Agent skill

Cloud Scheduler Permission Denied

by divinevideo in divinevideo/divine-mobile

Fix Google Cloud Scheduler silently failing to trigger Cloud Run jobs with status code 7 (PERMISSIONDENIED).

MPL-2.0Auto-check passedDevOps & Cloud

Install Cloud Scheduler Permission Denied

skills CLI
$ npx skills add divinevideo/divine-mobile --skill cloud-scheduler-permission-denied -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install divinevideo/divine-mobile cloud-scheduler-permission-denied --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/divinevideo/divine-mobile.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/cloud-scheduler-permission-denied .claude/skills/cloud-scheduler-permission-denied && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
cloud-scheduler-permission-denied
GitHub stars
266
Token cost
~843 tokens
SKILL.md length
210 words
Files
1
Skills in repo
103
Repo updated
First seen
Licence
MPL-2.0

At a glance

Fix Google Cloud Scheduler silently failing to trigger Cloud Run jobs with status code 7 (PERMISSIONDENIED).

  • Works in 4 steps: Identify the scheduler's service account → Grant run.invoker role to that service… → Test by manually triggering the scheduler → …
  • Cloud Run jobs with status code 7 (PERMISSIONDENIED)
  • SKILL.md covers Problem, Context / Trigger Conditions, Solution and Verification, plus 3 more sections
  • Calls gcloud

What it does

Cloud Scheduler Permission Denied is an agent skill from divinevideo/divine-mobile. Fix Google Cloud Scheduler silently failing to trigger Cloud Run jobs with status code 7 (PERMISSIONDENIED). Use when: (1) Cloud Run jobs stop running but schedulers show ENABLED, (2) gcloud scheduler jobs describe shows lastAttemptTime but status.code: 7, (3) Jobs worked before but stopped after IAM changes or project updates. The scheduler service account needs roles/run.invoker on the project.

Its SKILL.md is about 840 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud. It works with Google Cloud and Cloud Run. The licence is MPL-2.0.

When your agent uses it

  • Cloud Run jobs with status code 7 (PERMISSIONDENIED)
  • Cloud Run jobs stop running but schedulers show ENABLED
  • Gcloud scheduler jobs describe shows lastAttemptTime but status.code: 7
  • Jobs worked before but stopped after IAM changes

Example prompts

  • “/cloud-scheduler-permission-denied”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Identify the scheduler's service account
  2. Grant run.invoker role to that service account
  3. Test by manually triggering the scheduler
  4. Verify the Cloud Run job started

What it can do on your machine

Read from SKILL.md and the folder at commit c3d6f7e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gcloud

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • cloud.google.com
    • grpc.io

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Cloud Scheduler Permission Denied loads about 843 tokens when it runs. Until then it costs about 109 tokens; SKILL.md has 210 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~109
When it runs · the whole SKILL.md, loaded when a task matches
~843

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from divinevideo/divine-mobile at commit c3d6f7e, republished under its MPL-2.0 licence (© divinevideo). 210 words, ~843 tokens.

Download SKILL.mdSave it as .claude/skills/cloud-scheduler-permission-denied/SKILL.md (or your agent's skills folder).
name
cloud-scheduler-permission-denied
description
Fix Google Cloud Scheduler silently failing to trigger Cloud Run jobs with status code 7 (PERMISSION_DENIED). Use when: (1) Cloud Run jobs stop running but schedulers show ENABLED, (2) gcloud scheduler jobs describe shows lastAttemptTime but status.code: 7, (3) Jobs worked before but stopped after IAM changes or project updates. The scheduler service account needs roles/run.invoker on the project.
author
Claude Code
version
1.0.0
date
2026-02-08

Cloud Scheduler Permission Denied (Code 7)

Problem

Cloud Scheduler jobs silently fail to trigger Cloud Run jobs. The scheduler shows as ENABLED, attempts are made (lastAttemptTime updates), but Cloud Run jobs never start. The only indicator is status.code: 7 which means PERMISSION_DENIED.

Context / Trigger Conditions

  • Cloud Run jobs previously ran on schedule but stopped
  • Dashboard shows jobs as "FAILED" or "DONE" with old timestamps
  • gcloud scheduler jobs describe <name> shows:
    lastAttemptTime: '2026-02-08T14:00:03.316530Z'
    state: ENABLED
    status:
      code: 7
  • No obvious errors in Cloud Logging for the scheduler

Solution

  1. Identify the scheduler's service account:

    bash
    gcloud scheduler jobs describe <scheduler-name> \
      --location=<region> \
      --project=<project> \
      --format="yaml(httpTarget.oauthToken.serviceAccountEmail)"
  2. Grant run.invoker role to that service account:

    bash
    gcloud projects add-iam-policy-binding <project-id> \
      --member="serviceAccount:<service-account-email>" \
      --role="roles/run.invoker"
  3. Test by manually triggering the scheduler:

    bash
    gcloud scheduler jobs run <scheduler-name> \
      --location=<region> \
      --project=<project>
  4. Verify the Cloud Run job started:

    bash
    gcloud run jobs executions list \
      --region=<region> \
      --project=<project> \
      --limit=5

Verification

After granting permissions and triggering:

  • status.code should no longer be 7 on next attempt
  • New Cloud Run job execution should appear in executions list
  • Execution should show RUNNING status

Example

bash
# Check scheduler status - note code: 7
gcloud scheduler jobs describe profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project

# Grant permission
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:my-scheduler@my-project.iam.gserviceaccount.com" \
  --role="roles/run.invoker"

# Test
gcloud scheduler jobs run profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project

Notes

  • Status code 7 is gRPC's PERMISSION_DENIED - not documented prominently for Cloud Scheduler
  • This commonly happens after:
    • Creating new service accounts
    • Migrating projects
    • IAM policy updates that remove inherited permissions
    • Using a custom service account instead of the default
  • The scheduler will keep attempting (and failing) silently - no alerts by default
  • Consider adding Cloud Monitoring alerts for scheduler failures

References

© divinevideo, MPL-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/cloud-scheduler-permission-denied of divinevideo/divine-mobile.

Open the folder on GitHubat commit c3d6f7e

Compare with similar skills

Cloud Scheduler Permission Denied next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Cloud Scheduler Permission Denied compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Cloud Scheduler Permission Denied this skilldivinevideo/divine-mobile266—~843Automated safety check: PassMPL-2.0
Devopsnicepkg/auto-company1952 repos~814Automated safety check: PassMIT
Broccoli Oss GCP Deploybesimple-oss/broccoli285—~4.1kAutomated safety check: PassMIT
Canaryatelier-fashion/adlc-toolkit171—~2.2kAutomated safety check: PassMIT
GCP DrawIO Diagram Generatora5c-ai/babysitter1.8k—~3.7kAutomated safety check: PassMIT
Google Agents CLI Publishpifferologo/cloud-agents-cli1291 repos~2.4kAutomated safety check: PassApache-2.0

Similar skills

  • Devops

    nicepkg/auto-company

    Deploy to Cloudflare (Workers, R2, D1), Docker, GCP (Cloud Run, GKE), Kubernetes (kubectl, Helm).

    195 GitHub starsUsed in 2 repos~814 tokens
    DevOps & CloudAuto-check passed
  • Broccoli Oss GCP Deploy

    besimple-oss/broccoli

    Deploy this repository to a new Google Cloud project using the repo's existing Cloud Run, Cloud Run Jobs, Cloud SQL, Secret Manager, and Artifact Registry scripts.

    285 GitHub stars~4.1k tokensUpdated 5 mo ago
    DevOps & CloudAuto-check passed
  • Canary

    atelier-fashion/adlc-toolkit

    Canary deployment with smoke tests — deploy to a zero-traffic revision, run health checks, and promote on success.

    171 GitHub stars~2.2k tokensUpdated 12 days ago
    DevOps & CloudAuto-check passed
  • Creates DrawIO XML diagrams of Google Cloud architectures from text or images, and analyzes existing .drawio files to list their GCP components.

    1.8k GitHub stars~3.7k tokensUpdated 24 days ago
    DevOps & CloudAuto-check passed
  • Google Agents CLI Publish

    pifferologo/cloud-agents-cli

    This skill should be used when the user wants to "publish an agent", "publish my ADK agent", "register an agent with Gemini Enterprise", "publish to Gemini Enterprise", or needs guidance on the…

    129 GitHub starsUsed in 1 repo~2.4k tokens
    DevOps & CloudAuto-check passed
  • Deploying

    GoogleCloudPlatform/race-condition

    Guides deployment of Race Condition to a GCP project. An agent skill from GoogleCloudPlatform/race-condition.

    234 GitHub stars~3k tokensUpdated 6 days ago
    DevOps & CloudAuto-check passed

More from divinevideo/divine-mobile

All 103 skills in this repo
  • Fix ArgoCD ExternalSecret deployment failing with "namespace X is not permitted in project Y".

    266 GitHub stars~931 tokensUpdated today
    Auto-check passed
  • Art Direct

    divinevideo/divine-mobile

    Art direction for any content — reads text, PDF, Word, HTML, PPT, then proposes 2-3 creative directions with photography style, mood, and visual language.

    266 GitHub stars~4.8k tokensUpdated today
    Auto-check passed
  • Async Await Null Race Condition

    divinevideo/divine-mobile

    Fix "Null check operator used on a null value" errors when an object is set to null during an async await.

    266 GitHub stars~881 tokensUpdated today
    Auto-check passed
  • AWS V4 Signing Custom Headers Gcs

    divinevideo/divine-mobile

    Add custom metadata headers (x-amz-meta-) to AWS v4 signed requests for GCS S3-compatible API.

    266 GitHub stars~1k tokensUpdated today
    Auto-check passed
  • Bash Herestring Newline Secrets

    divinevideo/divine-mobile

    Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings.

    266 GitHub stars~791 tokensUpdated today
    Auto-check passed
  • Fix silent video/media processing failures caused by URL extraction code that filters on file extensions (.mp4, .webm, .webp).

    266 GitHub stars~1.1k tokensUpdated today
    Auto-check passed

Categories

Questions about Cloud Scheduler Permission Denied

What does Cloud Scheduler Permission Denied do?

Fix Google Cloud Scheduler silently failing to trigger Cloud Run jobs with status code 7 (PERMISSIONDENIED). Cloud Scheduler Permission Denied is an agent skill from divinevideo/divine-mobile. Fix Google Cloud Scheduler silently failing to trigger Cloud Run jobs with status code 7 (PERMISSIONDENIED).

When should I use Cloud Scheduler Permission Denied?

Cloud Scheduler Permission Denied fits situations like: cloud Run jobs with status code 7 (PERMISSIONDENIED); cloud Run jobs stop running but schedulers show ENABLED; gcloud scheduler jobs describe shows lastAttemptTime but status.code: 7; jobs worked before but stopped after IAM changes.

How do I install Cloud Scheduler Permission Denied in Claude Code?

Run `npx skills add divinevideo/divine-mobile --skill cloud-scheduler-permission-denied -a claude-code`. Or copy the skill folder (.agents/skills/cloud-scheduler-permission-denied in divinevideo/divine-mobile) into .claude/skills/cloud-scheduler-permission-denied in your project. Claude Code loads it when a task matches its description.

How do I install Cloud Scheduler Permission Denied in Codex?

Run `npx skills add divinevideo/divine-mobile --skill cloud-scheduler-permission-denied -a codex`. Or copy the skill folder (.agents/skills/cloud-scheduler-permission-denied in divinevideo/divine-mobile) into .agents/skills/cloud-scheduler-permission-denied in your project. Codex loads it when a task matches its description.

Can I use Cloud Scheduler Permission Denied in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add divinevideo/divine-mobile --skill cloud-scheduler-permission-denied -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cloud-scheduler-permission-denied, .gemini/skills/cloud-scheduler-permission-denied, .github/skills/cloud-scheduler-permission-denied and .opencode/skills/cloud-scheduler-permission-denied in your project.

What does Cloud Scheduler Permission Denied need to run?

Going by SKILL.md and its folder, Cloud Scheduler Permission Denied needs the command-line tools its instructions call (gcloud).

Does Cloud Scheduler Permission Denied access the network?

SKILL.md names 2 domains. As links in the text: cloud.google.com and grpc.io. This is read from the text; nothing was executed.

Is Cloud Scheduler Permission Denied safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Cloud Scheduler Permission Denied use?

Cloud Scheduler Permission Denied is published under the MPL-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Cloud Scheduler Permission Denied use?

About 843 tokens (SKILL.md is roughly 3.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Cloud Scheduler Permission Denied?

Skills that share tags, products or a category with Cloud Scheduler Permission Denied: Devops (nicepkg/auto-company, 195 stars), Broccoli Oss GCP Deploy (besimple-oss/broccoli, 285 stars), Canary (atelier-fashion/adlc-toolkit, 171 stars) and GCP DrawIO Diagram Generator (a5c-ai/babysitter, 1.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Cloud Scheduler Permission Denied?

divinevideo (a GitHub organization) maintains it in divinevideo/divine-mobile, which has 266 GitHub stars. The repository holds 103 skills in this directory. The repository was last updated on October 10, 2026.

Source: divinevideo/divine-mobile on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.