feelthefusionfeelthefusion/skill-starter-kit/skills/cloud-clis/SKILL.md

cloud-clis

Skill0 starsChanged 50 days agoUnlicenseView on GitHub

Operate GitHub, Railway, Cloudflare, AWS, Google Cloud and Google Workspace from the terminal: which CLI does what (gh, railway, wrangler/cloudflared, aws, gcloud, gws, gam), how to check you're signed in, deploy, read logs, manage env vars/secrets, DNS, storage and databases — CLI first, MCP opt-in. Use for any deploy, hosting, domain, DNS, bucket, database, env var, log, PR/issue/release or CI task on these platforms.

In this repository10 other files it gives its agents.
- skill-starter-kitSkill
- browser-verifySkill
- consistencySkill
- docs-freshnessSkill
- github-mcpSkill
- guardrailsSkill
- lsp-pluginsSkill
- security-gateSkill
- taste-codeSkill
- verify-gateSkill

The file

We split this skill into the rules it gives an agent

3 rules. About 0 are common, 1 is distinctive, and 2 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Very specific:
Not signed in → run the login yourself (gh auth login, railway login, wrangler login, aws configure sso, gcloud auth login, gws auth login …
line 25
Distinctive:
CLI first: Prefer the CLI over an MCP server: no standing context cost, same on both hosts.
line 30
Very specific:
Secrets stay out of the transcript: Read variable *names*, not values (railway variables --json | jq -r 'keys[]', wrangler secret list, aws …
line 36

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Cloud CLIs: GitHub · Railway · Cloudflare · AWS · Google Cloud · Google Workspace

The kit installs all seven CLIs and the vendors' own skills (use-railway, cloudflare, wrangler, workers-best-practices, deploy-on-aws, gcloud, and on Claude Code the core gws-* skills — Hermes' bundled google-workspace skill already drives gws). This skill is the router: which tool, signed in as whom, and the few rules that keep deploys boring.

Which CLI for what

Platform	CLI	Signed in?	Typical jobs	Vendor skill
GitHub	`gh`	`gh auth status`	PRs, issues, releases, Actions runs/logs (`gh run view --log-failed`), `gh api` for anything else	— (`github-mcp` for the read-only MCP)
Railway	`railway`	`railway whoami`	link project/service, deploy (`railway up`), logs, env vars, domains, Postgres	`use-railway`
Cloudflare	`wrangler` (+ `cloudflared`)	`wrangler whoami`	Workers/Pages deploy, D1, R2, KV, Queues, secrets, DNS via API; `cloudflared` for tunnels	`cloudflare` (product choice), `wrangler`, `workers-best-practices`
AWS	`aws`	`aws sts get-caller-identity`	S3, SES, IAM, Lambda, RDS, CloudFront, CloudWatch logs; architecture + IaC	`deploy-on-aws`
Google Cloud	`gcloud` (+ `gsutil`, `bq`)	`gcloud auth list` · `gcloud config list`	Cloud Run, Cloud SQL, GCS, BigQuery, IAM, logs (`gcloud logging read`), APIs & credentials	`gcloud`
Google Workspace (user data)	`gws`	`gws auth status`	Gmail, Drive, Calendar, Sheets, Docs, Slides, Chat, Tasks; JSON in/out; `gws schema <method>` for any API	`gws-shared` + `gws-gmail` · `-drive` · `-calendar` · `-sheets` · `-docs` · `-slides` · `-admin-reports`
Google Workspace (admin)	`gam` (GAM7)	`gam oauth info`	users, groups, OUs, aliases, licenses, shared drives, bulk CSV (`gam csv users.csv gam update user ~email …`), audits	— (`gam help`, GAM wiki)

Not signed in → run the login yourself (gh auth login, railway login, wrangler login, aws configure sso, gcloud auth login, gws auth login (first time: gws auth setup), gam oauth create) — each opens the browser; the user clicks approve once.

Rules

CLI first. Prefer the CLI over an MCP server: no standing context cost, same on both hosts. Ask for JSON and filter it (gh … --json, railway … --json, aws … --output json --query, wrangler whoami --json, gcloud … --format=json) instead of pasting whole tables.
Check the target before you change it. Print the account/project/environment first (railway status, wrangler whoami, aws sts get-caller-identity, gcloud config get project, gh repo view) — the classic mistake is deploying to the wrong project or account.
Secrets stay out of the transcript. Read variable names, not values (railway variables --json | jq -r 'keys[]', wrangler secret list, aws ssm describe-parameters). railway variables / --kv print raw values — never run them bare. Set secrets from a file or stdin, never inline in a command. Never print tokens (gws auth export, gcloud auth print-access-token are blocked).
Deploy after ./verify.sh is green, then prove the deploy: health endpoint / curl -I, deploy logs, and the browser (browser-verify) on the live URL.
GAM changes real users. Preview bulk jobs first (gam print users query "…" / a CSV of targets), run on one account, then the batch.
Irreversible cloud deletes are blocked by guard.sh (buckets, databases, stacks, instances, Railway projects/services/environments/volumes, Workers, D1/R2/KV, GCP projects/SQL/ buckets, Workspace users/groups/shared drives, permanent Drive/Gmail deletes, repos). If one is genuinely intended, the user runs it by hand.

MCP servers (opt-in)

The vendors also ship MCP servers. Enable one only when the CLI can't do the job:

Railway: claude mcp add --transport http railway https://mcp.railway.com
Cloudflare: claude mcp add --transport http cloudflare https://mcp.cloudflare.com/mcp
Google Cloud: npx -y @google-cloud/gcloud-mcp (googleapis/gcloud-mcp)
AWS: /plugin marketplace add awslabs/agent-plugins → /plugin install deploy-on-aws@agent-plugins-for-aws (IaC, pricing, knowledge MCPs)

Hermes: hermes mcp add <name> --url <url>.

Works with →

verify-gate — green ./verify.sh before any deploy; browser-verify checks the live URL after.
guardrails — guard.sh blocks irreversible cloud deletes and credential-dir reads.
security-gate — gitleaks before a push; zizmor for Actions workflows you create with gh.
github-mcp — the read-only GitHub MCP when gh isn't enough.
docs-freshness — <cli> --help and the vendor skill beat memory; CLIs change fast.

Verification

gh --version && railway --version && wrangler --version && aws --version && gcloud --version && gws --version && gam version all print.
The seven "signed in?" commands name the right account.
guard.sh blocks aws s3 rb s3://x --force, railway delete, wrangler d1 delete x and gh repo delete.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free