[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFSMGZVP91R72Z1VC8E0ZM":3,"skill-same:01M6AFSMGZVP91R72Z1VC8E0ZM":148},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6AFSMGZVP91R72Z1VC8E0ZM","google-cloud-waf-security",null,"Generates security-focused guidance for Google Cloud workloads based on the Google Cloud Well-Architected Framework (WAF). Use to evaluate a workload, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33481,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fgoogle-cloud-waf-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"google cloud","security","google","google cloud waf security","cloud","waf","evaluate","for","actionable","recommendations","requirements","protection","guidance","use","iam","data","network","data protection","apache","framework","workload","network security","2026-11-10 10:12:30",false,"---\nname: google-cloud-waf-security\ndescription: Generates security-focused guidance for Google Cloud workloads based on the Google Cloud Well-Architected Framework (WAF). Use to evaluate a workload, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.\nmetadata:\n  source: google\u002Fskills (Apache 2.0)\n---\n\n# Google Cloud Well-Architected Framework skill for the Security pillar\n\n## Overview\n\nThe security pillar of the Google Cloud Well-Architected Framework provides\ndesign principles and best practices for building a robust security posture by\nintegrating security into every layer of the architecture for cloud workloads.\nIt focuses on maintaining confidentiality and integrity of data and systems\nwhile ensuring compliance and privacy. It provides a structured approach to risk\nmanagement, threat defense, and identity control, enabling you to operate cloud\nworkloads securely and at scale.\n\n## Core principles\n\nThe recommendations in the security pillar of the Well-Architected Framework are\naligned with the following core principles:\n\n-  **Implement security by design**: Integrate cloud security and network\n   security considerations starting from the initial design phase of your\n   applications and infrastructure. Google Cloud provides architecture\n   blueprints and recommendations to help you apply this principle. Grounding\n   document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-security-by-design\n\n-  **Implement zero trust**: Use a _never trust, always verify_ approach, where\n   access to resources is granted based on continuous verification of trust.\n   Google Cloud supports this principle through products like Chrome Enterprise\n   Premium and Identity-Aware Proxy (IAP). Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-zero-trust\n\n-  **Implement shift-left security**: Implement security controls early in the\n   software development lifecycle. Avoid security defects before system changes\n   are made. Detect and fix security bugs early, fast, and reliably after the\n   system changes are committed. Google Cloud supports this principle through\n   products like Cloud Build, Binary Authorization, and Artifact Registry.\n   Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-shift-left-security\n\n-  **Implement preemptive cyber defense**: Adopt a proactive approach to\n   security by implementing robust fundamental measures like threat\n   intelligence. This approach helps you build a foundation for more effective\n   threat detection and response. Google Cloud's approach to layered security\n   controls aligns with this principle. Google Cloud supports this principle\n   through products like Security Command Center, Google Threat Intelligence,\n   and Google SecOps. Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-preemptive-cyber-defense\n\n-  **Use AI securely and responsibly**: Develop and deploy AI systems in a\n   responsible and secure manner. The recommendations for this principle are\n   aligned with guidance in the AI and ML perspective of the Well-Architected\n   Framework and in Google's Secure AI Framework (SAIF). Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-securely-and-responsibly\n\n-  **Use AI for security**: Use AI capabilities to improve your existing\n   security systems and processes through Gemini in Security and overall\n   platform-security capabilities. Use AI as a tool to increase the automation\n   of remedial work and ensure security hygiene to make other systems more\n   secure. Google Cloud supports this principle through products like Google\n   Threat Intelligence and Google SecOps. Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-for-security\n\n-  **Meet regulatory, compliance, and privacy needs**: Adhere to\n   industry-specific regulations, compliance standards, and privacy\n   requirements. Google Cloud helps you meet these obligations through products\n   like Assured Workloads, Organization Policy Service, and our compliance\n   resource center. Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fmeet-regulatory-compliance-and-privacy-needs\n\n## Relevant Google Cloud products\n\nThe following are _examples_ of Google Cloud products and features that are\nrelevant to security:\n\n- **Identity and access management**\n\n  - **Identity and Access Management (IAM)**: Fine-grained access control for\n    Google Cloud resources.\n  - **Identity-Aware Proxy (IAP)**: Secure access to applications without a VPN.\n  - **Chrome Enterprise Premium**: Endpoint security and context-aware access.\n\n- **Network security**\n\n  - **Google Cloud Armor**: DDoS protection and Web Application Firewall (WAF).\n  - **VPC Service Controls**: Define security perimeters to prevent data\n    exfiltration.\n  - **Cloud Next-Generation Firewall (NGFW)**: Advanced threat protection for\n    network traffic.\n  - **Shared VPC**: Centralized network management across projects.\n  - **Cloud Interconnect and IPsec VPN**: Secure, private connectivity.\n\n- **Data security**\n\n  - **Cloud Key Management Service (KMS)**: Manage encryption keys.\n  - **Sensitive Data Protection (formerly Cloud DLP)**: Discover and redact\n    sensitive data.\n  - **Confidential Computing**: Encrypt data in use (memory).\n\n- **Security operations (SecOps)**\n\n  - **Google SecOps (Chronicle)**: Threat detection and security analytics.\n  - **Security Command Center (SCC)**: Centralized vulnerability and threat\n    management.\n  - **Cloud Logging and Cloud Monitoring**: Visibility into system activity.\n\n- **Automation and supply chain**\n\n  - **Cloud Build**: Secure CI\u002FCD pipelines.\n  - **Artifact Analysis**: Vulnerability scanning for container images.\n  - **Binary Authorization**: Deploy-time policy enforcement.\n  - **Assured open source software**: Use secured OSS packages.\n\n## Workload assessment questions\n\nAsk appropriate questions to understand the security-related requirements and\nconstraints of the workload and the user's organization. Choose questions from\nthe following list:\n\n- **Security by design**:\n\n  - How do you incorporate security considerations into your project's initial\n    planning and design phases?\n  - How do you define and document security requirements for new applications\n    and services?\n  - How do you ensure that security is integrated into your development\n    lifecycle?\n  - What tools and techniques do you use to perform threat modeling during the\n    design phase?\n  - How do you manage and prioritize security vulnerabilities discovered during\n    the design and development process?\n  - How do you handle security updates and patches for your applications and\n    infrastructure?\n  - How do you document and communicate security design decisions to your team\n    and stakeholders?\n  - How do you ensure that security configurations are consistently applied\n    across your environments?\n  - How do you validate the effectiveness of your security controls and\n    measures?\n  - How do you handle security exceptions and deviations from your security\n    design?\n\n- **Zero trust**:\n\n  - How do you verify and authenticate users and devices accessing your Google\n    Cloud resources?\n  - How do you implement the principle of least privilege for access control?\n  - How do you monitor and control network traffic within your Google Cloud\n    environment?\n  - How do you secure data in transit and at rest in your Google Cloud\n    environment?\n  - How do you implement continuous monitoring and logging of user and device\n    activity?\n  - How do you handle and respond to security incidents and breaches in a Zero\n    Trust environment?\n  - How do you manage and update security policies and controls in a Zero Trust\n    environment?\n  - How do you ensure that third-party applications and services comply with\n    your Zero Trust principles?\n  - How do you handle remote access and BYOD devices in a Zero Trust\n    environment?\n  - How do you educate and train your employees on Zero Trust principles and\n    practices?\n\n- **Shift-left security**:\n\n  - How do you integrate security testing into your development pipeline early\n    in the process?\n  - What types of security testing do you perform during the development phase?\n  - How do you provide developers with feedback on security vulnerabilities and\n    best practices?\n  - How do you empower developers to take ownership of security in their code?\n  - How do you ensure that security requirements are clearly defined and\n    communicated to developers?\n  - How do you measure the effectiveness of your Shift Left security\n    initiatives?\n  - How do you handle security dependencies and third-party libraries in your\n    code?\n  - How do you manage and update security configurations in your development\n    environment?\n  - How do you handle security exceptions and deviations from your security\n    policies in development?\n  - How do you promote a culture of security awareness and responsibility among\n    developers?\n\n- **Preemptive cyber defense**:\n\n  - How do you proactively identify and mitigate potential security threats\n    before they impact your systems?\n  - What tools and techniques do you use for continuous security monitoring and\n    analysis?\n  - How do you respond to and remediate security alerts and incidents?\n  - How do you simulate and test your incident response plans?\n  - How do you stay up-to-date with the latest security threats and\n    vulnerabilities?\n  - How do you handle and mitigate DDoS attacks against your applications and\n    services?\n  - How do you protect your sensitive data from insider threats?\n  - How do you ensure that your security controls are effective against advanced\n    persistent threats (APTs)?\n  - How do you handle security vulnerabilities in your supply chain?\n  - How do you adapt your security posture to evolving threats and technologies?\n\n- **Security of AI workloads**:\n\n  - How do you ensure the security of your AI models and data?\n  - How do you address potential biases and ethical concerns in your AI models?\n  - How do you protect your AI models from adversarial attacks and data\n    poisoning?\n  - How do you ensure the privacy of data used in your AI models?\n  - How do you explain and interpret the decisions made by your AI models?\n  - How do you manage and control access to your AI models and data?\n  - How do you ensure compliance with regulations and standards related to\n    AI and ML?\n  - How do you monitor and detect anomalies in the behavior of your AI models?\n  - How do you handle and respond to security incidents involving your AI\n    models?\n  - How do you educate and train your employees on the secure and responsible\n    use of AI and ML?\n\n- **AI for security**:\n\n  - How do you leverage AI and ML to enhance your security posture?\n  - What types of AI models do you use for security purposes?\n  - How do you train and validate your AI models for security applications?\n  - How do you ensure the accuracy and reliability of AI-based security\n    systems?\n  - How do you handle false positives and false negatives from AI-based\n    security systems?\n  - How do you integrate AI-based security systems with your existing security\n    infrastructure?\n  - How do you manage and update your AI models for security applications?\n  - How do you explain and interpret the decisions made by your AI models for\n    security applications?\n  - How do you ensure the ethical and responsible use of AI and ML for security\n    purposes?\n  - How do you measure the effectiveness of AI and ML in improving your security\n    posture?\n\n- **Regulatory compliance and privacy**:\n\n  - What regulatory compliance frameworks and privacy standards do you need to\n    adhere to?\n  - How do you assess and manage compliance risks in your Google Cloud\n    environment?\n  - How do you ensure the privacy of sensitive data stored and processed in\n    Google Cloud?\n  - How do you handle data subject requests (DSRs) related to privacy\n    regulations?\n  - How do you document and track compliance activities and evidence?\n  - How do you ensure that third-party vendors and partners comply with your\n    regulatory and privacy requirements?\n  - How do you handle data breaches and security incidents related to compliance\n    regulations?\n  - How do you stay up-to-date with changes in regulatory compliance and privacy\n    standards?\n  - How do you educate and train your employees on regulatory compliance and\n    privacy requirements?\n  - How do you demonstrate and prove compliance to auditors and regulators?\n\n## Validation checklist\n\nUse the following checklist to evaluate the architecture's alignment with\nsecurity recommendations:\n\n- **Security by design**:\n\n  - Are system components selected based on their security features and\n    hardening?\n  - Is defense-in-depth implemented at the network, host, and application\n    layers?\n  - Are safe libraries and application frameworks used to prevent common\n    vulnerabilities?\n  - Is a risk assessment performed using industry standards?\n\n- **Zero trust**:\n\n  - Is access control enforced based on user identity and context (device,\n    location)?\n  - Are private connectivity methods (Cloud Interconnect, VPN) used for internal\n    traffic?\n  - Are default networks disabled in all projects?\n  - Are VPC Service Controls perimeters established around sensitive data?\n\n- **Shift-left security**:\n\n  - Is infrastructure provisioned using Infrastructure as Code\n    (e.g., Terraform)?\n  - Are automated security scans integrated into the CI\u002FCD pipeline?\n  - Is there a process for scanning and patching vulnerabilities in\n    dependencies?\n  - Is Binary Authorization used to ensure only trusted images are deployed?\n\n- **Preemptive cyber defense**:\n\n  - Is threat intelligence integrated into security operations?\n  - Is security logging enabled and centralized for all critical resources?\n  - Are automated responses configured for common security threats?\n  - Are defenses validated through periodic testing or red-teaming?\n\n- **AI security and governance**:\n\n  - Are AI pipelines secured against tampering and data poisoning?\n  - Is differential privacy or data masking used for training data where\n    appropriate?\n  - Are Vertex Explainable AI and fairness indicators used for model governance?\n","# Google Cloud Well-Architected Framework skill for the Security pillar\n\n## Overview\n\nThe security pillar of the Google Cloud Well-Architected Framework provides\ndesign principles and best practices for building a robust security posture by\nintegrating security into every layer of the architecture for cloud workloads.\nIt focuses on maintaining confidentiality and integrity of data and systems\nwhile ensuring compliance and privacy. It provides a structured approach to risk\nmanagement, threat defense, and identity control, enabling you to operate cloud\nworkloads securely and at scale.\n\n## Core principles\n\nThe recommendations in the security pillar of the Well-Architected Framework are\naligned with the following core principles:\n\n-  **Implement security by design**: Integrate cloud security and network\n   security considerations starting from the initial design phase of your\n   applications and infrastructure. Google Cloud provides architecture\n   blueprints and recommendations to help you apply this principle. Grounding\n   document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-security-by-design\n\n-  **Implement zero trust**: Use a _never trust, always verify_ approach, where\n   access to resources is granted based on continuous verification of trust.\n   Google Cloud supports this principle through products like Chrome Enterprise\n   Premium and Identity-Aware Proxy (IAP). Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-zero-trust\n\n-  **Implement shift-left security**: Implement security controls early in the\n   software development lifecycle. Avoid security defects before system changes\n   are made. Detect and fix security bugs early, fast, and reliably after the\n   system changes are committed. Google Cloud supports this principle through\n   products like Cloud Build, Binary Authorization, and Artifact Registry.\n   Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-shift-left-security\n\n-  **Implement preemptive cyber defense**: Adopt a proactive approach to\n   security by implementing robust fundamental measures like threat\n   intelligence. This approach helps you build a foundation for more effective\n   threat detection and response. Google Cloud's approach to layered security\n   controls aligns with this principle. Google Cloud supports this principle\n   through products like Security Command Center, Google Threat Intelligence,\n   and Google SecOps. Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-preemptive-cyber-defense\n\n-  **Use AI securely and responsibly**: Develop and deploy AI systems in a\n   responsible and secure manner. The recommendations for this principle are\n   aligned with guidance in the AI and ML perspective of the Well-Architected\n   Framework and in Google's Secure AI Framework (SAIF). Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-securely-and-responsibly\n\n-  **Use AI for security**: Use AI capabilities to improve your existing\n   security systems and processes through Gemini in Security and overall\n   platform-security capabilities. Use AI as a tool to increase the automation\n   of remedial work and ensure security hygiene to make other systems more\n   secure. Google Cloud supports this principle through products like Google\n   Threat Intelligence and Google SecOps. Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-for-security\n\n-  **Meet regulatory, compliance, and privacy needs**: Adhere to\n   industry-specific regulations, compliance standards, and privacy\n   requirements. Google Cloud helps you meet these obligations through products\n   like Assured Workloads, Organization Policy Service, and our compliance\n   resource center. Grounding document:\n   https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fmeet-regulatory-compliance-and-privacy-needs\n\n## Relevant Google Cloud products\n\nThe following are _examples_ of Google Cloud products and features that are\nrelevant to security:\n\n- **Identity and access management**\n\n  - **Identity and Access Management (IAM)**: Fine-grained access control for\n    Google Cloud resources.\n  - **Identity-Aware Proxy (IAP)**: Secure access to applications without a VPN.\n  - **Chrome Enterprise Premium**: Endpoint security and context-aware access.\n\n- **Network security**\n\n  - **Google Cloud Armor**: DDoS protection and Web Application Firewall (WAF).\n  - **VPC Service Controls**: Define security perimeters to prevent data\n    exfiltration.\n  - **Cloud Next-Generation Firewall (NGFW)**: Advanced threat protection for\n    network traffic.\n  - **Shared VPC**: Centralized network management across projects.\n  - **Cloud Interconnect and IPsec VPN**: Secure, private connectivity.\n\n- **Data security**\n\n  - **Cloud Key Management Service (KMS)**: Manage encryption keys.\n  - **Sensitive Data Protection (formerly Cloud DLP)**: Discover and redact\n    sensitive data.\n  - **Confidential Computing**: Encrypt data in use (memory).\n\n- **Security operations (SecOps)**\n\n  - **Google SecOps (Chronicle)**: Threat detection and security analytics.\n  - **Security Command Center (SCC)**: Centralized vulnerability and threat\n    management.\n  - **Cloud Logging and Cloud Monitoring**: Visibility into system activity.\n\n- **Automation and supply chain**\n\n  - **Cloud Build**: Secure CI\u002FCD pipelines.\n  - **Artifact Analysis**: Vulnerability scanning for container images.\n  - **Binary Authorization**: Deploy-time policy enforcement.\n  - **Assured open source software**: Use secured OSS packages.\n\n## Workload assessment questions\n\nAsk appropriate questions to understand the security-related requirements and\nconstraints of the workload and the user's organization. Choose questions from\nthe following list:\n\n- **Security by design**:\n\n  - How do you incorporate security considerations into your project's initial\n    planning and design phases?\n  - How do you define and document security requirements for new applications\n    and services?\n  - How do you ensure that security is integrated into your development\n    lifecycle?\n  - What tools and techniques do you use to perform threat modeling during the\n    design phase?\n  - How do you manage and prioritize security vulnerabilities discovered during\n    the design and development process?\n  - How do you handle security updates and patches for your applications and\n    infrastructure?\n  - How do you document and communicate security design decisions to your team\n    and stakeholders?\n  - How do you ensure that security configurations are consistently applied\n    across your environments?\n  - How do you validate the effectiveness of your security controls and\n    measures?\n  - How do you handle security exceptions and deviations from your security\n    design?\n\n- **Zero trust**:\n\n  - How do you verify and authenticate users and devices accessing your Google\n    Cloud resources?\n  - How do you implement the principle of least privilege for access control?\n  - How do you monitor and control network traffic within your Google Cloud\n    environment?\n  - How do you secure data in transit and at rest in your Google Cloud\n    environment?\n  - How do you implement continuous monitoring and logging of user and device\n    activity?\n  - How do you handle and respond to security incidents and breaches in a Zero\n    Trust environment?\n  - How do you manage and update security policies and controls in a Zero Trust\n    environment?\n  - How do you ensure that third-party applications and services comply with\n    your Zero Trust principles?\n  - How do you handle remote access and BYOD devices in a Zero Trust\n    environment?\n  - How do you educate and train your employees on Zero Trust principles and\n    practices?\n\n- **Shift-left security**:\n\n  - How do you integrate security testing into your development pipeline early\n    in the process?\n  - What types of security testing do you perform during the development phase?\n  - How do you provide developers with feedback on security vulnerabilities and\n    best practices?\n  - How do you empower developers to take ownership of security in their code?\n  - How do you ensure that security requirements are clearly defined and\n    communicated to developers?\n  - How do you measure the effectiveness of your Shift Left security\n    initiatives?\n  - How do you handle security dependencies and third-party libraries in your\n    code?\n  - How do you manage and update security configurations in your development\n    environment?\n  - How do you handle security exceptions and deviations from your security\n    policies in development?\n  - How do you promote a culture of security awareness and responsibility among\n    developers?\n\n- **Preemptive cyber defense**:\n\n  - How do you proactively identify and mitigate potential security threats\n    before they impact your systems?\n  - What tools and techniques do you use for continuous security monitoring and\n    analysis?\n  - How do you respond to and remediate security alerts and incidents?\n  - How do you simulate and test your incident response plans?\n  - How do you stay up-to-date with the latest security threats and\n    vulnerabilities?\n  - How do you handle and mitigate DDoS attacks against your applications and\n    services?\n  - How do you protect your sensitive data from insider threats?\n  - How do you ensure that your security controls are effective against advanced\n    persistent threats (APTs)?\n  - How do you handle security vulnerabilities in your supply chain?\n  - How do you adapt your security posture to evolving threats and technologies?\n\n- **Security of AI workloads**:\n\n  - How do you ensure the security of your AI models and data?\n  - How do you address potential biases and ethical concerns in your AI models?\n  - How do you protect your AI models from adversarial attacks and data\n    poisoning?\n  - How do you ensure the privacy of data used in your AI models?\n  - How do you explain and interpret the decisions made by your AI models?\n  - How do you manage and control access to your AI models and data?\n  - How do you ensure compliance with regulations and standards related to\n    AI and ML?\n  - How do you monitor and detect anomalies in the behavior of your AI models?\n  - How do you handle and respond to security incidents involving your AI\n    models?\n  - How do you educate and train your employees on the secure and responsible\n    use of AI and ML?\n\n- **AI for security**:\n\n  - How do you leverage AI and ML to enhance your security posture?\n  - What types of AI models do you use for security purposes?\n  - How do you train and validate your AI models for security applications?\n  - How do you ensure the accuracy and reliability of AI-based security\n    systems?\n  - How do you handle false positives and false negatives from AI-based\n    security systems?\n  - How do you integrate AI-based security systems with your existing security\n    infrastructure?\n  - How do you manage and update your AI models for security applications?\n  - How do you explain and interpret the decisions made by your AI models for\n    security applications?\n  - How do you ensure the ethical and responsible use of AI and ML for security\n    purposes?\n  - How do you measure the effectiveness of AI and ML in improving your security\n    posture?\n\n- **Regulatory compliance and privacy**:\n\n  - What regulatory compliance frameworks and privacy standards do you need to\n    adhere to?\n  - How do you assess and manage compliance risks in your Google Cloud\n    environment?\n  - How do you ensure the privacy of sensitive data stored and processed in\n    Google Cloud?\n  - How do you handle data subject requests (DSRs) related to privacy\n    regulations?\n  - How do you document and track compliance activities and evidence?\n  - How do you ensure that third-party vendors and partners comply with your\n    regulatory and privacy requirements?\n  - How do you handle data breaches and security incidents related to compliance\n    regulations?\n  - How do you stay up-to-date with changes in regulatory compliance and privacy\n    standards?\n  - How do you educate and train your employees on regulatory compliance and\n    privacy requirements?\n  - How do you demonstrate and prove compliance to auditors and regulators?\n\n## Validation checklist\n\nUse the following checklist to evaluate the architecture's alignment with\nsecurity recommendations:\n\n- **Security by design**:\n\n  - Are system components selected based on their security features and\n    hardening?\n  - Is defense-in-depth implemented at the network, host, and application\n    layers?\n  - Are safe libraries and application frameworks used to prevent common\n    vulnerabilities?\n  - Is a risk assessment performed using industry standards?\n\n- **Zero trust**:\n\n  - Is access control enforced based on user identity and context (device,\n    location)?\n  - Are private connectivity methods (Cloud Interconnect, VPN) used for internal\n    traffic?\n  - Are default networks disabled in all projects?\n  - Are VPC Service Controls perimeters established around sensitive data?\n\n- **Shift-left security**:\n\n  - Is infrastructure provisioned using Infrastructure as Code\n    (e.g., Terraform)?\n  - Are automated security scans integrated into the CI\u002FCD pipeline?\n  - Is there a process for scanning and patching vulnerabilities in\n    dependencies?\n  - Is Binary Authorization used to ensure only trusted images are deployed?\n\n- **Preemptive cyber defense**:\n\n  - Is threat intelligence integrated into security operations?\n  - Is security logging enabled and centralized for all critical resources?\n  - Are automated responses configured for common security threats?\n  - Are defenses validated through periodic testing or red-teaming?\n\n- **AI security and governance**:\n\n  - Are AI pipelines secured against tampering and data poisoning?\n  - Is differential privacy or data masking used for training data where\n    appropriate?\n  - Are Vertex Explainable AI and fairness indicators used for model governance?\n",{"name":5,"metadata":46,"description":7},{"source":47},"google\u002Fskills (Apache 2.0)","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fgoogle-cloud-waf-security",3931,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-14 06:14:46",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add davila7\u002Fclaude-code-templates --skill google-cloud-waf-security",{"tool":64,"command":65},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill google-cloud-waf-security",{"tool":67,"command":68},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill google-cloud-waf-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fgoogle-cloud-waf-security\u002FSKILL.md",true,[72,78,84,88,92,96,100,104,108,112,116,120,124,128,132,136,140,144],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"sections\u002Fadversarial.md","REFERENCE","参考文档",13701,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fadversarial.md",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"sections\u002Fadversarial.md.tmpl","OTHER","其他",1217,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fadversarial.md.tmpl",{"path":85,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":86,"sourceHtmlUrl":87},"sections\u002Fchangelog.md",1869,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fchangelog.md",{"path":89,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":90,"sourceHtmlUrl":91},"sections\u002Fchangelog.md.tmpl",28,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fchangelog.md.tmpl",{"path":93,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":94,"sourceHtmlUrl":95},"sections\u002Fgreptile.md",3443,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fgreptile.md",{"path":97,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":98,"sourceHtmlUrl":99},"sections\u002Fgreptile.md.tmpl",3328,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fgreptile.md.tmpl",{"path":101,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":102,"sourceHtmlUrl":103},"sections\u002Fmanifest.json",2077,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fmanifest.json",{"path":105,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":106,"sourceHtmlUrl":107},"sections\u002Fplan-completion.md",20692,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fplan-completion.md",{"path":109,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":110,"sourceHtmlUrl":111},"sections\u002Fplan-completion.md.tmpl",2074,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fplan-completion.md.tmpl",{"path":113,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":114,"sourceHtmlUrl":115},"sections\u002Fpr-body.md",11307,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fpr-body.md",{"path":117,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":118,"sourceHtmlUrl":119},"sections\u002Fpr-body.md.tmpl",11193,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Fpr-body.md.tmpl",{"path":121,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":122,"sourceHtmlUrl":123},"sections\u002Freview-army.md",21564,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Freview-army.md",{"path":125,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":126,"sourceHtmlUrl":127},"sections\u002Freview-army.md.tmpl",3301,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Freview-army.md.tmpl",{"path":129,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":130,"sourceHtmlUrl":131},"sections\u002Ftest-coverage.md",14083,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Ftest-coverage.md",{"path":133,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":134,"sourceHtmlUrl":135},"sections\u002Ftest-coverage.md.tmpl",1393,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Ftest-coverage.md.tmpl",{"path":137,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":138,"sourceHtmlUrl":139},"sections\u002Ftests.md",16529,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Ftests.md",{"path":141,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":142,"sourceHtmlUrl":143},"sections\u002Ftests.md.tmpl",4706,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002Fsections\u002Ftests.md.tmpl",{"path":145,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":146,"sourceHtmlUrl":147},"SKILL.md.tmpl",25331,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fship\u002FSKILL.md.tmpl",[149,179,206,239,274,298],{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":160,"publishedAt":41},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[155],{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[161,162,163,164,165,26,166,167,32,168,169,170,171,172,173,174,175,176,177,178],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","when","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":41},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[185],{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},[187,188,189,190,191,192,193,194,195,196,197,168,198,199,200,201,202,203,204,205],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":221,"publishedAt":41},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[212,215,216],{"categoryNo":213,"categoryName":214,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},{"categoryNo":217,"categoryName":218,"taxonomyType":219,"taxonomyTypeDesc":220},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[222,223,224,225,226,227,228,26,229,230,231,232,233,234,235,32,236,237,168,238],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":243,"licenseFileUrl":244,"sourceHtmlUrl":245,"categories":246,"keywords":250,"publishedAt":41},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[247],{"categoryNo":248,"categoryName":249,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000009","前端开发",[251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,26,273],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":275,"name":276,"nameZh":6,"description":277,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":243,"licenseFileUrl":278,"sourceHtmlUrl":279,"categories":280,"keywords":285,"publishedAt":41},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[281,284],{"categoryNo":282,"categoryName":283,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":248,"categoryName":249,"taxonomyType":158,"taxonomyTypeDesc":159},[286,287,288,289,290,252,291,261,262,292,293,294,295,26,296,170,297],"webapp testing","testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":299,"name":300,"nameZh":6,"description":301,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":243,"licenseFileUrl":302,"sourceHtmlUrl":303,"categories":304,"keywords":312,"publishedAt":41},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[305,308,309],{"categoryNo":306,"categoryName":307,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},{"categoryNo":310,"categoryName":311,"taxonomyType":219,"taxonomyTypeDesc":220},"01JBSEEDCAT000000000000036","内容创作者",[313,314,315,316,317,318,34,319,254,320,264,198,321,322,323,324,325,234,326,168,327,328,329,330,331,176,28],"discernment nudge","nudge","interpretation","help","run","reasoning","writing","lookup","content","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble"]