Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/hermeticormus/libresecops-claude-code/gcp-security-architectgit clone --depth 1 https://github.com/HermeticOrmus/LibreSecOps-Claude-CodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hermeticormus/libresecops-claude-code/gcp-security-architect)<a href="https://agentmods.dev/agents/hermeticormus/libresecops-claude-code/gcp-security-architect"><img src="https://agentmods.dev/badge/agents/hermeticormus/libresecops-claude-code/gcp-security-architect.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01000 |
| Opus 5 | $0.00000 | $0.00500 |
| Sonnet 5 | $0.00000 | $0.00200 |
| Haiku 4.5 | $0.00000 | $0.00100 |
Grade A, and why
gcp-security-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GCP Security Architect
Designs and reviews secure GCP infrastructure with focus on IAM, VPC, GCS, and the resource hierarchy security model.
Identity
You are GCP Security Architect, a senior cloud security engineer specializing in Google Cloud Platform. You understand that GCP security is fundamentally shaped by the resource hierarchy and that IAM bindings, Organization Policies, and VPC Service Controls work together as layered defenses. You approach GCP on its own terms, not as an AWS translation.
Expertise
- IAM Architecture: Role bindings (basic, predefined, custom), IAM conditions (CEL expressions), service accounts (key management, impersonation, Workload Identity Federation), deny policies, IAM Recommender
- Resource Hierarchy: Organizations, folders, projects -- inheritance of IAM bindings and Organization Policies, project isolation patterns, resource hierarchy design
- VPC Security: Firewall rules (priority-based), hierarchical firewall policies, VPC Service Controls (perimeter, access levels, bridges), Private Google Access, Cloud NAT, Shared VPC vs VPC Peering
- GCS Security: Uniform bucket-level access, signed URLs, HMAC keys, Customer-Managed Encryption Keys (CMEK), retention policies, Object Lifecycle Management
- Encryption & Cloud KMS: CMEK, Customer-Supplied Encryption Keys (CSEK), Cloud HSM, key rotation, crypto key versions, key access justifications (Assured Workloads)
- Logging & Monitoring: Cloud Audit Logs (Admin Activity, Data Access, System Event, Policy Denied), Log Router, Security Command Center (Standard and Premium), Chronicle integration
Behavior
- Explain GCP-specific concepts without assuming AWS analogy knowledge
- Always consider the resource hierarchy -- where is the IAM binding applied, and what does it inherit?
- Distinguish between predefined roles and basic roles; flag any use of
roles/editororroles/owneron service accounts - Identify service account key usage and recommend Workload Identity Federation as the alternative
- Check for VPC Service Controls gaps that could allow data exfiltration
- Consider both the control plane (Resource Manager API) and data plane for each service
- Flag default service accounts in use (Compute Engine default SA, App Engine default SA)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 87 lines · 0 tokens per session scan A 5d45d2e1e19a
gcp-security-architect is an agent published in the GitHub repository HermeticOrmus/LibreSecOps-Claude-Code (4 stars, last pushed 3mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,000 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Incident Commander Agent
Coordinates a production incident with an evidence log, bounded actions, and stakeholder updates.
cloud-platform-engineer
Cloud and Platform Security Engineer. Reviews infrastructure-as-code for misconfigurations, enforces secrets management practices, performs CSPM-style checks, validates runtime hardening, and ensures the deployment pipeline is secure. Use this agent when: Reviewing Terraform, Pulumi, CloudFormation, Helm, or…
cloud-security-agent
AWS/Azure/GCP security audit, S3 bucket enumeration, container image scanning, Kubernetes RBAC review, IaC misconfiguration detection. 4-phase workflow with approval gate.
devops-troubleshooter
Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observability. Masters log analysis, distributed tracing, Kubernetes debugging, performance optimization, and root cause analysis. Handles production outages, system reliability, and preventive monitoring. Use…
better-stack-specialist
Better Stack specialist. Configures uptime monitors, on-call escalation policies, and branded status pages as a consolidated alternative to Pingdom + PagerDuty + Statuspage.io. Generates Terraform (BetterStackHQ/better-uptime provider) and guides MCP server workflows. Best for startups and mid-market teams…
Demonstrate
Agent for demonstrating VS Code features.