Google Workspace Cli

# Create a "Google Workspace Cli" AI Skill

I want you to help me set up a reusable AI skill that I can use in future conversations. Read the complete skill definition below, then help me install it.

## Complete Skill Definition

# Google Workspace CLI

> **Category:** Engineering
> **Domain:** Google Workspace Administration

## Overview

The **Google Workspace CLI** skill provides tools for auditing Google Workspace configurations, generating authentication setup documentation, and diagnosing common GWS issues. It helps IT administrators maintain secure, well-configured Workspace environments without needing to navigate complex admin consoles.

## Quick Start

```bash
# Audit Workspace security configuration
python scripts/workspace_audit.py --config gws-config.json

# Generate auth setup guide
python scripts/auth_setup_guide.py --method oauth --scopes admin,drive

# Run diagnostics
python scripts/gws_doctor.py --check all

# JSON output for automation
python scripts/workspace_audit.py --config gws-config.json --format json
```

## Tools Overview

### workspace_audit.py

Audits Google Workspace configuration exports for security best practices.

| Feature | Description |
|---------|-------------|
| 2FA enforcement | Checks if 2-step verification is required |
| Password policy | Validates password strength requirements |
| Sharing settings | Reviews external sharing configurations |
| App access | Checks third-party app access policies |
| Admin roles | Reviews admin role assignments |
| Mobile management | Checks device management policies |
| Drive settings | Validates Drive sharing and access controls |

### auth_setup_guide.py

Generates step-by-step authentication setup documentation for GWS API access.

| Feature | Description |
|---------|-------------|
| OAuth setup | Generates OAuth 2.0 configuration guide |
| Service account | Creates service account setup documentation |
| API scopes | Lists required scopes for each API |
| Domain delegation | Documents domain-wide delegation setup |
| Testing guide | Provides verification steps |

### gws_doctor.py

Diagnostic tool for common Google Workspace configuration issues.

| Feature | Description |
|---------|-------------|
| DNS checks | Validates MX, SPF, DKIM, DMARC records format |
| SSL/TLS | Checks certificate and transport security settings |
| Integration health | Validates common integration patterns |
| Config consistency | Checks for conflicting settings |
| Best practices | Compares against GWS recommended settings |

## Workflows

### Security Audit Workflow

1. **Export config** - Export GWS settings to JSON via Admin SDK or manual export
2. **Audit** - Run workspace_audit.py against the config file
3. **Review findings** - Prioritize critical security gaps
4. **Remediate** - Apply recommended settings in Admin Console
5. **Re-audit** - Verify changes resolved findings

### API Setup Workflow

1. **Plan** - Determine which APIs and scopes are needed
2. **Generate guide** - Run auth_setup_guide.py with desired method
3. **Follow steps** - Create credentials in Google Cloud Console
4. **Configure** - Set up domain delegation if needed
5. **Verify** - Test API access with provided verification steps

### Health Check Workflow

1. **Run diagnostics** - Execute gws_doctor.py with all checks
2. **Review results** - Check DNS, email, and integration health
3. **Fix issues** - Address failures in priority order
4. **Re-check** - Verify fixes pass diagnostics

### Regular Maintenance

```bash
# Monthly security audit
python scripts/workspace_audit.py --config gws-export.json --format json > audit_$(date +%Y%m).json

# Weekly health check
python scripts/gws_doctor.py --check dns,email --format json
```

## Reference Documentation

- [GWS Admin Guide](references/gws-admin-guide.md) - Security settings, API configuration, DNS requirements

## Common Patterns Quick Reference

### Security Priorities
| Setting | Priority | Impact |
|---------|----------|--------|
| 2FA enforcement | Critical | Prevents account takeover |
| Password policy | Critical | Reduces credential attacks |
| External sharing | High | Prevents data leakage |
| App access control | High | Limits third-party risk |
| Mobile management | Medium | Secures device access |
| Admin role review | Medium | Limits privilege exposure |

### DNS Records for Email
| Record | Purpose | Example |
|--------|---------|---------|
| MX | Email routing | `ASPMX.L.GOOGLE.COM` |
| SPF | Sender verification | `v=spf1 include:_spf.google.com ~all` |
| DKIM | Email signing | Domain-specific CNAME |
| DMARC | Policy enforcement | `v=DMARC1; p=reject; rua=mailto:...` |

### API Scopes
| API | Scope | Purpose |
|-----|-------|---------|
| Admin SDK | `admin.directory.user` | User management |
| Drive | `drive.readonly` | File listing |
| Gmail | `gmail.settings.basic` | Email settings |
| Calendar | `calendar.readonly` | Calendar access |

### Common Issues
| Issue | Symptom | Fix |
|-------|---------|-----|
| No 2FA | Account takeover risk | Enable 2FA enforcement |
| Weak passwords | Credential stuffing | Set 12+ char minimum |
| Open sharing | Data leakage | Restrict external sharing |
| No DMARC | Email spoofing | Add DMARC DNS record |
| Stale admins | Excessive privileges | Review admin roles quarterly |

---

## What I Need You to Do

First, detect which platform I'm using (Claude.ai, ChatGPT, etc.) and follow the matching instructions below.

### If I'm on Claude.ai:

Walk me through these exact steps:

1. **Create the Project:** Tell me to go to **claude.ai > Projects > Create project** and name it **"Google Workspace Cli"**

2. **Add Project Knowledge:** Give me the COMPLETE skill definition above as a single copyable text block inside a code fence. Tell me to click **"Add content" > "Add text content"** inside the project, then paste that entire block. Do NOT say "paste from above" -- give me the actual text to copy right there.

3. **Set Custom Instructions:** Tell me to open project settings and paste this exact instruction:
   "You are an expert Google Workspace Cli in the Engineering domain. Use the project knowledge as your expertise. Follow the workflows, frameworks, and templates defined there. Always provide specific, actionable output."

4. **Test It:** Give me a specific sample prompt I can use inside the new project to verify it works. Pick a real task from the skill's workflows.

### If I'm on ChatGPT:

Walk me through these exact steps:

1. **Create a Custom GPT:** Tell me to go to **chatgpt.com > Explore GPTs > Create**
2. **Configure it:**
   - Name: **"Google Workspace Cli"**
   - Description: "Tools for auditing Google Workspace configurations, generating authentication setup documentation, and diagnosing common GWS issues. Helps IT administrators maintain secure, well-configured Workspace environments."
   - Instructions: Give me the COMPLETE skill definition above as a single copyable text block inside a code fence to paste into the Instructions field. Do NOT say "paste from above."
3. **Test It:** Give me a sample prompt to verify it works.

### If I'm on another platform:
Ask which tool I'm using and adapt the instructions accordingly.

## Important
- Always provide the full skill text in a ready-to-copy code block -- never tell me to "scroll up" or "copy from above"
- Keep the setup steps simple and numbered
- After setup, test it with me using a real workflow from the skill

Source: https://github.com/borghei/Claude-Skills/tree/main/engineering/google-workspace-cli/SKILL.md