Taming gcloud Hallucinations in AI Agents

Where this fits

You ask your coding agent to resize a Cloud SQL instance or update an IAM policy. The agent confidently generates a gcloud command with a flag that was deprecated two major versions ago. You run it, and the failure costs you ten minutes and a support ticket. This skill fixes that failure mode by forcing every AI-generated gcloud command through explicit leaf-level gcloud help validation before execution.

Why agents benefit

• Eliminates stale syntax knowledge: The skill treats all pre-existing gcloud knowledge as suspect, forcing fresh help-lookup for every leaf command.
• Safety-critical guardrails: It rejects unvalidated command proposals, so agents cannot silently execute hallucinated flags or malformed positionals.
• Data reduction: Instead of dumping entire help pages into context, it extracts only relevant flags and values, keeping token usage low.
• Better planning workflows: When an agent needs to outline multi-step GCP tasks, it includes help lookup as a mandatory step, not an afterthought.
• Scopes correctly: It knows when not to fire—client library code and raw REST/gRPC calls are out of scope, so it doesn't interfere with non-CLI work.

Practical scenarios

Resizing a managed instance group

Your agent proposes gcloud compute instance-groups managed resize my-group --size=5. Before suggesting it, the skill runs gcloud help instance-groups managed resize and discovers that --size is correct but --region is required. The final command includes the region, and the operation succeeds on the first try.

Updating IAM policies without breaking access

Your agent needs to add a role binding. The skill validates gcloud projects add-iam-policy-binding help output and catches that the --condition flag needs a specific --condition-from-file alternative. The agent adjusts its recommendation before you ever run a risky update.

Exploring new GCP services

You ask, "How do I list secrets in Secret Manager?" The agent answers from memory, but the skill forces a lookup of gcloud secrets list --help. It finds the correct --filter expression and --limit flag, avoiding a verbose, incorrect response.

Add it to your agent workflow

Install it with:

npx skills add google/skills --skill gcloud

Then instruct your agent to invoke the skill whenever a task involves gcloud. For example:

User: "Create a GCS bucket with a retention policy."
Agent: "I need to validate syntax first. Running gcloud help storage buckets create..."

This ensures every proposed command is grounded in current, authoritative help output.

Compare before adopting

Before adding it, compare with alternatives and internal patterns. Check quality signals: Does your agent currently hallucinate gcloud flags? Are you using multiple cloud ecosystems where this GCP-only skill sits awkwardly? Evaluate maintenance freshness: The gcloud CLI changes quarterly, so update the skill's reference data. Consider alternatives like a custom gcloud-help tool or a sandboxed-shell approach. Finally, assess workflow fit: This skill is ideal for agents that already plan before executing terminal commands, not for simple chat-only assistants.

Why it is worth tracking

Google maintains this skill on a public repository with over 19,000 stars, which signals strong adoption and ongoing updates. The underlying problem—hallucinating CLI syntax—is universal, and Google's approach of enforcing leaf-level validation is a practical pattern worth borrowing. You can also track this skill's adoption on OpenAgentSkill at https://www.openagentskill.com/skills/google-gcloud. Re-evaluate it when your agent starts orchestrating larger GCP migrations; the validation overhead may be worth the uptime and security guarantees.