Cascades

Open-source Claude Code skills from Transilience AI.

cascades starts with Google Workspace investigation and remediation workflows and is intended to grow into a broader collection of reusable operational and security skills over time.

Transilience AI | Community Tools

Why the name

The Cascades name fits the intended shape of the repository: a unified detection and response system rather than a single isolated tool.

The Cascade Range is a chain of monitored volcanic sentinels watched by the USGS Cascades Volcano Observatory. It includes Mount St. Helens, Mount Rainier, Mount Hood, Mount Baker, and Mount Shasta as part of one defensive line. The range behaves like a seismic early-warning perimeter down the West Coast, with detection infrastructure built into the geology itself.

That is the model for this repository: multiple skills, one coordinated observatory, and a focus on early detection, triage, escalation, and response.

What is included today

The initial public release includes three Google Workspace skills:

• google-workspace-gws-access
• google-workspace-security-triage
• google-workspace-oauth-remediation

These skills help with:

• verifying gws authentication and Admin Reports scopes
• exporting Google Workspace Admin Reports data safely
• triaging login, Drive, admin, and token activity
• reviewing OAuth grants and prioritizing remediation

Repository structure

cascades/
├── .claude/
│   └── skills/
│       ├── CLAUDE.md
│       ├── google-workspace-gws-access/
│       ├── google-workspace-security-triage/
│       └── google-workspace-oauth-remediation/
├── CLAUDE.md
├── CONTRIBUTING.md
├── LICENSE
└── README.md

Requirements

• Claude Code
• gws in PATH
• Python 3 for the helper scripts
• Google Workspace Admin Reports read-only access when using the Google Workspace skills

Quick start

Review the skill docs first:

• .claude/skills/google-workspace-gws-access/README.md
• .claude/skills/google-workspace-security-triage/README.md
• .claude/skills/google-workspace-oauth-remediation/README.md

Typical flow:

./.claude/skills/google-workspace-gws-access/scripts/check_gws_auth.sh

./.claude/skills/google-workspace-oauth-remediation/scripts/run_oauth_incident_review.sh \
  --start 2026-03-01T00:00:00Z \
  --end 2026-04-20T23:59:59Z \
  --output-dir reports/incidents/example-oauth-review \
  --tenant example.com

Design principles

• Keep skills portable and customer-agnostic.
• Prefer read-only access where possible.
• Use exact client IDs and concrete evidence when making security decisions.
• Treat generated outputs as local working data, not repository content.

Related links

• Website: www.transilience.ai
• Transilience AI Community Tools: github.com/transilienceai/communitytools
• Cascades repository: github.com/transilienceai/cascades

Open source safety

This repository is for generic skill code and documentation only.

Do not commit:

• real customer exports
• reports or generated Markdown summaries
• user emails, tenant names, OAuth client IDs, or auth status artifacts from live environments
• caches such as __pycache__/

See CONTRIBUTING.md for contribution rules and sanitization requirements.