[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6995V58K1AZB0GGX15F63R1":3,"skill-same:01M6995V58K1AZB0GGX15F63R1":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6995V58K1AZB0GGX15F63R1","google-cloud-scc-query",null,"Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Security Command Center on Google Cloud. Use when retrieving details for a security finding by its name, validating finding scope (e.g., verifying findingClass is TOXIC_COMBINATION, VULNERABILITY, EXTERNAL_EXPOSURE, or THREAT), or fetching finding details for triage. Don't use to draft remediations, apply patches, or execute configurations.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24235,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-scc-query\u002FSKILL.md",[],[19,9,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"google cloud","google cloud scc query","cloud","scc","query","when","apply","for","command center","scope","combinations","active","threat","use","command","vulnerability","data","security command center","security","2026-11-10 10:12:30",false,"---\nname: google-cloud-scc-query\nmetadata:\n  version: \"1.0.2\"\n  category: Security\ndescription: >-\n  Queries and retrieves active security findings, external exposures, toxic\n  combinations, vulnerabilities, threats, and sensitive data risks from\n  Security Command Center on Google Cloud. Use when retrieving details for a\n  security finding by its name, validating finding scope (e.g., verifying\n  findingClass is TOXIC_COMBINATION, VULNERABILITY, EXTERNAL_EXPOSURE, or\n  THREAT), or fetching finding details for triage. Don't use to draft\n  remediations, apply patches, or execute configurations.\n---\n\n# Security Command Center Query Skill on Google Cloud\n\nProvides guidelines and read-only `gcloud` CLI command patterns for querying and\nretrieving security findings, external exposures, toxic combinations,\nvulnerabilities, threats, and sensitive data risks from Security Command Center\non Google Cloud.\n\n> [!IMPORTANT] There is NO `gcloud scc findings describe` command (`Invalid\n> choice: 'describe'`). To retrieve details for a specific finding by its name,\n> always use `gcloud scc findings list` with a filter on `name`.\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n--------------------------------------------------------------------------------\n\n## Core Execution Rules\n\n1.  **Read-Only & Zero-Speculation (Parent Scope Required)**: Keep all\n    executions strictly read-only. Every `gcloud scc findings list` or `group`\n    command strictly requires an explicit `{parent}` scope\n    (`organizations\u002F{id}`, `projects\u002F{id}`, or `folders\u002F{id}`). If the parent\n    scope is missing from the prompt and cannot be inferred from a full finding\n    name, **DO NOT run any `gcloud` commands** (do not execute queries without\n    parent, and never inspect `gcloud config`). Halt immediately before\n    executing commands and ask the user for the parent resource scope.\n2.  **Bounded Execution & No Runaway Loops**:\n    -   Limit tool calls to what is strictly necessary to complete the query\n        (typically 1 call for direct queries, or 2 calls for List → Deep Dive\n        workflows).\n    -   If a command fails due to permission\u002Fauth errors, or if a specific\n        finding query returns `[]`, halt immediately. Do not attempt blind\n        brute-force retries with different flags, and never search the local\n        workspace for credentials.\n3.  **Immediate Halt on Errors**: If any command fails with `PERMISSION_DENIED`,\n    `IAM_PERMISSION_DENIED`, credential expiration, or network timeouts, halt\n    immediately and report the verbatim error message. Do not search the\n    workspace for credentials or run diagnostic loops.\n4.  **Ambiguous or Multiple Findings**: If multiple finding names are provided\n    when a single finding report is requested, or if listing returns multiple\n    findings, do not investigate all of them or unilaterally pick one. Halt\n    immediately without running queries and ask the user to clarify which\n    specific finding name they want details for. If zero findings are returned\n    from a query, report that no active findings exist and halt immediately.\n5.  **Do Not Query Attack Path Resources**: Analyze only the data present in the\n    Security Command Center finding JSON payload. Do not run commands to\n    describe, verify, or query underlying Google Cloud resources (such as VMs,\n    Cloud Storage buckets, service accounts, or IAM policies).\n6.  **Parent Scope Resolution**:\n    -   For listing and grouping, format the parent resource path as\n        `organizations\u002F{org_id}`, `projects\u002F{project_id}`, or\n        `folders\u002F{folder_id}`.\n    -   For deep dive queries on a specific finding name, extract the `{parent}`\n        resource prefix before `\u002Fsources\u002F...`:\n        -   `organizations\u002F{org_id}\u002Fsources\u002F...` → `{parent}` is\n            `organizations\u002F{org_id}`\n        -   `folders\u002F{folder_id}\u002Fsources\u002F...` → `{parent}` is\n            `folders\u002F{folder_id}`\n        -   `projects\u002F{project_id}\u002Fsources\u002F...` → `{parent}` is\n            `projects\u002F{project_id}` Extract the parent prefix regardless of\n            whether the finding resource name is global (4-segment) or\n            location-qualified (5-segment with `\u002Flocations\u002F{location}\u002F`).\n            Execute the deep dive query using the extracted `{parent}`. Do not\n            reject or halt on project- or folder-level findings.\n\n--------------------------------------------------------------------------------\n\n## Data Residency & Regional Endpoints\n\nWhen Data Residency (DRZ) is enabled, findings are stored and accessible only\nwithin their designated regional location (`us`, `eu`, or `me-central2`).\nQueries across different locations do not return findings from other regions.\n\n### 1. Location Parameterization\n\nAll `gcloud scc findings` commands require specifying the target location via\n`--location={location}`:\n\n-   **Default**: `global` (used when data residency is not enabled or for global\n    findings).\n-   **Supported Regional Locations**:\n    -   `us` (United States multi-region)\n    -   `eu` (European Union multi-region)\n    -   `me-central2` (Kingdom of Saudi Arabia regional location)\n\n### 2. API Endpoint Overrides\n\nWhen data residency (DRZ) is enabled for an organization in a regional location\n(`us`, `eu`, or `me-central2`), configure the regional API endpoint override\nbefore executing finding queries:\n\n```bash\ngcloud config set api_endpoint_overrides\u002Fsecuritycenter https:\u002F\u002Fsecuritycenter.{LOCATION}.rep.googleapis.com\u002F\n```\n\nExample for the European Union (`eu`) region:\n\n```bash\ngcloud config set api_endpoint_overrides\u002Fsecuritycenter https:\u002F\u002Fsecuritycenter.eu.rep.googleapis.com\u002F\n```\n\nTo reset the endpoint back to default global routing:\n\n```bash\ngcloud config unset api_endpoint_overrides\u002Fsecuritycenter\n```\n\n### 3. Location-Qualified Finding Resource Names\n\nRegional finding resource names include the `\u002Flocations\u002F{location}\u002F` path\nsegment:\n\n-   Organization-level:\n    `organizations\u002F{org_id}\u002Fsources\u002F{source_id}\u002Flocations\u002F{location}\u002Ffindings\u002F{finding_id}`\n-   Folder-level:\n    `folders\u002F{folder_id}\u002Fsources\u002F{source_id}\u002Flocations\u002F{location}\u002Ffindings\u002F{finding_id}`\n-   Project-level:\n    `projects\u002F{project_id}\u002Fsources\u002F{source_id}\u002Flocations\u002F{location}\u002Ffindings\u002F{finding_id}`\n\nWhen performing a Deep Dive on a location-qualified finding name:\n\n1.  Extract the `{parent}` scope (the prefix before `\u002Fsources\u002F...`, e.g.,\n    `organizations\u002F{org_id}`).\n2.  Extract the `{location}` from `\u002Flocations\u002F{location}\u002F` (e.g., `eu`, `us`,\n    `me-central2`). If not present in the finding name, default to `global` (or\n    the user-specified location).\n3.  Execute the query with `--location={location}` and\n    `--filter=\"name=\\\"{finding_name}\\\"\"`.\n\n--------------------------------------------------------------------------------\n\n## Intent-Based Query Strategies\n\n### 1. Deep Dive (Specific Finding Details)\n\n**Intent**: User provides a specific finding name or explicitly asks to retrieve\nall details for one finding. \\\n**Action**: Execute `gcloud scc findings list` with a strict filter on `name`\nand NO `--field-mask` to retrieve the complete JSON payload. Specify\n`--location={location}` (default `global` unless a regional location is\nindicated or present in the finding name).\n\n```bash\ngcloud scc findings list {parent} \\\n  --location={location} \\\n  --filter=\"name=\\\"{finding_name}\\\"\" \\\n  --format=\"json\" --limit=1\n```\n\n### 2. Listing (Filtered Projection)\n\n**Intent**: User wants to list active findings matching criteria without pulling\nfull nested payloads. \\\n**Action**: Use `--field-mask` projection to restrict output size. Specify\n`--location={location}` (default `global` unless querying a specific region).\n\n```bash\ngcloud scc findings list {parent} \\\n  --location={location} \\\n  --filter=\"{filter_expression}\" \\\n  --field-mask=\"finding.name,finding.parentDisplayName,finding.findingClass,finding.category,finding.state,finding.eventTime,finding.severity,finding.resourceName\" \\\n  --format=\"json\" --order-by=\"severity,event_time desc\" --limit=100\n```\n\n| Intent \u002F Target Finding Class | `--filter` Expression                      |\n| :---------------------------- | :----------------------------------------- |\n| **All Active Findings**       | `state=\"ACTIVE\"`                           |\n| **Vulnerabilities**           | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"VULNERABILITY\"`              :\n| **Misconfigurations**         | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"MISCONFIGURATION\"`           :\n| **Toxic Combinations**        | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"TOXIC_COMBINATION\"`          :\n| **External Exposures**        | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"EXTERNAL_EXPOSURE\"`          :\n| **Threats**                   | `state=\"ACTIVE\" AND findingClass=\"THREAT\"` |\n| **Observations**              | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"OBSERVATION\"`                :\n| **Sensitive Data Risks**      | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"SENSITIVE_DATA_RISK\"`        :\n| **Chokepoints**               | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"CHOKEPOINT\"`                 :\n| **Posture Violations**        | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"POSTURE_VIOLATION\"`          :\n| **Secrets**                   | `state=\"ACTIVE\" AND findingClass=\"SECRET\"` |\n| **SCC Errors**                | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"SCC_ERROR\"`                  :\n| **Specific Category**         | `state=\"ACTIVE\" AND category=\"{category}\"` |\n\n### 3. Discovery & Aggregation (Grouping)\n\n**Intent**: User wants high-level counts or landscape overview (e.g., \"What are\nthe most common findings?\", \"Show me a summary by category\"). \\\n**Action**: Use `gcloud scc findings group`. Specify `--location={location}`\n(default `global` unless querying a specific region). Allowed fields for\n`--group-by` are strictly: `resource_name`, `category`, `state`, `parent`.\n\n```bash\ngcloud scc findings group {parent} \\\n  --location={location} \\\n  --group-by=\"{group_by_field}\" \\\n  --filter=\"state=\\\"ACTIVE\\\"\" \\\n  --format=\"json\"\n```\n\n--------------------------------------------------------------------------------\n\n## Payload Analysis & Handoff\n\nOnce the finding JSON payload is retrieved:\n\n*   **For `TOXIC_COMBINATION` Findings**:\n    1.  Verify the `attackExposure` field is present and has a `score > 0`.\n    2.  Inspect the attack path nodes, edges, or referenced\n        `attackExposureResult` to identify exposed resources and attack\n        trajectories.\n*   **For `VULNERABILITY` Findings**:\n    1.  Extract CVSS scores, exploit signals (`exploitationActivity`,\n        `observedInTheWild`, `zeroDay`), upstream fix status\n        (`upstreamFixAvailable`), and affected package details from the\n        `vulnerability` object to evaluate risk:\n        -   `vulnerability.cve.id`\n        -   `vulnerability.cve.cvssv3.baseScore`\n        -   `vulnerability.cve.cvssv3.attackVector`\n        -   `vulnerability.cve.exploitationActivity`\n        -   `vulnerability.cve.observedInTheWild`\n        -   `vulnerability.cve.zeroDay`\n        -   `vulnerability.cve.upstreamFixAvailable`\n        -   `vulnerability.offendingPackage.packageName`\n        -   `vulnerability.offendingPackage.packageVersion`\n        -   `vulnerability.fixedPackage.packageVersion`\n        -   `vulnerability.securityBulletin.suggestedUpgradeVersion`\n*   **Handoff**: Do not draft remediation plans, patch resources, or execute\n    configuration commands. Pass the extracted finding payload to the\n    appropriate remediation or IAM analyzer skill to manage the remediation\n    action loop.\n\n--------------------------------------------------------------------------------\n\n## Reference Schema\n\nSee [finding_schema.md](references\u002Ffinding_schema.md) for the JSON structure of\na Security Command Center finding.\n","# Security Command Center Query Skill on Google Cloud\n\nProvides guidelines and read-only `gcloud` CLI command patterns for querying and\nretrieving security findings, external exposures, toxic combinations,\nvulnerabilities, threats, and sensitive data risks from Security Command Center\non Google Cloud.\n\n> [!IMPORTANT] There is NO `gcloud scc findings describe` command (`Invalid\n> choice: 'describe'`). To retrieve details for a specific finding by its name,\n> always use `gcloud scc findings list` with a filter on `name`.\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n--------------------------------------------------------------------------------\n\n## Core Execution Rules\n\n1.  **Read-Only & Zero-Speculation (Parent Scope Required)**: Keep all\n    executions strictly read-only. Every `gcloud scc findings list` or `group`\n    command strictly requires an explicit `{parent}` scope\n    (`organizations\u002F{id}`, `projects\u002F{id}`, or `folders\u002F{id}`). If the parent\n    scope is missing from the prompt and cannot be inferred from a full finding\n    name, **DO NOT run any `gcloud` commands** (do not execute queries without\n    parent, and never inspect `gcloud config`). Halt immediately before\n    executing commands and ask the user for the parent resource scope.\n2.  **Bounded Execution & No Runaway Loops**:\n    -   Limit tool calls to what is strictly necessary to complete the query\n        (typically 1 call for direct queries, or 2 calls for List → Deep Dive\n        workflows).\n    -   If a command fails due to permission\u002Fauth errors, or if a specific\n        finding query returns `[]`, halt immediately. Do not attempt blind\n        brute-force retries with different flags, and never search the local\n        workspace for credentials.\n3.  **Immediate Halt on Errors**: If any command fails with `PERMISSION_DENIED`,\n    `IAM_PERMISSION_DENIED`, credential expiration, or network timeouts, halt\n    immediately and report the verbatim error message. Do not search the\n    workspace for credentials or run diagnostic loops.\n4.  **Ambiguous or Multiple Findings**: If multiple finding names are provided\n    when a single finding report is requested, or if listing returns multiple\n    findings, do not investigate all of them or unilaterally pick one. Halt\n    immediately without running queries and ask the user to clarify which\n    specific finding name they want details for. If zero findings are returned\n    from a query, report that no active findings exist and halt immediately.\n5.  **Do Not Query Attack Path Resources**: Analyze only the data present in the\n    Security Command Center finding JSON payload. Do not run commands to\n    describe, verify, or query underlying Google Cloud resources (such as VMs,\n    Cloud Storage buckets, service accounts, or IAM policies).\n6.  **Parent Scope Resolution**:\n    -   For listing and grouping, format the parent resource path as\n        `organizations\u002F{org_id}`, `projects\u002F{project_id}`, or\n        `folders\u002F{folder_id}`.\n    -   For deep dive queries on a specific finding name, extract the `{parent}`\n        resource prefix before `\u002Fsources\u002F...`:\n        -   `organizations\u002F{org_id}\u002Fsources\u002F...` → `{parent}` is\n            `organizations\u002F{org_id}`\n        -   `folders\u002F{folder_id}\u002Fsources\u002F...` → `{parent}` is\n            `folders\u002F{folder_id}`\n        -   `projects\u002F{project_id}\u002Fsources\u002F...` → `{parent}` is\n            `projects\u002F{project_id}` Extract the parent prefix regardless of\n            whether the finding resource name is global (4-segment) or\n            location-qualified (5-segment with `\u002Flocations\u002F{location}\u002F`).\n            Execute the deep dive query using the extracted `{parent}`. Do not\n            reject or halt on project- or folder-level findings.\n\n--------------------------------------------------------------------------------\n\n## Data Residency & Regional Endpoints\n\nWhen Data Residency (DRZ) is enabled, findings are stored and accessible only\nwithin their designated regional location (`us`, `eu`, or `me-central2`).\nQueries across different locations do not return findings from other regions.\n\n### 1. Location Parameterization\n\nAll `gcloud scc findings` commands require specifying the target location via\n`--location={location}`:\n\n-   **Default**: `global` (used when data residency is not enabled or for global\n    findings).\n-   **Supported Regional Locations**:\n    -   `us` (United States multi-region)\n    -   `eu` (European Union multi-region)\n    -   `me-central2` (Kingdom of Saudi Arabia regional location)\n\n### 2. API Endpoint Overrides\n\nWhen data residency (DRZ) is enabled for an organization in a regional location\n(`us`, `eu`, or `me-central2`), configure the regional API endpoint override\nbefore executing finding queries:\n\n```bash\ngcloud config set api_endpoint_overrides\u002Fsecuritycenter https:\u002F\u002Fsecuritycenter.{LOCATION}.rep.googleapis.com\u002F\n```\n\nExample for the European Union (`eu`) region:\n\n```bash\ngcloud config set api_endpoint_overrides\u002Fsecuritycenter https:\u002F\u002Fsecuritycenter.eu.rep.googleapis.com\u002F\n```\n\nTo reset the endpoint back to default global routing:\n\n```bash\ngcloud config unset api_endpoint_overrides\u002Fsecuritycenter\n```\n\n### 3. Location-Qualified Finding Resource Names\n\nRegional finding resource names include the `\u002Flocations\u002F{location}\u002F` path\nsegment:\n\n-   Organization-level:\n    `organizations\u002F{org_id}\u002Fsources\u002F{source_id}\u002Flocations\u002F{location}\u002Ffindings\u002F{finding_id}`\n-   Folder-level:\n    `folders\u002F{folder_id}\u002Fsources\u002F{source_id}\u002Flocations\u002F{location}\u002Ffindings\u002F{finding_id}`\n-   Project-level:\n    `projects\u002F{project_id}\u002Fsources\u002F{source_id}\u002Flocations\u002F{location}\u002Ffindings\u002F{finding_id}`\n\nWhen performing a Deep Dive on a location-qualified finding name:\n\n1.  Extract the `{parent}` scope (the prefix before `\u002Fsources\u002F...`, e.g.,\n    `organizations\u002F{org_id}`).\n2.  Extract the `{location}` from `\u002Flocations\u002F{location}\u002F` (e.g., `eu`, `us`,\n    `me-central2`). If not present in the finding name, default to `global` (or\n    the user-specified location).\n3.  Execute the query with `--location={location}` and\n    `--filter=\"name=\\\"{finding_name}\\\"\"`.\n\n--------------------------------------------------------------------------------\n\n## Intent-Based Query Strategies\n\n### 1. Deep Dive (Specific Finding Details)\n\n**Intent**: User provides a specific finding name or explicitly asks to retrieve\nall details for one finding. \\\n**Action**: Execute `gcloud scc findings list` with a strict filter on `name`\nand NO `--field-mask` to retrieve the complete JSON payload. Specify\n`--location={location}` (default `global` unless a regional location is\nindicated or present in the finding name).\n\n```bash\ngcloud scc findings list {parent} \\\n  --location={location} \\\n  --filter=\"name=\\\"{finding_name}\\\"\" \\\n  --format=\"json\" --limit=1\n```\n\n### 2. Listing (Filtered Projection)\n\n**Intent**: User wants to list active findings matching criteria without pulling\nfull nested payloads. \\\n**Action**: Use `--field-mask` projection to restrict output size. Specify\n`--location={location}` (default `global` unless querying a specific region).\n\n```bash\ngcloud scc findings list {parent} \\\n  --location={location} \\\n  --filter=\"{filter_expression}\" \\\n  --field-mask=\"finding.name,finding.parentDisplayName,finding.findingClass,finding.category,finding.state,finding.eventTime,finding.severity,finding.resourceName\" \\\n  --format=\"json\" --order-by=\"severity,event_time desc\" --limit=100\n```\n\n| Intent \u002F Target Finding Class | `--filter` Expression                      |\n| :---------------------------- | :----------------------------------------- |\n| **All Active Findings**       | `state=\"ACTIVE\"`                           |\n| **Vulnerabilities**           | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"VULNERABILITY\"`              :\n| **Misconfigurations**         | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"MISCONFIGURATION\"`           :\n| **Toxic Combinations**        | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"TOXIC_COMBINATION\"`          :\n| **External Exposures**        | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"EXTERNAL_EXPOSURE\"`          :\n| **Threats**                   | `state=\"ACTIVE\" AND findingClass=\"THREAT\"` |\n| **Observations**              | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"OBSERVATION\"`                :\n| **Sensitive Data Risks**      | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"SENSITIVE_DATA_RISK\"`        :\n| **Chokepoints**               | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"CHOKEPOINT\"`                 :\n| **Posture Violations**        | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"POSTURE_VIOLATION\"`          :\n| **Secrets**                   | `state=\"ACTIVE\" AND findingClass=\"SECRET\"` |\n| **SCC Errors**                | `state=\"ACTIVE\" AND                        |\n:                               : findingClass=\"SCC_ERROR\"`                  :\n| **Specific Category**         | `state=\"ACTIVE\" AND category=\"{category}\"` |\n\n### 3. Discovery & Aggregation (Grouping)\n\n**Intent**: User wants high-level counts or landscape overview (e.g., \"What are\nthe most common findings?\", \"Show me a summary by category\"). \\\n**Action**: Use `gcloud scc findings group`. Specify `--location={location}`\n(default `global` unless querying a specific region). Allowed fields for\n`--group-by` are strictly: `resource_name`, `category`, `state`, `parent`.\n\n```bash\ngcloud scc findings group {parent} \\\n  --location={location} \\\n  --group-by=\"{group_by_field}\" \\\n  --filter=\"state=\\\"ACTIVE\\\"\" \\\n  --format=\"json\"\n```\n\n--------------------------------------------------------------------------------\n\n## Payload Analysis & Handoff\n\nOnce the finding JSON payload is retrieved:\n\n*   **For `TOXIC_COMBINATION` Findings**:\n    1.  Verify the `attackExposure` field is present and has a `score > 0`.\n    2.  Inspect the attack path nodes, edges, or referenced\n        `attackExposureResult` to identify exposed resources and attack\n        trajectories.\n*   **For `VULNERABILITY` Findings**:\n    1.  Extract CVSS scores, exploit signals (`exploitationActivity`,\n        `observedInTheWild`, `zeroDay`), upstream fix status\n        (`upstreamFixAvailable`), and affected package details from the\n        `vulnerability` object to evaluate risk:\n        -   `vulnerability.cve.id`\n        -   `vulnerability.cve.cvssv3.baseScore`\n        -   `vulnerability.cve.cvssv3.attackVector`\n        -   `vulnerability.cve.exploitationActivity`\n        -   `vulnerability.cve.observedInTheWild`\n        -   `vulnerability.cve.zeroDay`\n        -   `vulnerability.cve.upstreamFixAvailable`\n        -   `vulnerability.offendingPackage.packageName`\n        -   `vulnerability.offendingPackage.packageVersion`\n        -   `vulnerability.fixedPackage.packageVersion`\n        -   `vulnerability.securityBulletin.suggestedUpgradeVersion`\n*   **Handoff**: Do not draft remediation plans, patch resources, or execute\n    configuration commands. Pass the extracted finding payload to the\n    appropriate remediation or IAM analyzer skill to manage the remediation\n    action loop.\n\n--------------------------------------------------------------------------------\n\n## Reference Schema\n\nSee [finding_schema.md](references\u002Ffinding_schema.md) for the JSON structure of\na Security Command Center finding.\n",{"name":5,"metadata":43,"description":7},{"version":44,"category":45},"1.0.2","Security","main","bb9b3f464aae37af360d079c1d863524955b0363","skills\u002Fcloud\u002Fgoogle-cloud-scc-query",2014,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 23:31:00",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add google\u002Fskills --skill google-cloud-scc-query",{"tool":61,"command":62},"bunx","bunx skills add google\u002Fskills --skill google-cloud-scc-query",{"tool":64,"command":65},"pnpm","pnpm dlx skills add google\u002Fskills --skill google-cloud-scc-query","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-scc-query\u002FSKILL.md",true,[69,75],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fattribution.md","REFERENCE","参考文档",1914,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-scc-query\u002Freferences\u002Fattribution.md",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Ffinding_schema.md",3912,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-scc-query\u002Freferences\u002Ffinding_schema.md",[80,116,147,175,202,226],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":94,"publishedAt":38},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[86,91],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":92,"categoryName":93,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000010","后端与接口",[9,95,96,97,98,99,100,37,101,19,102,103,104,105,106,107,108,109,110,111,112,113,114,115],"sign in with google web","sign","with","web","android","go","google workspace","implement","policy","python","implementing","react","iam","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":131,"publishedAt":38},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[122,123,126],{"categoryNo":92,"categoryName":93,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":124,"categoryName":125,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[132,133,9,19,134,135,136,137,138,139,107,140,141,142,143,144,145,112,115,146,24],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":159,"publishedAt":38},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[153,154,157,158],{"categoryNo":92,"categoryName":93,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":155,"categoryName":156,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":124,"categoryName":125,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[160,161,162,163,19,164,165,166,167,168,169,170,171,24,23,172,173,107,174,108],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","api","across","documentation",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":38},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,104,190,191,192,193,194,195,169,196,197,198,24,199,200,173,201],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":211,"publishedAt":38},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[208,209,210],{"categoryNo":92,"categoryName":93,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":124,"categoryName":125,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":127,"categoryName":128,"taxonomyType":129,"taxonomyTypeDesc":130},[9,212,213,214,215,146,216,217,218,219,220,136,221,222,223,170,32,224,24,225,172],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","up","decision","database","candidate",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":234,"publishedAt":38},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[232,233],{"categoryNo":92,"categoryName":93,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":124,"categoryName":125,"taxonomyType":89,"taxonomyTypeDesc":90},[235,236,111,237,9,163,238,19,164,239,240,241,242,24,243,172,107,244,245,246,247],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]