Borrowing it
Nothing to install: this file belongs to hoophq/hoop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hoophq/hoop/main/.claude/skills/gcp-marketplace-publish/SKILL.mdgit clone --depth 1 https://github.com/hoophq/hoopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hoophq/hoop/gcp-marketplace-publish)<a href="https://agentmods.dev/skills/hoophq/hoop/gcp-marketplace-publish"><img src="https://agentmods.dev/badge/skills/hoophq/hoop/gcp-marketplace-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hoophq/hoop/gcp-marketplace-publish"><img src="https://agentmods.dev/badge/skills/hoophq/hoop/gcp-marketplace-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01279 |
| Opus 5.5 | $0.00033 | $0.00512 |
| Sonnet 5.5 | $0.00017 | $0.00256 |
| Haiku 4.5 | $0.00008 | $0.00128 |
Grade A, and why
gcp-marketplace-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publish the sidecar to GCP Marketplace
On demand, not per release: after a Marketplace CVE notice, or when a release is worth showing. The listing is a showcase; keep it on a recent release.
Everything runs through scripts/gcp-marketplace/sidecar.sh (make targets
gcp-marketplace-sidecar-{setup,bundle,publish,test}). Read its header for
every setting. Do not reproduce its steps by hand.
Nothing here makes anything public. Publishing to customers is a Producer Portal action that only the operator takes.
0. Inputs
Ask the operator for anything missing; never guess these:
| Setting | Where it comes from |
|---|---|
VERSION |
The hoop release, e.g. 1.237.0. Must exist as hoophq/hoopsidecar:<VERSION>-distroless on Docker Hub |
SERVICE_NAME |
Producer Portal → Overview → the sidecar product → Service name |
CONSUMPTION_LABEL |
Producer Portal → Overview → Consumption tracking label (isol_plb32_...) |
GCP_PROJECT |
Default hoopdev-public, the partner project |
Tools: gcloud (logged in, with Artifact Registry, Storage and GKE rights on
the project), crane, go, helm, kubectl, zip, and terraform or tofu.
On Nix: nix-shell -p google-cloud-sdk crane kubernetes-helm kubectl zip opentofu go.
Check the release exists, and which Go built it, before anything else:
mkdir -p /tmp/hoop-img
crane export --platform linux/amd64 docker.io/hoophq/hoopsidecar:$VERSION-distroless - | tar -xf - -C /tmp/hoop-img app/hoop
go version /tmp/hoop-img/app/hoop # e.g. go1.26.8
Marketplace scans the image and rejects a release with any known
vulnerability, including Go standard library CVEs that cannot affect Linux.
If https://go.dev/doc/devel/release lists a newer patch release of that Go
with security fixes, stop: the repo's toolchain (go.work, go.mod) must be
raised and a new hoop release made first. Publishing anyway only fails the
scan two hours later.
1. Setup (first time per project only)
make gcp-marketplace-sidecar-setup
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 115 lines · 83 tokens per session scan A 395fa119fdef
gcp-marketplace-publish is a skill published in the GitHub repository hoophq/hoop (837 stars, last pushed today), licensed MIT. It adds 83 tokens to every session and 1,279 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
Other skills, from other repositories
imaging-data-commons
Query and download public cancer imaging data from NCI Imaging Data Commons using idc-index. Use for accessing large-scale radiology (CT, MR, PET) and pathology datasets for AI training or research. No authentication required. Query by metadata, visualize in browser, check licenses.
geo-database
Access NCBI GEO for gene expression/genomics data. Search/download microarray and RNA-seq datasets (GSE, GSM, GPL), retrieve SOFT/Matrix files, for transcriptomics and expression analysis.
brenda-database
Access BRENDA enzyme database via SOAP API. Retrieve kinetic parameters (Km, kcat), reaction equations, organism data, and substrate-specific enzyme information for biochemical research and metabolic pathway analysis.
clinpgx-database
Access ClinPGx pharmacogenomics data (successor to PharmGKB). Query gene-drug interactions, CPIC guidelines, allele functions, for precision medicine and genotype-guided dosing decisions.
gwas-database
Query NHGRI-EBI GWAS Catalog for SNP-trait associations. Search variants by rs ID, disease/trait, gene, retrieve p-values and summary statistics, for genetic epidemiology and polygenic risk scores.
string-database
Query STRING API for protein-protein interactions (59M proteins, 20B interactions). Network analysis, GO/KEGG enrichment, interaction discovery, 5000+ species, for systems biology.