Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add EvilFreelancer/secs --skill investigating-gcp-incidentsgit clone --depth 1 https://github.com/EvilFreelancer/secsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evilfreelancer/secs/investigating-gcp-incidents)<a href="https://agentmods.dev/skills/evilfreelancer/secs/investigating-gcp-incidents"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/investigating-gcp-incidents/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/evilfreelancer/secs/investigating-gcp-incidents"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/investigating-gcp-incidents.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01562 |
| Opus 5 | $0.00051 | $0.00781 |
| Sonnet 5 | $0.00021 | $0.00312 |
| Haiku 4.5 | $0.00010 | $0.00156 |
Grade A, and why
investigating-gcp-incidents scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Investigating GCP Incidents
Google Cloud writes the intrusion into its audit logs. Cloud Audit Logs record who called which API on what resource, split into streams — Admin Activity (always on), Data Access (often off by default, and where read/exfil is proven), System Event, and Policy Denied. The attacker's path is usually identity: abusing a service account, minting a service-account key, or widening an IAM binding. The investigator reconstructs it from the logs, and the first job is to preserve them, because Data Access logs may not have been enabled and their retention is finite.
Confirm the project/organization is in scope per AGENTS.md. Note up front whether Data Access logging was enabled for the affected services — if it was not, read/exfil evidence may simply not exist, and that gap is itself a finding. This is read-only investigation; disabling keys or bindings is the operator's containment call.
When to Use
- A suspected GCP compromise where the evidence is Cloud Audit Logs
- Tracing IAM and service-account abuse, key creation, and impersonation
- Confirming data access or exfiltration from GCS and other services
- Finding cloud persistence (new bindings, keys) and log/sink tampering
- Building a GCP attack timeline for an incident
When NOT to Use
- On-host artifacts of a GCE instance — use
investigating-windows-endpoints(or acquire the disk/memory) - AWS or Azure — use
investigating-aws-incidentsorinvestigating-azure-incidents - Proactive search with no incident yet — use
hunting-threats - Offensive cloud testing — use
exploiting-cloud-platforms - Proactive hardening — use
hardening-cloud-posture - Running the whole incident — use
responding-to-incidents - Packaging IOCs into a product — use
producing-threat-intelligence
Preserve First
Export the relevant audit logs to a separate project or bucket before anything can be altered, and snapshot affected disks:
gcloud logging read \
'logName:"cloudaudit.googleapis.com" AND timestamp>="2026-08-01T00:00:00Z"' \
--project TARGET --format json > gcp_audit_$(date -u +%Y%m%d_%H%M%S).json
gcloud compute disks snapshot DISK --project TARGET --snapshot-names ir-DISK
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 119 lines · 103 tokens per session scan A f21260f836ec
investigating-gcp-incidents is a skill published in the GitHub repository EvilFreelancer/secs (10 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 103 tokens to every session and 1,562 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
auditing-gcp-iam-permissions
Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.
configuring-identity-aware-proxy-with-google-iap
Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.
building-red-team-c2-infrastructure-with-havoc
Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.
configuring-pfsense-firewall-rules
Configures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation, control traffic flow, and protect internal network zones in enterprise and small-to-medium business environments.
deploying-palo-alto-prisma-access-zero-trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
conducting-cloud-penetration-testing
This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF…