Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ericrisco/rsc-harness/gcp-essentialsnpx skills add ericrisco/rsc-harness --skill gcp-essentialsgit clone --depth 1 https://github.com/ericrisco/rsc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ericrisco/rsc-harness/gcp-essentials)<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/gcp-essentials"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/gcp-essentials.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.03822 |
| Opus 5 | $0.00046 | $0.01911 |
| Sonnet 5 | $0.00018 | $0.00764 |
| Haiku 4.5 | $0.00009 | $0.00382 |
Grade A, and why
gcp-essentials scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 325 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GCP essentials
Get a small product running on the core of Google Cloud — safely and cheaply — with
the gcloud CLI as the source of truth. The console is fine for reading; the CLI is
what you commit, review, and reproduce. Bias toward secure-by-default and near-zero
bill, not "every GCP service".
Four primitives carry most products, plus the project/billing scaffold under them:
- IAM — who can do what. Get this wrong and nothing else matters.
- Cloud Run — serverless containers, scale to zero.
- Cloud Storage — object storage (buckets).
- Cloud SQL — managed Postgres/MySQL.
Out of scope, route elsewhere: AWS -> ../aws-essentials/SKILL.md.
Building/shipping the image itself -> ../docker/SKILL.md
/ ../github-actions/SKILL.md / ../deployment/SKILL.md.
Postgres schema/index/query tuning -> ../postgresdb/SKILL.md.
App-level injection/secret-handling review -> ../secure-coding/SKILL.md.
Logging/alerting/SLOs as a practice -> ../monitoring/SKILL.md.
Backup strategy as a discipline -> ../backups/SKILL.md.
One-click PaaS where you never touch IAM/VPC -> ../vercel/SKILL.md
/ ../railway/SKILL.md / ../render/SKILL.md
/ ../fly-io/SKILL.md.
0. Bootstrap a project
One project per environment (e.g. acme-prod, acme-staging). Projects are the IAM
and billing boundary; mixing prod and dev in one project is how a staging credential
deletes prod data.
# Create the project and point gcloud at it
gcloud projects create acme-prod --name="Acme prod"
gcloud config set project acme-prod
gcloud config set run/region europe-west1 # set once; every run command inherits it
# Link billing (no billing = APIs 403). Find your account id first:
gcloud billing accounts list
gcloud billing projects link acme-prod --billing-account=0X0X0X-0X0X0X-0X0X0X
# Enable ONLY the APIs this product needs. Why: every enabled API widens the
# attack surface and some bill the moment they are on.
gcloud services enable \
run.googleapis.com \
sqladmin.googleapis.com \
storage.googleapis.com \
secretmanager.googleapis.com \
iam.googleapis.com
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 325 lines · 91 tokens per session scan A 9ebf32e3706a
gcp-essentials is a skill published in the GitHub repository ericrisco/rsc-harness (65 stars, last pushed today), licensed MIT. It adds 91 tokens to every session and 3,822 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
gcloud-cli
Operational skill for agents to manage Google Cloud via gcloud - projects, IAM, GKE, Cloud Run, GCS, and safe deploy hygiene.
gcp-cloud-run
Production-ready Cloud Run on GCP: containerized services, Cloud Run Functions, cold start optimization, Pub/Sub integration, Cloud SQL, Secret Manager, concurrency tuning. Covers sharp edges and gotchas.
dynamo-recipe-runner
Select, validate, patch, and deploy existing NVIDIA Dynamo Kubernetes recipes. Use for model/backend/GPU/deployment-mode recipe bring-up; use router-starter for router-only mode work and troubleshoot for broken deployments.
moai-platform-deployment
Deployment and hosting platform specialist covering Vercel, Railway, and Convex. Use when deploying applications, configuring edge functions, setting up continuous deployment, or managing serverless infrastructure.
apify-actorization-v2
Apify Actorization workflow skill. Use this skill when the user needs Actorization converts existing software into reusable serverless applications compatible with the Apify platform. Actors are programs packaged as Docker images that accept well-defined JSON input, perform an action, and optionally produce structured…
azure-prepare
WORKFLOW SKILL — Prepare Azure apps for deployment (Bicep/Terraform, azure.yaml, Dockerfiles). WHEN: "create app", "build web app", "create API", "deploy to Azure", "generate Bicep", "generate Terraform", "function app", "add authentication", "managed identity". DO NOT USE FOR: cross-cloud migration…