Google Cloud Network Observability
Investigate Google Cloud network behavior with logs, metrics, and path diagnostics for VPC, NAT, and firewall issues.
The skill scopes itself to network logs, metrics, and connectivity diagnostics; requires read-oriented queries, SQL display for review, and cleanup of Connectivity Test resources, which reduces overreach and residue. However, it does not specify least-privilege IAM roles, handling of sensitive IP/threat data, user confirmation, or failure rollback, and creating/deleting test resources has external side effects, so points are deducted.
It supplies MCP, gcloud, bq, and curl fallback paths and includes schema validation and retry guidance for BigQuery errors. However, tool names and parameters are inconsistent (for example, execute_sql versus execute_sql_readonly and jsonPayload versus json_payload), some SQL/filter examples appear questionable, and there is no test suite or systematic abnormal-input handling. Static scoring therefore remains limited and deductions are substantial.
The metadata clearly targets VPC Flow Logs, NAT, firewall, threat logs, metrics, and Connectivity Tests while excluding generic VM management and non-observability work. Inputs, output contracts, permission prerequisites, regional/language support, and mainland-China reachability are not defined, and semantic triggering still depends on natural-language interpretation, so full marks are not justified.
The material has a clear main document, topic-specific references, installation entry point, Apache-2.0 licensing, repository maintenance note, and GitHub issue path. The skill lacks its own version, changelog, named maintainer, dependency versions, FAQ, and consolidated limitations; some guidance is scattered or contradictory.
It covers several common Google Cloud networking-observability tasks and provides reusable query templates, a cost-estimation workflow, and a result format. Correctness remains dependent on unverified fields, metric names, and pricing assumptions; the cost workflow is operationally heavy, and treating zero/no-data as conclusive while forbidding cross-checks can reduce diagnostic completeness. Static calibration caps this dimension at 7.
MCP references, a Cloud Console Flow Analyzer link, command templates, and schema-check procedures provide some auditability. There are no committed tests, CI coverage, real example outputs, or third-party corroboration, so key paths cannot be independently reproduced from the files and the static cap applies.
- Running a Connectivity Test creates an external resource; deletion is required, but prior user confirmation and recovery procedures for deletion failure or interruption are unspecified.
- Log and threat analysis may expose sensitive IPs, connection details, and attack payloads; no redaction, least-privilege, or output-retention policy is documented.
- Several references have inconsistent tool names, field casing, and SQL conventions; actual MCP schemas, BigQuery schemas, and metric descriptors should be checked before execution.
- Sampling, byte-size, pricing, and metric assumptions in the cost estimate lack externally verified evidence in the supplied files; results should be treated as estimates only.
What does this skill do, and when should you use it?
This skill focuses on Google Cloud networking observability rather than general VM administration. It analyzes VPC Flow Logs, firewall logs, threat logs, and Cloud NAT logs, and queries throughput, latency, and packet-loss metrics. It can also run Connectivity Tests to diagnose routing or firewall problems between endpoints. It prefers BigQuery, Cloud Monitoring, and Cloud Logging MCP services, with gcloud, bq, or curl as fallbacks when needed.
Identifies the relevant telemetry source; checks for BigQuery linked datasets; prints SQL before execution; queries and aggregates VPC Flow, firewall, threat, and Cloud NAT logs; queries throughput, RTT, and packet-loss metrics; runs Connectivity Tests; validates schemas, performs dry runs, and retries failed BigQuery queries; presents the direct finding and includes the Google Cloud Flow Analyzer link.
- A network engineer needs top talkers or traffic trends from VPC Flow Logs.
- A cloud operations team is auditing Cloud NAT translations or investigating port exhaustion.
- A security team needs firewall DENY events, ALLOW-rule verification, or threat-log analysis.
- An SRE is reviewing historical network throughput, latency, or packet loss.
- A network administrator is diagnosing routing or firewall configuration between two endpoints.
What are this skill's strengths and limitations?
- Covers VPC Flow Logs, Cloud NAT, firewall logs, threat logs, networking metrics, and Connectivity Tests.
- Prioritizes BigQuery linked datasets for high-volume aggregation.
- Includes schema validation, dry runs, and retry guidance for BigQuery errors.
- Treats zero or empty results as definitive findings within the requested scope.
- Requires a Google Cloud environment and gcloud, bq, curl, or the corresponding MCP capabilities.
- The source provides no test suite, version matrix, or concrete IAM permission list.
- Detailed SQL patterns and field definitions are referenced in files whose contents are not provided here.
- It is explicitly out of scope for generic VM management and non-observability tasks.
How do you install this skill?
In an Agent Skills-compatible environment, run: npx skills add google/skills. During installation, select google-cloud-networking-observability. The repository path is skills/cloud/google-cloud-networking-observability. The source does not document the installed directory location.
How do you use this skill?
After installation, use a specific networking-observability request, such as: “Analyze the last 12 hours of VPC Flow Logs and identify the top internal IPs by traffic,” or “Run a Connectivity Test between these endpoints and determine whether a firewall rule blocks the path.” The source does not specify a dedicated command syntax, parameter format, or authentication setup.