workload-manager-basics
Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.
- Installs
- 7.1K
- Last 24h
- +52
- Trending rank
- #3257
- Security
- Pass
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/google/skills --skill workload-manager-basics- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads workload-manager-basics automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Workload Manager Basics
Workload Manager validates enterprise workloads against Google Cloud best practices and recommendations. The public client libraries are centered on evaluations: define a resource scope, choose built-in or custom rules, run an evaluation, then inspect results and scanned resources.
Attribution
MUST READ: Before executing any gcloud, REST API, or MCP command, you
MUST read Usage Attribution. For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix gcloud with
CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:workload-manager-basics)"
and append agent-skills/1.0 (skill:workload-manager-basics) to User-Agent headers.
Use This Flow
flowchart LR
Rules["List rules"] --> Eval["Create or update evaluation"]
Resources["Project, folder, or org scope"] --> Eval
Eval --> Run["Run evaluation"]
Run --> Results["Inspect evaluation results"]
Results --> Remediate["Remediate findings"]
Results --> Export["Optional BigQuery export"]
Core API Constraints
To ensure compatibility, security, and successful integration:
- Public Surface Only: You MUST strictly interact with Workload Manager
using the official public
google-cloud-workloadmanagerclient library or the public REST API (workloadmanager.googleapis.com/v1). - No Internal or Undocumented APIs: Do NOT attempt to use internal RPC protocols, private service backends, or undocumented discovery mechanisms. They are not supported for public integrations and will fail.
- No Service-Specific CLI: There is no public
gcloud workload-managerCLI command group. Usegcloudonly for authentication, IAM role assignment, and fetching raw REST tokens. - Sandbox Execution Robustness (Auth/Mock Fallbacks): When gcloud authentication or Workload Manager API calls fail in sandboxed or restricted environments (e.g., due to Context Aware Access token blocks, missing API enablement, or mock resources returning 404/403), immediately fall back to presenting example code and static findings from your references instead of entering retry loops. Present the correct client library code structure or REST API payload example, clearly explain the auth or resource limitation, and list typical rules or mock findings statically to satisfy the request.
Prerequisites
-
Enable the Workload Manager API:
gcloud services enable workloadmanager.googleapis.com --quiet -
Authenticate locally using Application Default Credentials (ADC) before using client libraries:
gcloud auth application-default login -
Ensure the Workload Manager service agent has the required roles granted in your project (mandatory for API/client library usage, see IAM & Security).
-
Grant the least-privileged role needed for the task. Start with
roles/workloadmanager.viewerfor read-only access to evaluation resources and useroles/workloadmanager.evaluationAdminorroles/workloadmanager.adminonly when creating, updating, running, or deleting evaluations.
Quick Client Library Example
Use the Python client library for the first working automation path:
python3 -m pip install --upgrade google-cloud-workloadmanager
from google.cloud import workloadmanager_v1
project_id = "PROJECT_ID"
location = "LOCATION"
parent = f"projects/{project_id}/locations/{location}"
client = workloadmanager_v1.WorkloadManagerClient()
rules = client.list_rules(
request=workloadmanager_v1.ListRulesRequest(
parent=parent,
evaluation_type=workloadmanager_v1.Evaluation.EvaluationType.OTHER,
)
)
for rule in rules.rules:
print(rule.name, rule.display_name, rule.severity)
Reference Directory
-
Core Concepts: Evaluations, rules, results, scanned resources, supported workload types, and API shape.
-
General Best Practices: Google Cloud general best-practice posture checks,
OTHERevaluation guidance, custom Rego rules, and scale/automation patterns. -
Client Libraries: Python and Go client library examples for listing rules, creating evaluations, running evaluations, and reading findings.
-
REST Usage: Direct REST examples for the public Workload Manager API and operations polling.
-
Public CLI Status: No documented service-specific
gcloud workload-managercommand group; usegcloudonly for auth, IAM, API enablement, and REST tokens. -
Public MCP Status: No documented public Workload Manager MCP server; use client libraries or REST API instead.
-
Setup Prerequisites: Terraform examples only for adjacent prerequisites such as API enablement, IAM, BigQuery export datasets, and KMS keys. This is not Workload Manager resource management.
-
IAM & Security: Workload Manager roles, least-privilege guidance, service agents, data handling, and CMEK notes.
If product behavior or API fields are not covered here, check the current Workload Manager product documentation and client library reference before implementing.
Authoritative References
- Workload Manager overview
- Google Cloud best practices
- Workload Manager REST API
- About custom rules
- Write custom rules using Rego
- Python package
- Workload Manager IAM roles
- For additional information, use the Developer Knowledge MCP server
search_documentstool.
Additional Context
FAQ
What does the workload-manager-basics skill do?
Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.
How do I install workload-manager-basics?
Run npx skills add https://github.com/google/skills --skill workload-manager-basics in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/workload-manager-basics/ (personal) or .claude/skills/workload-manager-basics/ (project).
Which AI agents can use workload-manager-basics?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is workload-manager-basics safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains workload-manager-basics?
It is published by google in google/skills. It has 7,112 recorded installs.
More from google/skills
bigquery-basics
google/skills
Manages datasets, tables, and jobs in BigQuery. Use when you need to interact with BigQuery, run SQL queries, manage BigQuery resources (datasets, tables, views), or perform basic data ingestion and analysis.
cloud-run-basics
google/skills
Manages Cloud Run services, jobs, and worker pools. Use when you need to deploy applications responding to HTTP requests (services), run event-triggered or scheduled tasks (jobs), or handle always-on pull-based background processing (worker pools).
gemini-api
google/skills
Use when the user asks about using Gemini in an enterprise environment or explicitly mentions Vertex AI, Google Cloud, or Agent Platform. Guides the usage of the Gemini API on Agent Platform with the Google Gen AI SDK. Covers SDK usage (Python, JS/TS, Go, Java, C), capabilities like multimodal inputs, tools, media generation, caching, batch prediction, and Live API.
google-cloud-recipe-auth
google/skills
Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.
google-cloud-recipe-onboarding
google/skills
Guides a developer's first steps on Google Cloud, covering account creation, billing setup, project management, and deploying a first resource. Use when a new developer wants to initialize their first Google Cloud project, configure billing, and verify deployment. Don't use for enterprise organization setup (use Google Cloud Setup guided flow for that instead). Don't use for complex multi-project architectures.
cloud-sql-basics
google/skills
This file generates or explains Cloud SQL resources. Use this file when the user asks to create a Cloud SQL instance or database for MySQL, PostgreSQL, or SQL Server. Cloud SQL manages third-party MySQL, PostgreSQL, and SQL Server instances as resources in Cloud SQL. For example, when Cloud SQL creates an open-source MySQL instance, the resulting resource is a Cloud SQL for MySQL instance that Google Cloud manages. Cloud SQL handles backups, high availability, and secure connectivity for relational database workloads.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.