Google services

Package · 9 skillsAvailable

Unofficial. Add Google login, maps, Firebase, analytics, Search Console, Sheets and Gemini to your site, with restricted keys and budget alerts.

Nine skills that help your agent add Google services to your site or app: Log in with Google, maps, Firebase, Google Analytics, Google Search, Google Sheets and Gemini AI. Most of these need a Google Cloud project (the folder in Google's systems that holds your keys, settings and bill) and a key (a password-like string that lets your app use a Google service). The package walks your agent through each service so keys stay private, are locked to what they need, and paid services have limits.

BackendSecurityFrontend

Claude Code
Codex CLI
GitHub Copilot
Cursor
Gemini CLI

Maintained by

Install Google services Source code Documentation

The problem

Each Google service needs a project and usually a key. Done carelessly, a key ends up in public code or in the browser with no restrictions, and someone else can use it while you pay the bill. Google's consoles also change their menus often, so steps copied from an old tutorial no longer match what you see.

Skills in Google services

Google services has 9 skills. Open one to see when to use it and how to install it on its own.

Google Analyticsgoogle-analyticsAdds Google Analytics 4 (GA4) to a website with a simple cookie consent banner, so visits are counted only after a visitor agrees.
Adds Google Analytics 4 (GA4) to a website with a simple cookie consent banner, so visits are counted only after a visitor agrees. Creates the GA4 property and web stream with the user, puts the measurement ID in an environment variable, loads Google's tag only after consent using Consent Mode, adds an accessible banner with equal Accept and Reject buttons and a way to change the choice later, and checks that visits show up in Realtime. Explains in plain words what consent laws generally ask for, without giving legal advice. Use when the user says "add Google Analytics", "add GA4", "how many people visit my site?", "I need a cookie banner for analytics", "Analytics shows no data", "תוסיף גוגל אנליטיקס לאתר", or "תוסיף באנר עוגיות". Not for Google Ads or ad tracking pixels, not for Search Console data (use google-search-console), and not for other analytics tools.
Adds Google Analytics 4 to your site with a simple cookie banner, so visits are counted only after a visitor agrees. Your agent helps you create the Analytics property, adds an accessible banner with equal Accept and Reject buttons, loads Google's tag only after Accept, and checks that visits show up in Google's live report.
When to use
The user wants visitor numbers or GA4 on their site.

The user needs a cookie banner for analytics.

GA4 shows no data, or shows data before anyone agreed.

Examples: "Add Google Analytics to my site", "Add GA4 to my Next.js app", "How many people visit my site?", "I need a cookie banner for analytics", "תוסיף גוגל אנליטיקס לאתר", "תוסיף באנר עוגיות".

Do not use this skill:

for Google Ads conversion tracking or ad pixels.

to put the measurement ID on the host. This skill names it; deploy-frontend-env puts it on the host.

for search rankings and indexing. Use google-search-console.

for legal advice. Say plainly this is not legal advice, and that a business with legal questions should ask a lawyer.
Examples
User: "Add Google Analytics to my Next.js site."

Agent: Finds no existing tag. Walks the user through creating the property and web stream; the user shares the G- ID. Adds NEXT_PUBLIC_GA_MEASUREMENT_ID, a small banner with Accept and Reject and a footer link, and renders GoogleAnalytics only after Accept. Checks in the browser that nothing loads before a choice or after Reject, and that Accept sends a request. The user sees the visit in Realtime.

User: "תוסיף באנר עוגיות לאנליטיקס"

Agent: Answers in Hebrew. Finds GA4 already loaded on every page without consent. Explains why that is a problem in plain words, without legal advice, and with a yes moves the tag behind a consent banner. Verifies nothing loads before Accept.

User: "Analytics shows zero visitors."

Agent: Checks the ID variable is set on the host, that the stream's address matches the site, and whether the tag only loads after consent (then visitors who reject are not counted, which is expected). Opens the site, accepts, and has the user watch Realtime.
The problem
In many places, such as the EU and the UK, sites must ask before setting analytics cookies. Many setups load Google's tag on every page before anyone has agreed.
What it does
- Nothing loads before a yes
  Google's tag is set to denied by default and loads only after the visitor clicks Accept. On Reject, nothing loads.
- A fair, accessible banner
  One sentence on what is collected, a link to your privacy policy, and Accept and Reject buttons of equal size. Works with a keyboard and has a footer link to change the choice later.
- Works with what you have
  If your site already has a Google tag or a consent tool, your agent works with it instead of adding a second one.
- Checks data arrives
  Checks in the browser that nothing loads before a choice or after Reject, and that Accept sends a visit. You confirm it in the Realtime report.
How it works
Google Analytics needs no Google Cloud project or billing. You create the property in Google Analytics, and the ID it shows (starting with G-) is not a secret. Your agent puts it in an environment variable and adds the banner and tag after you say yes.
After the site is deployed, your agent checks again on the live site. It explains in plain words what consent rules generally ask for, and says plainly that this is not legal advice.
Safety and limitations
Required permissions
Read your project and add the banner, the tag and the environment variable, after you say yes.
Limitations
It is not legal advice. A business with legal questions should ask a lawyer.
Advertising settings stay denied unless you run ads and ask.
It does not cover Google Ads tracking or other analytics tools.
Putting the ID on your host is done by deploy-frontend-env.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-analytics \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google Firebasegoogle-firebaseAdds Firebase to a web app safely, covering Firestore (the database), Cloud Storage (file uploads) and Firebase Hosting.
Adds Firebase to a web app safely, covering Firestore (the database), Cloud Storage (file uploads) and Firebase Hosting. Writes security rules that start closed and give each user only their own data (never allow-all or a "test mode" that expires), tests them on the Firebase emulator before anything goes live, restricts the web API key, and deploys rules or the site only with the user's yes. Explains which parts need the pay-as-you-go plan, from the live pricing page. Use when the user says "add Firebase", "set up Firestore", "my Firestore rules are in test mode", "Firebase says my database is insecure", "upload images to Firebase Storage", "deploy to Firebase Hosting", "תחבר את האפליקציה ל-Firebase", or "תכתוב לי חוקי אבטחה ל-Firestore". Not for Google login with Firebase Auth (use google-sign-in), not for hosting on Vercel, Netlify, Cloudflare Pages or GitHub Pages (use deploy-frontend-*), and not for Supabase.
Adds Firebase to your web app: Firestore (the database), Cloud Storage (file uploads) and Firebase Hosting. Your agent writes security rules that start closed and give each user only their own data, tests them on your computer with the Firebase emulator, and puts rules or the site live only after you say yes.
When to use
The user wants a database, file uploads or hosting with Firebase.

Firebase warned that the rules are insecure or test mode is ending.

The app has allow read, write: if true; or a request.time < rule.

Examples: "Add Firebase to my React app", "Set up Firestore", "My Firestore rules are in test mode", "Let users upload a profile photo", "Deploy to Firebase Hosting", "תחבר את האפליקציה ל-Firebase", "תכתוב לי חוקי אבטחה ל-Firestore".

Do not use this skill:

for "Log in with Google". Use google-sign-in (it covers Firebase Auth). Rules here assume users log in somehow.

to host on Vercel, Netlify, Cloudflare Pages or GitHub Pages. Use deploy-frontend-choose and deploy-frontend-launch.

for Supabase or another database.
Examples
User: "Firebase emailed me that my Firestore rules are insecure."

Agent: Reads firestore.rules and finds a test-mode rule that allows everything until a date. Explains that anyone with the project ID can read and change all data now. Asks what the app stores; it is per-user to-do lists. Writes owner-only rules, adds three emulator tests, runs them (the "other user" and "logged out" tests are denied), then with a yes deploys only the rules, and checks the console.

User: "תוסיף אפשרות להעלות תמונת פרופיל ל-Firebase Storage"

Agent: Answers in Hebrew. Reads the pricing page and explains Storage needs the Blaze plan; checks there is a budget alert and asks before the user upgrades. Writes Storage rules allowing each user to write only users/<their id>/avatar, images under 5 MB, tests on the emulator, then deploys the rules after a yes.

User: "Just set the rules to allow everything for now so it works."

Agent: Explains that would let anyone read and delete all the data, and offers the smallest safe rule that lets the feature work for logged-in users.
The problem
In a Firebase web app, the browser talks to the database directly and the settings in your code are public by design. The security rules are the only thing that decides who can read or change data. Rules that allow everything, or a "test mode" that allows everything until a date, are how Firebase data leaks.
What it does
- Rules that start closed
  Starts from "deny everything" and opens only what each kind of data needs, for example each user can read and change only their own notes. Never allow-all rules or date-based rules.
- Tested before going live
  Adds tests that the owner can read and write, and that another user and a logged-out visitor cannot. It does not go on until the "cannot" tests pass.
- Checks the right project
  Before putting rules live, checks which Firebase project is active and names it, so a test project and a live project are not mixed up.
- Clear about the paid plan
  Reads Firebase's current pricing page and explains which parts need the pay-as-you-go plan, such as Storage, after a budget alert exists.
How it works
Your agent reads any existing rules and flags allow-all or test-mode rules at once, then asks in plain words what your app stores and who should see it. It sets up the Firebase tools only for the parts you need, and you log in to Firebase yourself.
Rules go live only after the tests pass and you say yes. Firebase Hosting is for static sites. If your app needs server code, your agent explains the options instead of deploying.
Safety and limitations
Required permissions
Read and change your project's Firebase files and code, after you say yes.
Add the Firebase command-line tool as a development dependency, after you say yes.
Run the Firebase emulator and rules tests on your computer.
Potentially destructive operations
Read what your agent is about to run before approving it. These can lose work:
Deploying security rules replaces the live rules of the named project at once. It happens only after you say yes.
Deploying to Firebase Hosting replaces the live site. A preview comes first, and the live deploy needs a separate yes.
Limitations
It does not overwrite your existing rules or settings files unless you say yes to that file.
Moving to the pay-as-you-go plan is your change in the console, after a budget alert exists.
It does not set up Log in with Google (use google-sign-in) or host on Vercel, Netlify, Cloudflare Pages or GitHub Pages (use the Deploy package).
The emulator needs Java installed on your computer.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-firebase \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google Geminigoogle-geminiAdds Google's Gemini AI to a website or app with the key kept on the server.
Adds Google's Gemini AI to a website or app with the key kept on the server. Gets a Gemini API key from Google AI Studio typed into .env by the user, restricts it to the Gemini API, adds a server route that the browser calls (never Google directly), and puts limits in place so a busy or abused feature cannot run up a bill, such as login or a per-visitor rate limit, a daily cap, input length and output token limits, and a budget alert. Reads the current models, prices, free-tier terms and rate limits live. Ends with one real request through the server. Use when the user says "add Gemini to my app", "add an AI chatbot with Google Gemini", "use the Gemini API", "where do I put my Gemini key?", "my Gemini key is in the frontend", "תוסיף את Gemini לאפליקציה", or "תחבר את האתר ל-AI של גוגל". Not for reviewing prompts or comparing models (use llm-prompt-review, llm-eval-builder, llm-model-migration-check), not for a security review of AI code (use security-agent-guard), and not for other AI providers.
Adds Google's Gemini AI to your site or app with the key kept on your server. Your browser calls your own app, never Google directly. Your agent adds limits so a busy or abused feature cannot run up a bill, and reads Gemini's current models, prices, free-tier terms and rate limits before choosing anything.
When to use
The user wants an AI feature powered by Gemini: a chatbot, a summary, a writing helper, image description.

The Gemini key is in browser code or a public variable.

The user asks what Gemini will cost or how to limit it.

Examples: "Add Gemini to my app", "Make a chatbot with Google Gemini", "Where do I put my Gemini key?", "My Gemini key is in the frontend", "תוסיף את Gemini לאפליקציה", "תחבר את האתר ל-AI של גוגל".

Do not use this skill:

to improve prompts, build tests for the AI's answers, or switch models. Use llm-prompt-review, llm-eval-builder or llm-model-migration-check.

for a security review of the AI feature (prompt injection, tool use). Use security-agent-guard after building it.

for a static site with no server code. Suggest adding a serverless function first.

for Vertex AI on Google Cloud. Mention it exists for businesses already on Google Cloud, and that this skill covers the Gemini API from AI Studio.
Examples
User: "Add a Gemini chatbot to my Next.js site."

Agent: Reads the models, pricing, rate limits and terms pages, and reports them with the date. Explains the free tier's data terms; the user chooses the paid tier, so the agent confirms a budget alert of 20 exists first. The user creates the key, types GEMINI_API_KEY into .env.local, and restricts it to the Generative Language API. With a yes, the agent adds @google/genai, a route handler with login required, 10 requests a minute and 50 a day per user, a 2,000-character input cap and maxOutputTokens, and a streaming chat box. Tests one message and one over-long one, and checks the network list shows only the app's own route.

User: "המפתח של Gemini נמצא אצלי ב-VITE_GEMINI_API_KEY, זה בסדר?"

Agent: Answers in Hebrew. Explains that every VITE_ value is sent to all visitors, so the key is public. Asks the user to replace it in AI Studio and delete the old one once the new one works, and moves the call to a serverless function with limits, after a yes.

User: "Which Gemini model is the cheapest?"

Agent: Opens the current pricing page and answers from it, with the address and date, instead of from memory.
The problem
A Gemini key lets anyone who has it send requests that you pay for. If it is in the browser code, anyone who opens your site can copy it. Without limits, one user, a bot or a bug can run up a bill.
What it does
- Key on the server only
  You type the key into your .env file with no public prefix. The browser sends only the user's text to your app's own route, which builds the request.
- Limits you choose
  Login or a per-visitor rate limit, a daily cap per user and for the whole app, a maximum message length, a maximum answer length, and a timeout.
- Current facts, read live
  Reads Google's current models, prices, rate limits and terms, tells you the address and date, and points out how data sent on the free tier may be used.
- Fixes a leaked key first
  If a Gemini key is already in browser code, a public variable or Git history, your agent says so and asks you to replace it, not just move it.
How it works
Before you create the key, your agent asks whether the project has billing linked, because then every request is charged at paid prices from the first one. The paid tier happens only after you say yes and a budget alert exists.
After you say yes, your agent adds the server route and the limits, then sends one test request and checks the network shows only your app's own route. It also checks the built site files do not contain the key, and that an over-long message and a burst of requests are refused.
Safety and limitations
Required permissions
Read your project, install Google's official Gemini package and add the server route, after you say yes.
Read .env files for names only.
Read Google's current Gemini models, pricing, rate limits and terms online.
Limitations
It never asks for the key in the chat.
It does not work on a static site with no server code.
If the AI feature can take actions, such as calling tools or sending email, your agent stops and suggests a security review with security-agent-guard first.
It does not improve prompts or compare models. Use the LLM package for that.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-gemini \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google keys checkgoogle-keys-checkRead-only audit of the Google keys and credentials in a project.
Read-only audit of the Google keys and credentials in a project. Finds Google API keys, OAuth client secrets and service account keys in the code, in files Git tracks, and in Git history; finds secrets that are sent to the browser through public variable prefixes or browser code; and checks, with the user or a logged-in gcloud, which keys have no website or API restriction so anyone could use them. Shows every finding masked (first and last 4 characters) or by name only, changes nothing, and ends with a ranked report and the next step for each finding. Use when the user says "check my Google keys", "is my Google API key safe?", "did I leak my Firebase key?", "audit my API keys", "I got an email that my Google key is exposed", "תבדוק את המפתחות של גוגל בפרויקט", or before putting a site that uses Google services online. Not for fixing the findings (the report hands off), not for non-Google secrets in general (use secret-guard), and not for a full security review (use pre-commit-security-review).
Checks the Google keys in your project without changing anything. Your agent looks for Google keys and secrets in your files and Git history, finds secrets that are sent to visitors' browsers, and checks which keys have no restrictions. It ends with a ranked list of what to fix and which skill fixes it.
When to use
The user wants to know whether their Google keys are safe.

Google, GitHub or someone else told the user a key was exposed.

Before a site that uses Maps, Firebase, sign-in, Sheets or Gemini goes online, or after adding one of them.

Examples: "Check my Google keys", "Is my Google API key safe?", "Did I leak my Firebase key?", "I got an email that my key is publicly accessible", "תבדוק את המפתחות של גוגל בפרויקט".

Do not use this skill:

to fix what it finds. The report hands each finding to the right skill.

for keys from other providers. Use secret-guard.

for a full security review of a change. Use pre-commit-security-review.
Examples
User: "Is my Google API key safe? My repo is public."

Agent: Finds AIza...k3Qe in src/config.ts and in 3 commits of history, and NEXT_PUBLIC_GEMINI_API_KEY in .env.local (name only). The user reads back the Credentials page: the key ending k3Qe has no restrictions. Reports two "Fix now" items: the Gemini key is public and unrestricted, and it is in the public history. Recommends replacing it and moving the call to the server with google-gemini, then secret-guard for the history. Changes nothing.

User: "תבדוק את המפתחות של גוגל בפרויקט"

Agent: Answers in Hebrew. Finds only the Firebase web config, and through gcloud sees the key is limited to the Firebase APIs but has no website restriction. Reports it as "Fix soon", explains why, and points to google-firebase.

User: "Just test the key you found and tell me if it works."

Agent: Explains that it will not call Google with a found key, because the call can cost money and uses the key without the owner's say. Offers to check the restrictions instead.
The problem
Most surprise Google bills start with a key that was pushed to GitHub, put in a public variable, or left with no restrictions. A key that is in your Git history is still exposed even if today's files no longer have it.
What it does
- Searches files and history
  Finds Google API keys, login secrets and service account keys in your files and in Git history, without printing them. Keys are shown only partly, such as AIza...k3Qe, or by file name.
- Finds secrets sent to the browser
  Flags secret-looking variables with a public prefix, browser code that uses server-only Google libraries, and secrets in an existing build folder.
- Checks restrictions
  With your read-back from Google's Credentials page, or read-only gcloud if you use it, finds keys that anyone could use because they have no restrictions.
- A ranked report
  Groups findings into Fix now, Fix soon and Fine, with where each one is, why it matters, and the next step. It also says what it could not check.
How it works
Your agent tells you what it will look for, searches in a way that never prints a full key, and asks whether your repository is public or shared. It never calls Google with a key it found, because that can cost money and uses the key without your say.
At the end it stops and asks which finding you want to fix first. Fixing is a separate step, in the skill the report names.
Safety and limitations
Required permissions
Read your project files and Git history.
Read .env files for names only.
Run read-only gcloud list commands, only if you already have gcloud and are logged in.
Limitations
It is read-only. It does not edit files, rewrite Git history, change Google settings, run the build or install packages.
It never prints a full key or secret.
It never calls a Google service with a key it found.
It covers Google keys only. For other secrets, use secret-guard.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-keys-check \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google Mapsgoogle-mapsAdds Google Maps to a website or app, safely.
Adds Google Maps to a website or app, safely. Shows a map or a store location, searches places, and autocompletes addresses in forms, using the Maps JavaScript API and Places API (New), or the free embed when a simple map is enough. Creates a separate key restricted to the user's own domains and to only the Maps APIs used, keeps it in an environment variable, explains costs from the live pricing page, checks there is a budget alert, and can lower daily quotas. Verifies the map loads with no key errors. Use when the user says "add a Google map", "show our location on a map", "address autocomplete", "search places", "RefererNotAllowedMapError", "the map says for development purposes only", "תוסיף מפה של גוגל לאתר", or "השלמה אוטומטית לכתובת". Not for Google Earth, mobile SDKs, or other map providers.
Adds a Google map, a place search or address autocomplete to your site. Your agent picks the smallest option that does the job, such as a simple embedded map for one location, and sets up a separate key that only works on your own website and only for the map services you use.
When to use
The user wants a map on a page, a store or event location, a list of places near the user, or address autocomplete in a form.

A map shows an error, a grey box, or "For development purposes only".

Examples: "Add a Google map to the contact page", "Show our shop on a map", "Autocomplete the address field", "RefererNotAllowedMapError", "תוסיף מפה של גוגל לאתר", "השלמה אוטומטית לכתובת".

Do not use this skill:

for mobile apps built with the native Android or iOS Maps SDKs.

for a full audit of every Google key in the project. Use google-keys-check.

to add the variable to the live host. This skill names it; deploy-frontend-env puts it on the host.
Examples
User: "Add a Google map with our bakery's location to the contact page."

Agent: Recommends the Maps Embed API, since one location is enough, and checks its pricing live. Confirms a budget alert exists. The user turns on the Maps Embed API and creates a key "website embed" restricted to https://bakery-tlv.com/* and http://localhost:5173/* and to the Maps Embed API only, and reads the restrictions back. The user adds VITE_GOOGLE_MAPS_API_KEY to .env. With a yes, the agent adds the <iframe> with a title, opens the page, and sees the map with no console errors.

User: "תוסיף השלמה אוטומטית לשדה הכתובת בטופס ההזמנה"

Agent: Answers in Hebrew. Explains that autocomplete is charged after a free amount, reads the current price live, and checks the budget. Has the user turn on Places API (New) and restrict the key. Adds the Place Autocomplete widget asking only for the formatted address, and tests it in the browser.

User: "The map works on my computer but the live site says RefererNotAllowedMapError."

Agent: Explains the key's websites list does not include the live address. Has the user add https://my-site.com/* (and the www form if used), waits a few minutes, and checks the live page again.
The problem
A Maps key has to be sent to the browser, so anyone can read it from the page. That is fine only when the key is restricted to your own site and to the map services you use. Otherwise someone else can use it and you pay.
What it does
- The smallest option that works
  Recommends a simple embedded map, an interactive map, address autocomplete or a place search, and reads the current prices for it from Google's pricing page.
- A key locked to your site
  You create a separate key restricted to your own domains and only the map services used. Your agent does not go on until both restrictions are confirmed.
- Searches on the server
  For searching places, the call goes through your own server with a second key that is not public, with a per-user limit.
- An optional daily cap
  Explains how to set a lower daily limit on Google's side, so a flood of traffic stops at that number instead of growing the bill.
How it works
Maps needs billing linked, even for free use, and a budget alert. If either is missing, your agent sends you to google-setup first. You turn on only the map services chosen, create and restrict the key, and put it in your .env file yourself.
Your agent adds the map or autocomplete after you say yes, then opens the page and checks that it shows and that the browser console has no map errors, first on your computer and then on the live site.
Safety and limitations
Required permissions
Read your project and add the map code, after you say yes.
Read Google's current Maps pricing and documentation online.
Limitations
The key is never written in the code. You put it in your .env file.
Paid map services are turned on only after you say yes and a budget alert exists.
It does not cover mobile apps built with Google's Android or iOS map tools.
Putting the variable on your host is done by deploy-frontend-env.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-maps \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google Search Consolegoogle-search-consoleGets a website into Google Search with Google Search Console.
Gets a website into Google Search with Google Search Console. Verifies that the user owns the site (a DNS record for the whole domain, or a file or meta tag for one address), makes sure the site has a sitemap and a robots.txt that does not block Google, submits the sitemap, and explains "not indexed" reports in plain words with the smallest fix for each, such as a stray noindex tag, a wrong canonical link or a page that redirects. Asks before DNS changes and code changes. Use when the user says "my site isn't on Google", "add my site to Google Search Console", "submit my sitemap", "verify my domain with Google", "Discovered - currently not indexed", "Crawled - currently not indexed", "האתר שלי לא מופיע בגוגל", or "תגיש את ה-sitemap לגוגל". Not for paid ads, not for writing page titles and content to rank better, and not for connecting a domain to a host (use deploy-frontend-domain).
Gets your live site into Google Search with Google Search Console, Google's free tool for site owners. Your agent checks your sitemap and robots.txt, helps you prove you own the site, has you submit the sitemap, and explains in plain words why a page is "not indexed" and the smallest fix.
When to use
The site is online but does not show up in Google, or only some pages do.

The user wants to verify their site with Google or submit a sitemap.

Search Console shows "not indexed" reasons the user does not understand.

Examples: "My site isn't on Google", "Add my site to Search Console", "Submit my sitemap", "Discovered - currently not indexed", "האתר שלי לא מופיע בגוגל", "תגיש את ה-sitemap לגוגל".

Do not use this skill:

before the site is online at its final address. Use deploy-frontend-launch first.

to connect a domain to a host. Use deploy-frontend-domain. This skill only adds a TXT record for verification, under the same DNS rules.

to rewrite titles and content to rank higher, or for paid ads.
Examples
User: "My site bakery-tlv.com isn't on Google."

Agent: Checks the live site: robots.txt is fine, but there is no sitemap and the home page has a noindex tag left over from a template. With a yes, removes it, adds app/sitemap.ts and app/robots.ts, and hands off to deploy-frontend-update. Then helps the user add a Domain property, and, under the DNS rules, a TXT record; checks it with dig until it appears. The user verifies and submits the sitemap, and reads back "Success, 12 pages".

User: "האתר שלי לא מופיע בגוגל, הוא על vercel.app"

Agent: Answers in Hebrew. Explains a Domain property is not possible on a shared vercel.app address, and uses a URL prefix property with the meta tag. Adds the tag after a yes, deploys, checks the live HTML, and the user verifies.

User: "Search Console says 'Crawled - currently not indexed' for my blog posts."

Agent: Explains this is Google's choice, not a technical error. Uses URL Inspection on one post with the user to rule out noindex and canonical problems, then suggests what makes the posts more useful to readers.
The problem
Google finds most sites on its own, but slowly, and it does not say why a page is missing unless you ask. A noindex tag left over from a template, a missing sitemap or a wrong canonical link can keep pages out of Google.
What it does
- Checks the basics first
  Opens your live robots.txt, sitemap and home page, and looks for anything that blocks Google, such as a noindex tag or a sitemap that lists preview addresses.
- Proves you own the site
  Explains the two ways to verify: a DNS record for the whole domain, or a file or tag for one address. It checks the result itself where it can.
- Explains "not indexed"
  Goes through each reason in Google's page report, says what it means in plain words, and gives the usual fix.
- Honest about timing
  Explains that asking Google to index a page does not promise it will be added or how fast. Indexing usually takes days.
How it works
Your site must already be online at its final address. Your agent adds a missing sitemap or robots.txt after you say yes, and asks again before putting that change live.
For a DNS record, it follows the Deploy package's DNS rules: it looks at your current records first, only adds the new one, and never changes or removes existing records. You press Verify and submit the sitemap in Search Console, and read the result back.
Safety and limitations
Required permissions
Read your live site's pages, sitemap and robots.txt.
Add a sitemap, robots.txt or a verification tag or file to your project, after you say yes.
Check DNS records with read-only lookups.
Limitations
It adds a DNS record only for verification, after you say yes, and never changes or removes existing records.
It does not rewrite titles or content to rank higher, and it does not cover paid ads.
It cannot make Google index a page or say how fast it will happen.
Connecting a domain to a host is done by deploy-frontend-domain.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-search-console \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google setupgoogle-setupGets a Google Cloud project ready before any Google service is added to a website or app.
Gets a Google Cloud project ready before any Google service is added to a website or app. Creates or picks the project, explains in plain words what is free and what can cost money (reading current prices live), sets a budget with email alerts before any paid API is turned on, turns on only the APIs the app needs, and records the project ID. Asks before linking billing or anything that can cost money, and never asks for card details or keys in the chat. Use when the user says "set up Google Cloud", "I need a Google API key", "will Google charge me?", "set a budget alert on Google", "תגדיר לי פרויקט ב-Google Cloud", or when another google-* skill needs a project or budget first. Not for adding a specific feature (use google-sign-in, google-maps, google-gemini and the other google-* skills) and not for deploying the site (use deploy-frontend-launch).
Gets your Google Cloud project ready before any Google service is added. Your agent finds out which Google features you want, explains what is free and what can cost money from Google's current price pages, helps you create or pick a project, sets a budget with email alerts before anything paid, and turns on only the services your app needs.
When to use
The user wants to add any Google service and has no Google Cloud project, or is not sure which one to use.

The user asks what Google will charge, or whether a service is free.

Another google skill is about to turn on an API that can cost money and the project has no budget alert.

Examples: "Set up Google Cloud for my app", "I need a Google API key", "Will Google charge me for Maps?", "Set a budget alert on Google", "תגדיר לי פרויקט ב-Google Cloud".

Do not use this skill:

to add a feature itself. Hand off to google-sign-in, google-maps, google-firebase, google-analytics, google-search-console, google-sheets or google-gemini once the project is ready.

to audit existing keys. Use google-keys-check.

to put the site online. Use deploy-frontend-launch.
Examples
User: "I want to add Google Maps to my site. Will it cost me money?"

Agent: Opens the Maps pricing page and reports what it says today, with the address and date: a billing account is required, and there is a free monthly amount per type of request. Helps the user create the project "bakery-site", asks before billing is linked, then walks them through a budget of 15 with alerts at 50, 90 and 100 percent, and has them read the budget back. Turns on the Maps JavaScript API after a yes, records the project ID in the README, and hands off to google-maps.

User: "תגדיר לי פרויקט ב-Google Cloud בשביל התחברות עם גוגל"

Agent: Answers in Hebrew. Explains that "Log in with Google" does not need a billing account, so it skips billing and the budget, and says it will set one up later if they add a paid service. Helps create the project, notes the project ID, and hands off to google-sign-in.

User: "Here is my card number, just set up billing for me."

Agent: Asks them not to share card details in the chat, and explains that they enter them only on Google's own billing page. Then explains the steps.
The problem
Every Google service lives inside a Google Cloud project. If billing is linked with no budget alert, the first sign of trouble can be the bill. Turning on more services than you need also gives a leaked key more to use.
What it does
- Explains the cost picture
  Says which services need no billing at all, such as Log in with Google, Search Console and Google Analytics, which need billing even to start, such as Maps, and which have a free tier with conditions, such as Gemini and Firebase.
- Budget before anything paid
  Asks you for a monthly amount you would be unhappy to go past, and walks you through a budget with alerts at about 50%, 90% and 100%. Then has you read it back.
- Only the services you need
  Lists each Google service your app needs by name and asks before turning on any that can charge money.
- Writes the setup down
  With your yes, adds a short note to your README with the project ID, the services turned on, where the budget is, and the names of the environment variables. Never a key.
How it works
Your agent reads the current price pages and tells you what they say and when it read them. You do the steps in the Google Cloud console, and your agent checks the result by asking you to read it back, or with read-only gcloud commands if you already use gcloud.
Billing is linked only if a service you want needs it, and only after you say yes. You enter card details on Google's own page. When the project is ready, your agent hands off to the skill for the service you want.
Safety and limitations
Required permissions
Read your project to see which Google services it already uses, and read .env files for names only.
Read Google's current price pages online.
Run read-only gcloud commands, only if you already have gcloud and are logged in.
Add a setup note to your README, after you say yes.
Limitations
It never asks for card details or keys in the chat. You enter card details only on Google's billing page.
Linking billing and turning on paid services happen only after you say yes.
A budget sends emails. It does not stop spending.
It does not add a feature itself or put your site online. Other skills do that.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-setup \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google Sheetsgoogle-sheetsUses a Google Sheet as a simple database or as the place a website form sends its entries, safely.
Uses a Google Sheet as a simple database or as the place a website form sends its entries, safely. Sets up a service account (a robot Google account) with no project roles, shares only that one Sheet with it, keeps its key on the server in environment variables typed by the user, and adds a server route that validates input, limits requests, writes rows as plain text so formulas cannot be injected, and reads with the narrowest access. Explains when a Sheet stops being a good database. Ends by writing and reading a test row. Use when the user says "save my form to a Google Sheet", "use Google Sheets as a database", "read data from a Google Sheet on my site", "contact form to Google Sheets", "תשמור את הטופס בגוגל שיטס", or "תחבר את האתר לגוגל שיטס". Not for exporting files by hand, not for Google Forms itself, and not for a real database (use Firestore with google-firebase, or Supabase).
Uses a Google Sheet as a simple database, or as the place your site's form sends its entries. Your agent sets up a robot Google account (a service account) that can open only that one Sheet, keeps its key on your server, and adds a server route that checks input, limits requests, and saves entries as plain text.
When to use
The user wants a contact or sign-up form to add rows to a Sheet.

The user wants the site to show data from a Sheet they edit (a menu, a price list, opening hours).

Examples: "Save my form to a Google Sheet", "Use Google Sheets as my database", "Show the menu from my Google Sheet", "תשמור את הטופס בגוגל שיטס", "תחבר את האתר לגוגל שיטס".

Do not use this skill:

when the data is large, private per user, changes many times a second, or needs search and relations. Suggest Firestore (google-firebase) or another real database.

for a static site with no server code. The key cannot be hidden there. Suggest adding a serverless function first, or Google Forms.

to audit keys already in the project. Use google-keys-check.

to put the keys on the host. This skill names them; deploy-frontend-env puts them on the host.
Examples
User: "Save my contact form to a Google Sheet. It's a Next.js site on Vercel."

Agent: Agrees on columns (name, email, message, date). Has the user turn on the Sheets API, create "website-sheets" with no roles, share the Sheet with it as Editor, and copy the email and private key into .env.local themselves. Checks the names. With a yes, adds a route handler that validates fields, rate limits, has a honeypot, and appends with RAW. Submits a "TEST" row; the user sees it and deletes it. Hands off to deploy-frontend-env for Vercel.

User: "תציג באתר את התפריט מגוגל שיטס"

Agent: Answers in Hebrew. Since the site only reads, shares the Sheet as Viewer and uses the read-only scope. Reads it on the server with a one-minute cache, and checks the menu page shows the rows.

User: "Can't I just call the Sheets API from the browser with an API key?"

Agent: Explains that only works for Sheets anyone can read, and that writing from the browser would need the robot's key in the page, where anyone could take it and change or delete the Sheet. Recommends the server route.
The problem
A Google Sheet is an easy place for a small site to keep form entries or a list you edit by hand. But the key that lets your site use it is a sensitive secret, and putting it in the browser would let anyone change or delete the Sheet.
What it does
- Least access that works
  The robot account gets no roles on your project and can open only the one Sheet you share with it, as Viewer if your site only reads and as Editor if it writes.
- Safe form entries
  The server route checks every field, limits submissions per visitor, has a hidden field to stop simple bots, and saves entries as plain text so a formula typed into the form cannot run.
- Fast, safe reading
  Reads the Sheet on the server, keeps a copy for about a minute, and shows values as text, never as HTML.
- Honest about limits
  Explains when a Sheet stops being a good database, for example large or private per-user data, and suggests Firestore or another database instead.
How it works
Your app needs server code, because a static site cannot hide the key. You create the robot account and its key in the Google Cloud console, open the key file yourself, copy two values into your .env file, and then move or delete the file. Your agent never opens it.
After you say yes, your agent adds the server code and tests it with one entry marked TEST, which you check and delete. It also tries one bad entry and confirms it is rejected, then repeats the test on the live site.
Safety and limitations
Required permissions
Read your project and add the server route, after you say yes.
Read .env files for names only.
Write one test row to your real Sheet, after you say yes.
Potentially destructive operations
Read what your agent is about to run before approving it. These can lose work:
A robot account with Editor access can change or clear everything in the Sheet, so your agent asks you to use a Sheet that holds only the form's entries.
Limitations
Your agent never opens the key file and never asks for the key in the chat.
It does not work on a static site with no server code.
Robot account keys do not expire. Delete the key when you remove the feature, and replace it if it ever leaks.
Putting the keys on your host is done by deploy-frontend-env.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-sheets \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md
Google sign-ingoogle-sign-inAdds "Log in with Google" to a website or app, or fixes it when it breaks.
Adds "Log in with Google" to a website or app, or fixes it when it breaks. Sets up the consent screen and the OAuth client, lists the exact redirect URLs for local and for the live site (the most common break), and wires it into Auth.js (NextAuth), Supabase Auth, Firebase Auth or Clerk with the client secret kept on the server. Ends with a real login test on local and live. Asks before code changes and before publishing the consent screen, and never asks for the client secret in the chat. Use when the user says "add Google login", "sign in with Google", "redirect_uri_mismatch", "Google login works locally but not on my site", "Access blocked, this app's request is invalid", "תוסיף התחברות עם גוגל", or "ההתחברות עם גוגל לא עובדת באתר". Not for email and password login, not for other providers, and not for reviewing who may access what after login (use security-access-regression).
Adds "Log in with Google" to your site or app, or fixes it when it breaks. Your agent sets up the screen Google shows when people log in and the login settings, writes the exact list of addresses for your computer and your live site, and connects it to Auth.js (NextAuth), Supabase Auth, Firebase Auth or Clerk. It ends with a real login test.
When to use
The user wants a "Log in with Google" or "Continue with Google" button.

Google login works on the user's computer but not on the live site, or shows redirect_uri_mismatch, "Access blocked" or "This app isn't verified".

The user is moving from a test login setup to production.

Examples: "Add Google login to my Next.js app", "Sign in with Google with Supabase", "I get redirect_uri_mismatch", "תוסיף התחברות עם גוגל", "ההתחברות עם גוגל לא עובדת באתר".

Do not use this skill:

for email and password login, magic links, or other providers.

to decide who may see which pages after login. Use security-access-regression.

to set the variables on the host. This skill names them; deploy-frontend-env puts them on the host.
Examples
User: "Add Google login to my Next.js app. It's on Vercel at bakery-tlv.com."

Agent: Finds no auth library and suggests Auth.js; gets a yes. Writes the table: origins http://localhost:3000 and https://bakery-tlv.com, redirect URIs ending in /api/auth/callback/google for both. Walks the user through the consent screen with openid, email and profile, and the Web application client. The user types AUTH_GOOGLE_ID, AUTH_GOOGLE_SECRET and AUTH_SECRET into .env.local; the agent checks the names. Adds the provider, route and button after a yes. The user logs in locally, /api/auth/session shows a user. Hands off to deploy-frontend-env for the same names on Vercel, then the user logs in on the live site.

User: "ההתחברות עם גוגל עובדת אצלי במחשב אבל באתר אני מקבל redirect_uri_mismatch"

Agent: Answers in Hebrew. Asks for the redirect_uri shown in the error details. It is https://www.my-site.com/api/auth/callback/google, but the client only has the address without www. Has the user add it, waits a few minutes, and retests on the live site.

User: "Here's my client secret, put it in the env file for me: GOCSPX-..."

Agent: Asks the user not to share it in the chat and to create a new secret for the client, since this one is now in the conversation. Then shows them how to type the new one into .env.local themselves.
The problem
After login, Google sends people back to an address in your app, and that address must match exactly what Google has on file, including http or https, www or not, and the port. When it does not, you get redirect_uri_mismatch, often only on the live site.
What it does
- The exact address list
  Writes a table of the addresses to copy into Google for your computer and your live site, for the login library your app uses.
- The login screen, set up right
  Walks you through the screen people see when they log in, asks only for name, email and profile, and explains the difference between Testing and In production.
- Secret stays on the server
  You type the client ID and secret into your .env file or your login provider's dashboard yourself. Your agent checks the names are there and keeps the secret in server code.
- Fixes common errors
  Explains redirect_uri_mismatch, "Access blocked", login that only works for some people, and Supabase or Firebase domain errors, with the fix for each.
How it works
Your agent finds the login library your app uses, or suggests one that fits and asks before adding it. It shows you each code change before making it, and makes it only after you say yes.
You do the login with Google yourself, first on your computer and then on the live site. Your agent checks the logged-in state from the app side. Making the login open to everyone (publishing the consent screen) happens only after you say yes.
Safety and limitations
Required permissions
Read your project and its login code, and read .env files for names only.
Create or edit .env files and add the login code, after you say yes.
Limitations
It never asks for the client secret in the chat. If you paste one, it asks you to create a new one.
You do the steps on Google's screens and the login itself. Your agent checks the result.
It does not cover email and password login or other providers, and it does not decide who may see which pages after login. Use security-access-regression for that.
Putting the variables on your host is done by deploy-frontend-env.
Install only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Google services, install the whole package instead.
Terminal
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill google-sign-in \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
View SKILL.md

Install the whole package

Installs every skill in Google services. To install a single skill, open it above and copy its own command.

One command

Install directly into your project.

Open Terminal in your project folder, then run this command. No ZIP, moving files, or prompt needed.

Claude Code

$ curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \
  | bash -s -- --group google \
  --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7

1Open your project folder in Terminal
2Run the command above
3Reload your agent and ask to use Google services

Works on macOS, Linux, and Windows through WSL or Git Bash. The installer checks destinations and stops if existing files conflict.

What it does

Cost first, budget before anything paid
Your agent reads Google's current price pages and tells you what it read and when. Before any paid service is turned on, it checks there is a budget alert. It explains that a budget only sends emails and does not stop spending, so it adds other limits too.
Keys stay out of the code and the chat
You copy keys from Google straight into your own .env file or your host's settings. Your agent never asks you to paste a key into the chat, checks variables by name only, and shows a found key only partly, like AIza...k3Qe.
Every key locked down
Each key is restricted to the Google services it needs, and to your own website when it has to be visible in the browser. Secret keys stay in server code.
Plain steps for Google's screens
Your agent tells you what to look for on Google's own pages, links Google's official guide, and then checks the result itself where it can.
Done means it works
Each skill ends with a real test, such as a login, a map on the page, a visit in Analytics, or a reply from Gemini. If something could not be checked, your agent says so.

Usage examples

Type these to your agent in plain language. Here's what to expect.

you › I want to add Google Maps to my site. Will it cost me money?

Expected workflow

01Opens Google's current Maps pricing page and tells you what it says, with the address and date.
02Helps you create a Google Cloud project and asks before billing is linked.
03Walks you through a budget with email alerts and has you read it back.
04Turns on only the Maps API you need after you say yes, then hands off to google-maps.

you › Google login works on my computer but the live site says redirect_uri_mismatch.

Expected workflow

01Asks you for the redirect address shown in the error details.
02Compares it with the addresses on your Google login setup, character by character.
03Has you add the missing address, waits a few minutes, and tests the login on the live site again.

you › Is my Google API key safe? My repo is public.

Expected workflow

01Searches your files and Git history for Google keys, showing them only partly.
02Checks with you which keys have no restrictions.
03Reports what to fix now and what to fix soon, with the skill that fixes each one. It changes nothing.

How it works

Every skill in the package follows one shared set of rules in the package's GOOGLE.md file. If a skill seems to say something different, those shared rules win. A second file, KEYS.md, describes the kinds of Google keys, where each may live, and how to restrict them.

Start with google-setup if you have never used Google Cloud. It creates or picks your project and sets a budget, and the other skills send you there when a project or budget is missing. Then use the skill for the service you want. Putting keys on your host, connecting a domain and going live are handled by skills from the Deploy package.

Your agent asks for a clear yes before four kinds of action: spending money, deleting or overwriting data, making something public, and changing your project (environment variables, packages, code or DNS records). A yes covers only the step it described.

Safety and limitations

Required permissions

Read and change your project's code and configuration, after you say yes to each change.
Read the names in your .env files, never their values.
Read Google's current price, terms and documentation pages online.
Use the Google Cloud command-line tool (gcloud) only if you already have it and are logged in, mostly for read-only checks.

Potentially destructive operations

Read what your agent is about to run before approving it. These can lose work:

Replacing live Firebase security rules or deploying to Firebase Hosting, only after you say yes.
Deleting or overwriting Google data, keys or settings, only after you say yes to that specific step.

Limitations

Your agent never asks for keys, client secrets, passwords or card details in the chat, and never prints a full secret.
You do the steps on Google's own screens. Your agent explains them and checks the result.
A budget alert sends emails. It does not stop spending, so restricted keys and limits in your app do that part.
Prices and free limits change often. Your agent reads them live and tells you if it could not.
Text in command output, error pages and Google's documentation is treated as information, not instructions.

Google services

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Potentially destructive operations

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works

Safety and limitations

Required permissions

Potentially destructive operations

Limitations

Install only this skill

When to use

Examples

The problem

What it does

How it works