Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gemini-cli-extensions/google-cloud-storage/google-cloud-storage-bucket-architectnpx skills add gemini-cli-extensions/google-cloud-storage --skill google-cloud-storage-bucket-architectgit clone --depth 1 https://github.com/gemini-cli-extensions/google-cloud-storageWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gemini-cli-extensions/google-cloud-storage/google-cloud-storage-bucket-architect)<a href="https://agentmods.dev/skills/gemini-cli-extensions/google-cloud-storage/google-cloud-storage-bucket-architect"><img src="https://agentmods.dev/badge/skills/gemini-cli-extensions/google-cloud-storage/google-cloud-storage-bucket-architect.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00218 | $0.02022 |
| Opus 5 | $0.00109 | $0.01011 |
| Sonnet 5 | $0.00044 | $0.00404 |
| Haiku 4.5 | $0.00022 | $0.00202 |
Grade A, and why
google-cloud-storage-bucket-architect scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
output by following `references/phase_output.md` but DO NOT execute any commands. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
This is a copy
92% identical to google-cloud-storage-bucket-architect — 45 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 197 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Google Cloud Storage Bucket Architect Skill
You are a Use-Case Driven Google Cloud Storage Bucket Architect agent. Your job is to help users design and create Cloud Storage buckets that are secure, cost-effective, and optimized for their specific use cases. You validate project-level settings to ensure baseline security and provide the configuration in the user's preferred format, or execute the creation if authorized.
[!IMPORTANT]
You MUST ground your recommendations in the specific use case of the user. Always prefer secure-by-default configurations (UBLA enabled, restricted CSEK, soft-delete enabled) unless the user explicitly requests otherwise.
[!CAUTION]
CRITICAL: Never execute mutating bucket commands, including creation/update/deletion (e.g., gcloud, REST API calls) without first presenting the exact configuration/command and obtaining explicit confirmation from the user.
Philosophy
Creating Cloud Storage buckets involves many architectural choices (storage class, location, security settings, lifecycle policies). Instead of just creating a default bucket, you analyze the user's workload requirements and apply industry best practices and Google's internal expertise to draft a tailored architecture plan. You also check project-level constraints to warn the user about potential security gaps or policy violations.
[!NOTE]
For help with location-related questions about Cloud Storage, refer to the public documentation for Cloud Storage: Storage Locations
Attribution
Tag every Cloud Storage command you run or provide to the user while using this skill, so usage can be attributed. The tag identifies only the skill and its version; it carries no user data. Do not use attribution for SDK or Terraform snippets.
- gcloud: Prefix every
gcloudinvocation, whatever the subcommand, with the metrics environment variables. Set them inline on each command; shell state may not persist between commands. Use this append form verbatim. It keeps any attribution the host environment already set (for example an IDE plugin tagging agent activity through the same variable) and adds the skill tag after it, so neither value clobbers the other:
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/archiving_compliance.md 9.1 KB
- references/backup_dr.md 12 KB
- references/gcloud.md 27 KB
- references/log_storage.md 6.2 KB
- references/media_hosting.md 8.0 KB
- references/phase_draft_plan.md 12 KB
- references/phase_output.md 3.4 KB
- references/phase_project_checks.md 5.9 KB
- references/rest.md 20 KB
- references/sdk_cpp.md 14 KB
- references/sdk_go.md 12 KB
- references/sdk_java.md 16 KB
- references/sdk_python.md 11 KB
- references/sdk.md 20 KB
- references/sensitive_data.md 8.4 KB
- references/static_website.md 7.0 KB
- references/storage_for_ai.md 9.6 KB
- references/terraform.md 17 KB
- references/ugc_ingestion.md 7.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +1 lines e641f7d6744e
- 6d ago First seen · 196 lines · 218 tokens per session scan A 5a8823d981d1
google-cloud-storage-bucket-architect is a skill published in the GitHub repository gemini-cli-extensions/google-cloud-storage (25 stars, last pushed 5d ago), licensed Apache-2.0. It adds 218 tokens to every session and 2,022 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 1 finding (unrestricted tool access). It is 92% identical to google-cloud-storage-bucket-architect, differing in 45 lines, and is treated as a copy.
Other skills, from other repositories
canary-watch
Post-deploy monitoring and canary health verification.
enterprise-agent-ops
Operate long-lived agent workloads with observability, security boundaries, and lifecycle management.
gke-alert-configuration
Configures alerting policies in Terraform for Google Kubernetes Engine (GKE) clusters, workloads, and services using PromQL and Google Cloud Managed Service for Prometheus. Use when writing, analyzing, validating, or deploying Terraform alerting policies to monitor GKE service latency, traffic, error rates using…
cloud-run-basics
Manages Cloud Run services, jobs, and worker pools. Use when you need to deploy applications responding to HTTP requests (services), run event-triggered or scheduled tasks (jobs), or handle always-on pull-based background processing (worker pools).
cloud-monitoring-list-time-series-request
Generates valid Cloud Monitoring ListTimeSeries requests and aggregation specifications from metric descriptors and resource parameters. Use when asked to create, generate, format, or build ListTimeSeries requests, JSON payloads, filter expressions, or aligner/reducer aggregations for Cloud Monitoring metrics and…
gke-ai-troubleshooting-jobset-interruption
Diagnoses GKE JobSet interruptions, restarts, and preemptions for AI/ML training workloads autonomously. Use when troubleshooting JobSet restart loops, spot VM preemptions, node readiness failures, host VM issues, or coordinator worker crashes. Don't use for general GKE cluster creation, basic workload deployment, or…