Menú
Use when the user asks about read-only GCP inventory — Cloud Run services, Cloud SQL instances, Pub/Sub topics, or Cloud Logging entries. Queries are scoped to a single GCP project. Never modifies GCP resources.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Use when the user asks about Confluence content or wants to create, update, or delete Confluence pages and comments — CQL search, page retrieval, space metadata, comments, attachments, or any write operation on pages. Supports both read and write surfaces; every action passes the policy gate before any network call is made: read actions succeed by default, write and delete actions escalate by default, privilege actions are hard-denied.
Use when the user asks about Jira data or wants to create, update, or delete Jira content — JQL search, issue details, project metadata, comments, attachments, status transitions, or any write operation on issues and comments. Supports both read and write surfaces; every action passes the policy gate before any network call is made: read actions succeed by default, write and delete actions escalate by default, privilege actions are hard-denied.
Use when the user asks about GitLab data or wants to act on GitLab — project info, code search, issue/MR/release/pipeline inspection, or any write that creates, updates, closes, or deletes an MR, issue, note, or release; merging MRs (admin); and managing CI pipeline runs (retry / cancel / trigger / play_job).
Use this skill whenever the user wants to add a new agent connector to their @narai connectors workspace — wrapping a SaaS API, REST endpoint, GraphQL endpoint, SDK, or CLI tool into the canonical @narai connector shape (CLI + library + Claude Code plugin). Trigger even if the user doesn't say "connector" explicitly: phrases like "I want to query Stripe from Claude", "add Slack to our agents", "wrap our internal orders API", "connect Salesforce", "I have a GraphQL endpoint we need exposed", "make a Linear agent" all warrant this skill. Walks the user through identity, auth, and action-surface questions, then scaffolds the package, plugin layer, and tests by stamping out canonical templates and generating per-connector code. Do NOT use for: modifying existing connectors (just edit the file), wrapping MCP servers (different abstraction), or querying databases (db-agent-connector already covers postgres/mysql/sqlite/mssql/mongodb/dynamodb/oracle).
Use when the user asks about read-only AWS inventory — Lambda functions, RDS databases, S3 buckets, or CloudWatch metrics in an AWS account. Queries are scoped to a single region (except list_buckets, which is account-wide). Never modifies AWS resources.
Use this skill when the user wants to add a custom connector to their project — wrapping a SaaS API, REST endpoint, GraphQL endpoint, SDK, or CLI tool so Claude can call it via `gather()` from `narai-primitives`. Trigger even when the user doesn't say "connector" explicitly: phrases like "I want to query Stripe from Claude", "add Slack to our agents", "wrap our internal orders API", "connect Salesforce", "make a Linear agent" all warrant this skill. Also triggers for: "gate kubectl in prod", "approve before force push", "pull from Linear, summarize, post to Slack", "document this workflow". Scaffolds a minimal local connector at `.connectors/connectors/<name>/` (project scope, default) or `~/.connectors/connectors/<name>/` (user scope) — no `git init`, no `npm publish`, no plugin manifest, no marketplace entry. Do NOT use for: modifying an existing connector (just edit the file), wrapping an MCP server (different abstraction), querying databases (the `db` connector inside narai-primitives already covers postg
| name | gcp-connector |
| description | Use when the user asks about read-only GCP inventory — Cloud Run services, Cloud SQL instances, Pub/Sub topics, or Cloud Logging entries. Queries are scoped to a single GCP project. Never modifies GCP resources. |
| context | fork |
Answer the user's question by invoking the gcp-connector binary exposed by
this plugin. It delegates to narai-primitives/gcp, which speaks to
GCP by shelling out to gcloud / bq with Application Default Credentials.
gcp-connector --action <action> --params '<json>'
The CLI writes a single JSON envelope to stdout and exits 0 on success, 1 on a handled error, 2 on CLI misuse. Return the envelope verbatim to the orchestrator.
| Action | Required params |
|---|---|
list_services | project_id |
describe_db | project_id, instance_id, optional database |
list_topics | project_id |
query_logs | project_id, exactly one of filter / structured_filter, optional hours (default 24, max 168), optional max_results (default 100, max 1000) |
Example:
gcp-connector --action list_services --params '{"project_id":"acme-prod-123"}'
Prefer structured_filter — JSON clauses compiled internally to a Cloud
Logging filter string with correct quoting/escaping. Operators: =, !=,
>=, <=, contains (alias :). Fields are dotted identifier paths
(severity, textPayload, trace, logName, resource.type,
resource.labels.*, jsonPayload.*). Clauses combine under and / or,
nested one level deep. Values are always treated as data — quotes,
backslashes, and newlines in values are escaped, never interpreted as
filter syntax.
gcp-connector --action query_logs --params '{
"project_id": "acme-prod-123",
"structured_filter": {"and": [
{"field": "resource.type", "op": "=", "value": "k8s_container"},
{"field": "resource.labels.namespace_name", "op": "=", "value": "prod-app"},
{"field": "severity", "op": ">=", "value": "ERROR"},
{"field": "textPayload", "op": "contains", "value": "connection refused"}
]}
}'
The raw filter string remains available for simple unquoted expressions
(e.g. severity=ERROR) but rejects semicolons, quotes, and shell
metacharacters — use structured_filter for anything needing quoted
values, severity floors, or multi-word search.
Each returned entry has timestamp, severity, message (falls back
textPayload → jsonPayload.message → stringified jsonPayload),
container, namespace, pod, trace_id, log_name, insert_id
(missing values are null).
Uses Application Default Credentials. Before first use, run:
gcloud auth application-default login
Read-only by construction: the connector enforces a binary and sub-command
whitelist at the execFileSync layer, forbids shell strings, and refuses
write-style flags. Cannot invoke create, delete, update, or any
mutating gcloud sub-command.