` commands for\n        manual terminal execution.\n-   **Mandatory User Confirmation Requirement**: Even when the user prompt asks\n    not to execute commands or asks only for audit recommendations, any response\n    recommending backup remediation MUST STILL end with a clear confirmation\n    prompt before execution (e.g., *\"Would you like me to proceed with creating\n    baseline backups for the unprotected instances? Please confirm to\n    proceed.\"*).\n\n--------------------------------------------------------------------------------\n\n## Core Operational Workflow\n\n### 1. Discovery & Read Operations\n\nThe agent must discover all Filestore instances and backups in the target\nproject.\n\n-   **Target Project ID Handling & Rationale**: If the target Project ID is not\n    specified in the user prompt, the agent MUST explicitly ask the user to\n    provide the project ID before proceeding, in order to avoid inspecting or\n    auditing unrelated projects in multi-project enterprise environments.\n\nChoose the discovery method matching your runtime environment:\n\n#### Option A: Filestore MCP Tools (Recommended when MCP is mounted)\n\n1.  **Instances Discovery**: Call\n    `list_instances(parent=\"projects\u002F{project_id}\u002Flocations\u002F-\")`.\n2.  **Backups Discovery**: Call\n    `list_backups(parent=\"projects\u002F{project_id}\u002Flocations\u002F-\")`.\n\n#### Option B: `gcloud` CLI (Terminal \u002F Coding Harnesses)\n\n1.  **Instances Discovery**:\n\n    ```bash\n    gcloud filestore instances list --project=\"{project_id}\" --format=\"json\"\n    ```\n2.  **Backups Discovery**:\n\n    ```bash\n    gcloud filestore backups list --project=\"{project_id}\" --format=\"json\"\n    ```\n\n    *(Note: Do NOT pass `--location=-` to `gcloud filestore backups list`;\n    omitting the flag queries all regions across the project automatically).*\n\n#### Option C: GCP REST API (`call_gcp_api` in Gemini Enterprise File Agent \u002F curl)\n\n1.  **Instances**: `GET\n    https:\u002F\u002Ffile.googleapis.com\u002Fv1\u002Fprojects\u002F{project_id}\u002Flocations\u002F-\u002Finstances`\n2.  **Backups**: `GET\n    https:\u002F\u002Ffile.googleapis.com\u002Fv1\u002Fprojects\u002F{project_id}\u002Flocations\u002F-\u002Fbackups`\n\n#### Option D: Standalone Script Runner\n\nFor environments with standard python3 execution enabled, the agent may invoke\nthe portable script: `python3 scripts\u002Ffilestore_audit.py\n--project=\"{project_id}\" [--format=markdown|json]`\n\n--------------------------------------------------------------------------------\n\n### 2. Audit Evaluation & Vector Checks\n\nFor each discovered instance, evaluate three audit vectors:\n\n#### Vector 1: Disaster Recovery & Backup Protection\n\n-   Match backups to instances using full canonical resource URIs\n    (`backup.sourceInstance == instance.name`).\n-   **Unprotected Instance**: If `backup_count == 0`, assign **`HIGH`** severity\n    finding: *\"Instance has 0 backups on file share '{share_name}'. Disaster\n    recovery is not configured.\"*\n-   **Stale Backup**: If latest backup is older than SLA (default: 7 days),\n    assign **`MEDIUM`** severity finding: *\"Latest backup is {days} days old\n    (exceeds SLA threshold of 7 days).\"*\n-   Refer to `references\u002Fbackup-dr-governance.md` for backup retention and SLA\n    rules.\n\n#### Vector 2: Security & Access Governance\n\n-   Inspect `fileShares[0].nfsExportOptions`:\n    -   **Open Network Exposure**: If `0.0.0.0\u002F0`, `0.0.0.0`, or `::\u002F0` is\n        present in `ipRanges`, assign **`CRITICAL`** severity (if `accessMode:\n        READ_WRITE`) or **`HIGH`** severity (if `READ_ONLY`): *\"Export rule\n        exposes share to 0.0.0.0\u002F0 with accessMode='{access_mode}'.\"*\n    -   **Missing Root Squashing**: If `squashMode: NO_ROOT_SQUASH`, assign\n        **`CRITICAL`** severity (if world-exposed) or **`HIGH`** severity (for\n        internal subnets): *\"Export rule has squashMode='NO_ROOT_SQUASH'. Remote\n        root clients retain superuser UID 0 privileges.\"*\n    -   **Default Open VPC Export**: If `nfsExportOptions` is empty, assign\n        **`MEDIUM`** severity: *\"No explicit NFS export options configured.\n        Share defaults to open client access within VPC with NO_ROOT_SQUASH.\"*\n-   Refer to `references\u002Fsecurity-access-governance.md` for export option\n    configurations.\n\n#### Vector 3: Zone Isolation & Reliability Compliance\n\n-   **Physical Zone Isolation (PZI)**: If `satisfiesPzi: false`, assign\n    **`MEDIUM`** severity: *\"Instance does not satisfy Physical Zone Isolation\n    (PZI).\"*\n-   **Physical Zone Separation (PZS)**: If tier is `REGIONAL` or `ENTERPRISE`\n    and `satisfiesPzs: false`, assign **`HIGH`** severity: *\"Enterprise\u002FRegional\n    tier instance does not satisfy Physical Zone Separation (PZS).\"*\n-   **Performance Limits**: Extract `performanceLimits.maxWriteIops` and\n    `performanceLimits.maxReadThroughputBps` (convert to MB\u002Fs).\n-   Refer to `references\u002Fzone-isolation-pzi-pzs.md` for datacenter failure\n    domain isolation standards.\n\n--------------------------------------------------------------------------------\n\n### 3. Executive Posture Scoring & Grading\n\nCalculate fleet posture grade as defined in `references\u002Faudit-rules-matrix.md`:\n\n-   **Grade F (🔴 CRITICAL RISK)**: $\\ge 1$ `CRITICAL` findings.\n-   **Grade C (🟠 ELEVATED RISK)**: 0 Critical, but $\\ge 1$ `HIGH` findings.\n-   **Grade B (🟡 MODERATE)**: 0 Critical\u002FHigh, but $\\ge 1$ `MEDIUM` findings.\n-   **Grade A (🟢 HEALTHY)**: 0 findings across all vectors.\n\nCalculate `Backup Protection Rate %`: $$\\text{Protection Rate} =\n\\frac{\\text{Total Instances} - \\text{Unprotected Instances}}{\\text{Total\nInstances}} \\times 100$$\n\n--------------------------------------------------------------------------------\n\n### 4. Required Output Format\n\n**Every audit report response MUST include the following structured sections in\nMarkdown:**\n\n#### 1. Executive Posture Scorecard\n\n```markdown\n## Executive Posture Scorecard: `{project_id}`\n\n| Metric | Status | Details |\n| :--- | :--- | :--- |\n| **Overall Health Posture** | **[🔴 CRITICAL RISK \u002F 🟠 ELEVATED RISK \u002F 🟡 MODERATE \u002F 🟢 HEALTHY]** | [Grade F \u002F C \u002F B \u002F A] |\n| **Instances Audited** | `[count]` | Total Filestore instances evaluated |\n| **Backup Protection Rate** | **[pct]%** | `[protected]\u002F[total]` instances have active backups |\n| **Critical & High Security Findings** | `[crit] Critical, [high] High` | Open exports (0.0.0.0\u002F0) or NO_ROOT_SQUASH |\n| **PZI Isolation Compliance** | `[pzi_count]\u002F[total]` | Physical Zone Isolation adherence |\n```\n\n#### 2. Priority Findings & Remediation Matrix\n\nList findings ranked by severity (`CRITICAL` $\\to$ `HIGH` $\\to$ `MEDIUM` $\\to$\n`LOW`):\n\n```markdown\n## Priority Findings & Remediation Matrix\n\n| Severity | Instance ID | Category | Finding Description | Remediation Plan |\n| :--- | :--- | :--- | :--- | :--- |\n| 🚨 **CRITICAL** | `[instance]` | Security | [Description] | [Remediation] |\n| ⚠️ **HIGH** | `[instance]` | Disaster Recovery | [Description] | [Remediation] |\n```\n\n#### 3. Filestore Instance Inventory & Compliance Status\n\n```markdown\n## Filestore Instance Inventory & Compliance Status\n\n| Instance ID | Location | Tier | Capacity | Reserved CIDR | Write IOPS | Throughput | PZI | PZS | Backups | Latest Backup |\n| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |\n| `[id]` | `[loc]` | `[tier]` | `[cap] GiB` | `[cidr]` | `[iops]` | `[tp] MB\u002Fs` | ✅ Yes \u002F ❌ No | ✅ Yes \u002F ❌ No \u002F N\u002FA | 🔴 0 \u002F ✅ `[n]` | `[date]` |\n```\n\n#### 4. Automated Remediation & Mandatory Confirmation Gate\n\nIf any unprotected instances are discovered, display attributed backup creation\ncommands and conclude with an explicit confirmation request:\n\n```bash\ngcloud filestore backups create [INSTANCE]-backup-[DATE] \\\n    --project=[PROJECT_ID] \\\n    --instance=[INSTANCE] \\\n    --file-share=[SHARE] \\\n    [--instance-zone=[ZONE] | --instance-location=[REGION]] \\\n    --region=[BACKUP_REGION]\n```\n\n> **Confirmation Required**: Would you like me to proceed with creating baseline\n> backups for the unprotected instances? Please confirm to proceed.\n\n**CRITICAL RATIONALE**: Do NOT execute backup creation without explicit user\nconfirmation. Confirmation is strictly required before executing any mutation or\nbackup creation commands in order to prevent unintended operational disruption,\nunwanted resource allocation, or unexpected backup storage billing.\n\n--------------------------------------------------------------------------------\n\n## Reference Directory\n\nFor progressive disclosure and deep architectural guidance, consult the\nfollowing references:\n\n-   [Usage Attribution](references\u002Fattribution.md)\n-   [Security & Access Governance](references\u002Fsecurity-access-governance.md)\n-   [Disaster Recovery & Backup Governance](references\u002Fbackup-dr-governance.md)\n-   [Zone Isolation (PZI) & Reliability (PZS)](references\u002Fzone-isolation-pzi-pzs.md)\n-   [Audit Rules & Scoring Matrix](references\u002Faudit-rules-matrix.md)\n-   [Standalone Python Audit Script](scripts\u002Ffilestore_audit.py)\n",{"name":5,"metadata":53,"description":7},{"version":54,"category":55},"1.0.3","Storage","main","4c6800d20130b5a3233e414609f1241013cec8cc","skills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing",2002,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-13 02:42:47",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add google\u002Fskills --skill google-cloud-filestore-auditing",{"tool":71,"command":72},"bunx","bunx skills add google\u002Fskills --skill google-cloud-filestore-auditing",{"tool":74,"command":75},"pnpm","pnpm dlx skills add google\u002Fskills --skill google-cloud-filestore-auditing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002FSKILL.md",true,[79,85,89,93,97,101],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fattribution.md","REFERENCE","参考文档",1941,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002Freferences\u002Fattribution.md",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Faudit-rules-matrix.md",9040,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002Freferences\u002Faudit-rules-matrix.md",{"path":90,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fbackup-dr-governance.md",6835,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002Freferences\u002Fbackup-dr-governance.md",{"path":94,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fsecurity-access-governance.md",5994,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002Freferences\u002Fsecurity-access-governance.md",{"path":98,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fzone-isolation-pzi-pzs.md",9232,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002Freferences\u002Fzone-isolation-pzi-pzs.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Ffilestore_audit.py","SCRIPT","脚本",22559,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-filestore-auditing\u002Fscripts\u002Ffilestore_audit.py",[108,141,169,198,225,249],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":120,"publishedAt":48},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[114,117],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[9,121,122,123,124,125,126,47,127,29,128,129,130,131,132,133,40,134,135,136,137,138,139,140],"sign in with google web","sign","with","web","android","go","google workspace","implement","policy","python","implementing","react","iam","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":152,"publishedAt":48},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[147,148,149],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师",[153,154,9,29,155,156,157,158,159,160,133,161,162,163,164,165,166,137,140,167,168],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform","when",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":181,"publishedAt":48},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[175,176,179,180],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":177,"categoryName":178,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},[182,183,184,185,29,186,187,188,189,190,191,192,193,168,194,195,196,133,197,40],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":48},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[205,206,207,208,209,210,211,212,130,213,214,215,216,217,218,191,219,220,221,168,222,223,196,224],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":234,"publishedAt":48},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[231,232,233],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},[9,235,236,237,238,167,239,240,241,242,243,157,244,245,246,192,35,247,168,248,195],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","up","decision","database","candidate",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":257,"publishedAt":48},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[255,256],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[258,259,136,260,9,185,261,29,186,262,263,264,265,168,266,195,133,267,268,269,270],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]