Google Cloud Networking Observability (google/skills): a Claude skill that investigates GCP network problems from logs and metrics

This Google skill makes Claude investigate Google Cloud network problems using flow logs, firewall, NAT and threat logs, metrics and Connectivity Tests.

Installs: 12.3K; on skills.sh
Stars: 21.8K; on GitHub
Files: 9; besides SKILL.md
Updated: Nov 2026; last repo commit

Ask why traffic is dropped, what a firewall is blocking, which IPs send the most bytes or what a flow log setup would cost, and this skill tells Claude where to look. It prefers BigQuery log datasets for large counts, then Cloud Monitoring for latency and throughput, and Connectivity Tests for path checks. It uses Google Cloud MCP servers first, and falls back to gcloud, bq and curl.

The skill is built for short, direct answers. SKILL.md tells Claude to show the SQL before it runs, stop after the first conclusive result, and treat zero traffic as a real answer. It bundles no scripts and needs access to a Google Cloud project.

Good for

Cloud and network engineers debugging dropped traffic in GCP
Security teams reading firewall and threat logs
FinOps teams estimating the cost of VPC Flow Logs

Install google-cloud-networking-observability

Claude Code

1
Download the skill folder from https://github.com/google/skills/tree/HEAD/skills/cloud/google-cloud-networking-observability.
2
Put it at ~/.claude/skills/google-cloud-networking-observability/ so that SKILL.md sits directly inside.
3
Start a new session; the skill loads when its description matches the task.

Pick google-cloud-networking-observability when the installer asks which skills to add. The skill uses gcloud and bq on your machine and, when available, Google Cloud MCP servers, so the Claude app ZIP upload is not offered here. The README's Claude Code plugin route installs different plugins, and the marketplace does not list this skill.

Built from the package data we hold. Not yet tested by us.

What's in the skill

When it loads

Investigates Google Cloud networking issues by analyzing GCP logs, metrics, and diagnostics. Use when investigating dropped network traffic, packet drops, drop reasons, VPC Flow Logs (including Private Service Connect / PSC, serverless / App Engine Direct VPC, and cost estimation), NAT, firewall, or threat logs, querying latency and throughput metrics, or running Connectivity Tests for path diagnostics. Don't use for generic VM management or non-observability tasks.

Sections in SKILL.md

Attribution
🛑 Core Directive: Results First
Log & Telemetry Overview
Procedures
0. Log Source Preference
1. Tool Selection & Discovery
2. Schema Verification & Error Recovery
3. Analysis Guides (Read Only When Needed)
Boundaries (CRITICAL)

Key facts

Author: google (GitHub)
Repo: google/skills (skills/cloud/google-cloud-networking-observability)
License: Apache-2.0
Installs on skills.sh: 12,293 as of 2026-11-02
GitHub stars: 21,764 (whole repo) as of 2026-11-02
Last repo commit: 2026-11-01
Folder contents: 10 files including SKILL.md: 9 reference guides (flow logs, cost estimation, NAT, firewall, threats, metrics, Connectivity Tests, MCP usage, attribution)
Version in SKILL.md: 1.0.5, category Compute
Needs: Google Cloud project access; gcloud and bq CLIs or Google Cloud MCP servers
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk pass

What it includes

Find the right source, run the minimum query, present the result and stop.
Core directive
Prefers BigQuery linked datasets over Cloud Logging for aggregations.
Runs code · Log source preference
Uses Cloud Monitoring, BigQuery and Cloud Logging MCP servers, then gcloud and bq.
Runs code · Tool selection
Inspects one sample record, runs bq dry runs, and retries failed queries.
Runs code · Schema check and retry
SQL patterns and fields for traffic, top talkers, drops and packet loss.
Read · VPC Flow analysis
Estimates monthly VPC Flow Logs cost for subnets, VPCs or a project.
Runs code · Flow Logs cost estimate
Audits NAT translations and port exhaustion.
Read · Cloud NAT analysis
Finds DENY events and checks ALLOW rules.
Read · Firewall analysis
Reads Cloud Firewall Plus and Cloud IDS threat logs.
Read · Threat log analysis
Latency, throughput and packet loss through Cloud Monitoring.
Runs code · Metrics analysis
Creates a path test, reads the result, then deletes it.
Delete · Connectivity Tests
Adds a skill tag to gcloud and HTTP calls unless you opt out.
Network · Usage attribution

From the official docs

Permissions

Medium risk

Claude runs gcloud, bq and curl commands in your Google Cloud project with your credentials, and can create and delete Connectivity Test resources. Use read-only roles unless you need path tests.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It runs cloud commands with your credentials
Queries run through gcloud, bq, curl and Google Cloud MCP servers under your account. BigQuery queries can cost money, so read the SQL that SKILL.md tells Claude to print first. The cost-estimation reference also pipes output into `python3 -c` as an in-memory calculator.
Connectivity Tests are created and deleted
The connectivity reference tells Claude to create a test resource and delete it as its last step. Check that nothing is left behind if a run stops early.
Commands carry a usage tag
References/attribution.md tags gcloud commands and HTTP calls with agent-skills/1.0 (skill:google-cloud-networking-observability). It says no user data is sent, and that Claude should omit the tag if you ask.

Technical details

Talks to	Google Cloud APIs through gcloud, bq, curl and MCP servers
Sign-in and keys	Uses whatever Google Cloud credentials your gcloud and MCP setup already hold.

Questions

What does the skill do?

It investigates Google Cloud networking issues. It covers dropped traffic, VPC Flow Logs, Private Service Connect and serverless flows, Cloud NAT, firewall and threat logs, latency and throughput metrics, Connectivity Tests, and VPC Flow Logs cost estimates.

How do I install it?

Use the install box above. The google/skills README installs with npx skills add google/skills and asks which skills to take. Pick this one by name.

What does it need access to?

A Google Cloud project you can read. SKILL.md prefers the Cloud Monitoring, BigQuery and Cloud Logging MCP servers, and falls back to gcloud and bq. It prefers BigQuery datasets that are linked to your logs.

Can it change my cloud setup?

Mostly it reads logs and metrics. Connectivity Tests are the exception: SKILL.md says to create a test through the Network Management MCP server or gcloud, read the result, then delete the test and show the delete output.

Does it send data to Google?

Its attribution guide tells Claude to add a tag to commands it runs. This is the CLOUDSDK_METRICS_REQUEST_ATTRIBUTION variable on gcloud and a User-Agent suffix on direct HTTP calls. The guide says the tag identifies only the skill and version and carries no user data. Ask Claude to omit the tag and it should.

Is it safe?

It runs gcloud, bq and curl commands against your project, so it uses your Google Cloud credentials. SKILL.md tells Claude to print generated SQL before running it and to dry-run corrected queries. Use an account with read-only roles unless you want it to create Connectivity Tests.

Does it work in Codex or Gemini CLI?

The google/skills README installs for "target agents" through the skills CLI without naming each one. The cost reference is written for "Agent / Gemini CLI". Use the install box and pick your agent.

Will it dig deeper if the first answer looks odd?

No. SKILL.md bans extra checks: no more than 2 exploratory queries before showing results, no second data source once one is conclusive, and no deep dive when two tools disagree.

Information

updated Nov 2, 2026

Repository: google/skills
Folder: skills/cloud/google-cloud-networking-observability

google/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

google/skills README · github.com
google-cloud-networking-observability SKILL.md · github.com
attribution.md · github.com
mcp-usage.md · github.com
connectivity-tests.md · github.com
vpc-flow-logs-cost-estimation.md · github.com
google-cloud-networking-observability on skills.sh · skills.sh