Menu
Use when the user asks about read-only GCP inventory — Cloud Run services, Cloud SQL instances, Pub/Sub topics, or Cloud Logging entries. Queries are scoped to a single GCP project. Never modifies GCP resources.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Use when the user asks about Confluence content or wants to create, update, or delete Confluence pages and comments — CQL search, page retrieval, space metadata, comments, attachments, or any write operation on pages. Supports both read and write surfaces; every action passes the policy gate before any network call is made: read actions succeed by default, write and delete actions escalate by default, privilege actions are hard-denied.
Use when the user asks about Jira data or wants to create, update, or delete Jira content — JQL search, issue details, project metadata, comments, attachments, status transitions, or any write operation on issues and comments. Supports both read and write surfaces; every action passes the policy gate before any network call is made: read actions succeed by default, write and delete actions escalate by default, privilege actions are hard-denied.
Use when the user asks about GitLab data or wants to act on GitLab — project info, code search, issue/MR/release/pipeline inspection, or any write that creates, updates, closes, or deletes an MR, issue, note, or release; merging MRs (admin); and managing CI pipeline runs (retry / cancel / trigger / play_job).
Use this skill whenever the user wants to add a new agent connector to their @narai connectors workspace — wrapping a SaaS API, REST endpoint, GraphQL endpoint, SDK, or CLI tool into the canonical @narai connector shape (CLI + library + Claude Code plugin). Trigger even if the user doesn't say "connector" explicitly: phrases like "I want to query Stripe from Claude", "add Slack to our agents", "wrap our internal orders API", "connect Salesforce", "I have a GraphQL endpoint we need exposed", "make a Linear agent" all warrant this skill. Walks the user through identity, auth, and action-surface questions, then scaffolds the package, plugin layer, and tests by stamping out canonical templates and generating per-connector code. Do NOT use for: modifying existing connectors (just edit the file), wrapping MCP servers (different abstraction), or querying databases (db-agent-connector already covers postgres/mysql/sqlite/mssql/mongodb/dynamodb/oracle).
Use when the user asks about read-only AWS inventory — Lambda functions, RDS databases, S3 buckets, or CloudWatch metrics in an AWS account. Queries are scoped to a single region (except list_buckets, which is account-wide). Never modifies AWS resources.
Use this skill when the user wants to add a custom connector to their project — wrapping a SaaS API, REST endpoint, GraphQL endpoint, SDK, or CLI tool so Claude can call it via `gather()` from `narai-primitives`. Trigger even when the user doesn't say "connector" explicitly: phrases like "I want to query Stripe from Claude", "add Slack to our agents", "wrap our internal orders API", "connect Salesforce", "make a Linear agent" all warrant this skill. Also triggers for: "gate kubectl in prod", "approve before force push", "pull from Linear, summarize, post to Slack", "document this workflow". Scaffolds a minimal local connector at `.connectors/connectors/<name>/` (project scope, default) or `~/.connectors/connectors/<name>/` (user scope) — no `git init`, no `npm publish`, no plugin manifest, no marketplace entry. Do NOT use for: modifying an existing connector (just edit the file), wrapping an MCP server (different abstraction), querying databases (the `db` connector inside narai-primitives already covers postg
| name | gcp-connector |
| description | Use when the user asks about read-only GCP inventory — Cloud Run services, Cloud SQL instances, Pub/Sub topics, or Cloud Logging entries. Queries are scoped to a single GCP project. Never modifies GCP resources. |
| context | fork |
Answer the user's question by invoking the gcp-connector binary exposed by
this plugin. It delegates to narai-primitives/gcp, which speaks to
GCP by shelling out to gcloud / bq with Application Default Credentials.
gcp-connector --action <action> --params '<json>'
The CLI writes a single JSON envelope to stdout and exits 0 on success, 1 on a handled error, 2 on CLI misuse. Return the envelope verbatim to the orchestrator.
| Action | Required params |
|---|---|
list_services | project_id |
describe_db | project_id, instance_id, optional database |
list_topics | project_id |
query_logs | project_id, exactly one of filter / structured_filter, optional hours (default 24, max 168), optional max_results (default 100, max 1000) |
Example:
gcp-connector --action list_services --params '{"project_id":"acme-prod-123"}'
Prefer structured_filter — JSON clauses compiled internally to a Cloud
Logging filter string with correct quoting/escaping. Operators: =, !=,
>=, <=, contains (alias :). Fields are dotted identifier paths
(severity, textPayload, trace, logName, resource.type,
resource.labels.*, jsonPayload.*). Clauses combine under and / or,
nested one level deep. Values are always treated as data — quotes,
backslashes, and newlines in values are escaped, never interpreted as
filter syntax.
gcp-connector --action query_logs --params '{
"project_id": "acme-prod-123",
"structured_filter": {"and": [
{"field": "resource.type", "op": "=", "value": "k8s_container"},
{"field": "resource.labels.namespace_name", "op": "=", "value": "prod-app"},
{"field": "severity", "op": ">=", "value": "ERROR"},
{"field": "textPayload", "op": "contains", "value": "connection refused"}
]}
}'
The raw filter string remains available for simple unquoted expressions
(e.g. severity=ERROR) but rejects semicolons, quotes, and shell
metacharacters — use structured_filter for anything needing quoted
values, severity floors, or multi-word search.
Each returned entry has timestamp, severity, message (falls back
textPayload → jsonPayload.message → stringified jsonPayload),
container, namespace, pod, trace_id, log_name, insert_id
(missing values are null).
Uses Application Default Credentials. Before first use, run:
gcloud auth application-default login
Read-only by construction: the connector enforces a binary and sub-command
whitelist at the execFileSync layer, forbids shell strings, and refuses
write-style flags. Cannot invoke create, delete, update, or any
mutating gcloud sub-command.