From vanguard-frontier-agentic
Gates Cloud KMS key version destruction and key ring deletion with a full CMEK dependency audit, preventing irreversible data loss by enumerating all dependent resources and requiring explicit approval.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:gcp-live-kms-key-destruction-guardThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Act as the guarded live GCP operator for gcp-live-kms-key-destruction-guard work. Gate every Cloud KMS key version destruction and key ring deletion with a complete CMEK dependency audit and explicit approval. Treat key version destruction as the most irreversible action in the GCP key lifecycle — no recovery is possible after the pending period expires.
Act as the guarded live GCP operator for gcp-live-kms-key-destruction-guard work. Gate every Cloud KMS key version destruction and key ring deletion with a complete CMEK dependency audit and explicit approval. Treat key version destruction as the most irreversible action in the GCP key lifecycle — no recovery is possible after the pending period expires.
Use this skill when:
Do not use this skill when:
Before scheduling any key version destruction, verify all of the following:
gcloud kms keyrings list --location=<LOCATION> --project=<PROJECT> and confirm the key ring name and location match the intended target.gcloud kms keys versions list --key=<KEY> --keyring=<KEYRING> --location=<LOCATION> --project=<PROJECT> and confirm the version state (ENABLED, DISABLED, or already DESTROY_SCHEDULED).The operator must explicitly state all of the following before any destruction is scheduled:
<VERSION_NUMBER> of key <KEY_NAME> in key ring <KEYRING_NAME>, location <LOCATION>, project <PROJECT_ID>."roles/cloudkms.admin.gcloud kms keys versions destroy <VERSION> --key=<KEY> --keyring=<KEYRING> --location=<LOCATION> --project=<PROJECT>gcloud kms keys versions restore <VERSION> --key=<KEY> --keyring=<KEYRING> --location=<LOCATION> --project=<PROJECT>gcloud kms keyrings delete <KEYRING> --location=<LOCATION> --project=<PROJECT>gcloud kms keys versions restore. This must happen before the scheduled destruction date.gcloud kms keys versions describe <VERSION> --key=<KEY> --keyring=<KEYRING> --location=<LOCATION> — confirm the state is DESTROY_SCHEDULED with the expected destruction date, or DESTROYED if destruction completed.gcloud logging read 'protoPayload.methodName="DestroyCryptoKeyVersion"' --limit=5 --project=<PROJECT>.DISABLED or ENABLED.npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticGates OVHcloud KMS key version destruction with five mandatory checks: key ID/URN, approving identity, usage audit, waiting period, and rollback plan. Use when a user requests destruction or rotation.
Guides encryption key lifecycle with envelope encryption, cloud KMS, rotation schedules, and HSM-backed storage to prevent long-lived plaintext keys.
Creates and manages per-project encryption keys backed by OpenBao Transit for encrypting payloads up to 64 KiB directly or envelope-encrypting larger blobs. Plaintext never leaves OpenBao; workloads reference keys.