Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fmind/dot/gcloudnpx skills add fmind/dot --skill gcloudgit clone --depth 1 https://github.com/fmind/dotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fmind/dot/gcloud)<a href="https://agentmods.dev/skills/fmind/dot/gcloud"><img src="https://agentmods.dev/badge/skills/fmind/dot/gcloud.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00042 | $0.00745 |
| Opus 5 | $0.00021 | $0.00373 |
| Sonnet 5 | $0.00008 | $0.00149 |
| Haiku 4.5 | $0.00004 | $0.00075 |
Grade A, and why
gcloud scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Google Cloud CLI
Use gcloud for bounded account, project, IAM, API, billing, logging, and audit operations. cloud-run owns deployment, terraform-stack owns provisioned infrastructure, and incident-response owns a live outage.
Workflow
-
Resolve identity and scope: inspect the named configuration, account, project, and billing project; never activate another configuration just to make a command work.
gcloud config configurations list --format=json gcloud config configurations describe <configuration> --format=json gcloud config get auth/impersonate_service_account --configuration <configuration> gcloud config get auth/access_token_file --configuration <configuration> gcloud projects describe <project-id> --format=json -
Pin every consequential call: pass
--configuration,--account,--project, and--billing-project(plus--impersonate-service-accountfor an approved chain) so terminal defaults cannot redirect the operation. -
Start read-only: describe the resource, IAM policy, enabled services, billing linkage, quotas, and logs, bounded by project, resource, and time window.
-
Plan the mutation: state the resource, before and after state, permissions, cost or quota impact, rollback, and verification command; API enablement, IAM, billing, deletion, and production changes need explicit authority.
-
Apply minimally and verify: change only the named resource, then re-read it and its operation or audit status; separate local configuration, accepted request, completed operation, and user-visible outcome.
Gotchas
--quietis not authority: it suppresses prompts; it neither makes an operation safe nor approves it.- Overrides replace the account:
CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT,CLOUDSDK_AUTH_ACCESS_TOKEN_FILE, and--impersonate-service-accountchange the effective principal; prove which is active first. - Failures are findings: on an auth, permission, or quota error report the missing principal, denied permission, or exhausted quota; do not switch configurations, broaden IAM, create keys, or move spend to another project.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 47 lines · 42 tokens per session scan A 093d8c11dd72
gcloud is a skill published in the GitHub repository fmind/dot (4 stars, last pushed today), licensed MIT. It adds 42 tokens to every session and 745 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
cloud-run
Deploy container services to Google Cloud Run with Artifact Registry, keyless CI identity, Secret Manager, ko, or Dockerfiles.
google-cloud-operations
Operate Google Cloud with gcloud: pin account, configuration, project, and billing context for IAM, APIs, logs, and audits outside deployment.
terraform-stack
Canonical infrastructure-as-code stack — OpenTofu-first with tflint, trivy config scans, terraform-docs, native tests, and GCS state. Use for any Terraform or OpenTofu work.
go-stack
Build Go projects, libraries, CLIs, TUIs, web apps, or ADK agents with the standard package layout and pinned tooling.
python-stack
Build typed Python projects with uv, Ruff, ty, pytest, Litestar, and Typer. Use for packages, CLIs, web apps, tests, typing, or API verification.
k8s-local
Create and manage local Kubernetes clusters (k3d or kind) and deploy to them with kubectl, helm, helmfile, and skaffold. Use for local k8s cluster setup, dev loops, and debugging.