google/skills

This system is a collection of operational skills and CLI tools designed to guide users through complex Google Cloud infrastructure tasks, with a strong emphasis on safety, cost control, and automated validation. It covers the full lifecycle of AI/ML workloads—including model tuning, inference, and evaluation—as well as core platform management for GKE, BigQuery, and IAM. The system provides prescriptive workflows, diagnostic scripts, and migration utilities to help engineers design, deploy, and troubleshoot cloud resources while preventing accidental costs or security misconfigurations.

The Data Agent Kit directory now vendors Google Data Cloud plugins (including AlloyDB, BigQuery, Cloud SQL, Spanner, and others) as git submodules, enabling the Antigravity CLI to discover and install these plugins directly from repository paths. This change introduces a new installation mechanism for \agy\ that bypasses the need for a marketplace manifest, with each plugin pinned to a specific upstream release tag to ensure stability.

plugins/cloud/data-agent-kit · high confidence

Adds the \agent-platform-eval-flywheel\ skill, providing a structured methodology to evaluate and iteratively improve GenAI models and agents on Google Cloud. The skill introduces mandatory safety and confirmation tiers to prevent accidental costs or unsafe actions during evaluation, and includes new reference guides and scripts for deploying and evaluating models on Agent Platform endpoints (BYOM) and Model-as-a-Service (MaaS) models. It also adds support for evaluating Managed Agents and provides detailed patterns for dataset creation, metric selection, and failure analysis.

skills/cloud/agent-platform-eval-flywheel · high confidence

This change adds a new set of Python scripts to the agent-platform-alert-configuration skill to automate the setup and validation of monitoring for Vertex AI Reasoning Engines. The \gather\_agent\_info.py\ script locates agents using Cloud Asset Inventory or direct API scans, while \check\_telemetry.py\ verifies that required telemetry environment variables are enabled. The \create\_online\_monitor.py\ script provisions Online Evaluators for quality metrics like hallucination and response quality. Additionally, \analyze\_traffic.py\ classifies agent traffic patterns (e.g., steady, bursty, seasonal) to recommend optimal dynamic alerting strategies, and \config\_utils.py\ provides shared utilities for linting PromQL queries and validating alert policy configurations.

skills/cloud/agent-platform-alert-configuration/scripts · high confidence

Users can now generate valid PromQL queries for Google Cloud Monitoring metrics using the new cloud-monitoring-promql-query skill. This skill provides a structured workflow to map Cloud Monitoring metric descriptors to PromQL structures, handling project ID resolution, resource filtering, and aggregation selection based on metric kinds and value types. It includes a Python-based validation script (validate\_promql.py) that enforces Cloud Monitoring-specific semantic rules, such as requiring monitored\_resource filters, wrapping counter metrics with rate/increase, and ensuring histogram\_quantile usage for distribution metrics. The skill also includes reference guides for aggregation mappings and error recovery to help users diagnose and fix common PromQL syntax and semantic issues.

skills/cloud/cloud-monitoring-promql-query · high confidence

Added a new skill that provides instructions and example scripts for performing inference with Google Cloud Agent Platform GenAI models, including first-party Gemini models and third-party OpenMaaS models (Llama, DeepSeek, Qwen). The skill introduces mandatory safety and confirmation tiers, requiring interactive user approval before executing inference to prevent unexpected costs, and enforces strict parameter grounding for model IDs, project IDs, and regions. It includes example scripts for the Google GenAI SDK, OpenAI SDK, and Vertex AI SDK, along with a verification script to ensure the environment is correctly set up.

skills/cloud/agent-platform-inference · high confidence

A new skill for the Agent Platform has been added to guide the deployment of open models and custom weights from Model Garden to Agent Platform endpoints, including undeployment and resource cleanup. The skill introduces strict safety tiers requiring explicit user confirmation for mutating (deploy/undeploy) and destructive (delete) actions, and mandates live catalog queries to recommend specific model versions rather than relying on static knowledge. It also includes a dedicated workflow for copying and deploying First-Party (1P) Tuned Models across regions and projects, handling IAM bindings and Long-Running Operation polling. To support cost transparency, a new Python script (\calculate\_cost.py\) provides hourly deployment cost estimates based on machine types, with a built-in staleness warning mechanism to flag outdated pricing data.

skills/cloud/agent-platform-deploy · high confidence

Users can now fine-tune open models (Llama, Gemma, Qwen) and Gemini models using the Agent Platform infrastructure. This new skill provides a structured workflow covering environment setup, dataset preparation (including JSONL validation and Hugging Face dataset integration), model selection with baseline hyperparameter recommendations, job execution, monitoring, and cost estimation. It includes reference documentation for supported models and tuning heuristics, along with utility scripts to prepare datasets, launch tuning jobs, monitor progress, cancel jobs, and estimate costs based on model-specific token-to-character ratios and pricing.

skills/cloud/agent-platform-tuning · high confidence

Added a new skill, \application-design-center-design-deploy\, that provides a prescriptive, agent-controlled workflow for designing and deploying Google Cloud infrastructure using Terraform within the Application Design Center (ADC). This replaces the previous automated \design\_infra\ tool with a structured process that includes local HCL validation, a shifted-left best-practices plan scan via the ADC assessment API, and guided troubleshooting for deployment failures. The skill enforces strict security policies, such as keeping state local during validation and ensuring all secrets are managed via GCP Secret Manager, while guiding users through importing validated templates into the ADC registry for lifecycle management.

skills/cloud/application-design-center-design-deploy · high confidence

A new skill has been added to analyze Google Cloud BigQuery slot consumption, query costs, and execution bottlenecks. It includes a Python CLI utility (\scripts/slot\_analyzer.py\) that extracts telemetry from \INFORMATION\_SCHEMA.JOBS\_BY\_PROJECT\ to calculate slot-hours, identify slot contention, detect Cartesian joins, and flag costly unpartitioned table scans. The skill also provides reference documentation with diagnostic SQL queries, remediation playbooks for specific issues (slot contention, join explosions, unpartitioned scans), and architectural optimization rules for partitioning, clustering, and BI Engine usage.

skills/cloud/bigquery-slot-cost-optimizer · high confidence

A new \gke-alert-configuration\ skill has been added to the \skills/cloud\ directory to guide the creation of alerting policies for Google Kubernetes Engine (GKE) clusters using Terraform and Google Cloud Managed Service for Prometheus. The skill enforces best practices for monitoring the 4 Golden Signals (latency, errors, traffic, saturation) and cluster health, specifically requiring Multi-Window Multi-Burn-Rate SLO alerts for error rates and dynamic PromQL queries for traffic drop detection. It includes strict guardrails to manage costs associated with \kube-state-metrics\ (KSM), requiring user permission before generating Tier 2 KSM-dependent alerts and recommending filtered \PodMonitoring\ resources to minimize ingestion charges. The skill also provides a Python validation script (\scripts/validate\_config.py\) to lint PromQL syntax and Terraform HCL configurations before deployment.

skills/cloud/gke-alert-configuration · high confidence

A new GKE Cluster Autoscaler skill has been added to the Containers category, providing comprehensive guidance on enabling, optimizing, and troubleshooting cluster autoscaling. The skill introduces support for the new CapacityBuffer CRD (Preview), allowing users to pre-warm node capacity using active or standby strategies to reduce latency during traffic spikes. It also includes new diagnostic assets: a shell script to scan for scale-down blockers (such as bare pods, local storage, and tight PDBs) and another to live-tail visibility logs for scale-up and scale-down events. The documentation covers advanced topics like ComputeClass-based node pool auto-creation, location policies for zone balancing, and handling zonal stockouts.

skills/cloud/gke-cluster-autoscaler · high confidence

A new skill for configuring, optimizing, and troubleshooting GKE ComputeClasses has been added. It provides comprehensive guidance on cost optimization (Spot VMs with on-demand fallback), GPU/TPU workloads, and performance tuning, along with specific rules for handling Committed Use Discounts (CUDs), capacity quotas, and node pool auto-creation. The skill includes a set of example YAML templates for various scenarios, including balanced zonal reservations, capacity quota spillover, RBAC safeguards, dynamic RWO storage classes for stateful workloads, and specialized classes for GenAI inference, Kafka, Postgres, Redis, Spark, and TPU training.

skills/cloud/gke-compute-classes · high confidence

A new diagnostic skill has been added to help users autonomously troubleshoot GKE JobSet interruptions, restarts, and preemptions for large-scale AI/ML training workloads. The skill provides a structured workflow to identify restart loops, inspect nodepool interruptions (such as spot VM preemptions or maintenance events), correlate node readiness failures with host VM issues, and detect worker application hangs. It includes specific MQL and PromQL queries for metrics, LQL filters for Cloud Logging, and reference documents detailing failure signatures like kernel panics and NCCL timeouts. A validation script is also included to verify the correctness of the logging and Prometheus queries against a target project.

skills/cloud/gke-ai-troubleshooting-jobset-interruption · high confidence

A new skill named 'gke-workload-security' has been added to the skills/cloud directory to help users audit, configure, and harden workload-level security controls for Google Kubernetes Engine (GKE). This skill provides documentation and executable assets for key security workflows, including running a cluster audit script (audit\_cluster.sh) to check configurations like Workload Identity and Network Policies, setting up Workload Identity Federation for secure API access, implementing default-deny Network Policies, isolating pods using GKE Sandbox (gVisor), enforcing Pod Security Standards, and integrating with Secret Manager via CSI drivers. It is distinct from platform-level security controls and is intended for securing specific namespaces and workloads.

skills/cloud/gke-workload-security · high confidence

A new \gke-app-onboarding\ skill has been added to guide users through containerizing and deploying applications to Google Kubernetes Engine. This skill provides a structured workflow covering app assessment, containerization (with multi-stage build best practices), image management via Artifact Registry, and Kubernetes manifest generation. It includes concrete, production-hardened examples for both Node.js and Go applications, featuring secure configurations such as non-root users, read-only root file systems, dropped capabilities, and digest-pinned images, along with health check endpoints and resource limits.

skills/cloud/gke-app-onboarding · high confidence

Added a new skill for the Gemini Enterprise Agent Platform that enables agents to interact with the Skill Registry. This includes capabilities for discovering skills (search, list, get, inspect revisions), managing the skill lifecycle (upload, update, delete), and monitoring long-running operations. The skill provides a Python-based CLI tool (\skill\_registry\_ops.py\) and a validation script to handle authentication via Google Cloud credentials and execute these registry operations against the \v1beta1\ API.

skills/cloud/agent-platform-skill-registry · high confidence

A new skill has been added to generate a LiveAPI client service class for the Gemini Enterprise Agent Platform. This skill guides the creation of a client that connects to the Gemini Live API over WebSockets, handling bidirectional streaming, bearer-token authentication via Application Default Credentials, and transparent session resumption. It includes reference definitions for the \ClientMessage\ and \ServerMessage\ wire protocols and instructions for building a demo frontend and backend service to validate text, audio, video, and transcription interactions.

skills/cloud/gemini-live-api · high confidence

A new 'cloud-databases-onboarding' skill has been added to guide users through selecting and provisioning Google Cloud database services. The skill implements a three-phase workflow: Phase 1 gathers user requirements (data model, workload, scale) using discovery prompts; Phase 2 recommends a specific GCP database (e.g., Cloud SQL, AlloyDB, Spanner) based on a structured recommendation matrix; and Phase 3 assists in drafting Infrastructure-as-Code (Terraform or gcloud CLI) for the selected database, enforcing validation and user review before execution. The skill includes a Python validation script to verify reference files and formatting, ensuring the onboarding instructions and selection logic are consistent.

skills/cloud/cloud-databases-onboarding · high confidence

Added a new skill that enables agents and cloud engineers to inspect, search, and read files on Google Cloud Filestore (NFS) instances without local NFS client packages or root privileges. The skill provides a CLI runner (scripts/nfs\_browser.py) that supports two execution engines: a Cloud Run Serverless NFS Bridge (primary, via HTTP/OIDC) and a GCE Jump Host via IAP SSH (fallback). It exposes read-only operations including directory tree exploration, filename/content search, chunked file reading, and POSIX metadata inspection, with built-in safeguards such as path traversal protection, binary file detection, and context-window-safe chunking. The package also includes setup guides, architecture documentation, and unit tests for the CLI and helper modules.

skills/cloud/google-cloud-filestore-nfs-browser · high confidence

A new skill has been added to audit Google Cloud Filestore instances for disaster recovery readiness, security access governance, and architectural reliability. The skill includes a Python engine (\scripts/filestore\_audit.py\) and reference documentation that checks for missing or stale backups, overly permissive NFS export rules (such as \0.0.0.0/0\ exposure or missing \ROOT\_SQUASH\), and compliance with Physical Zone Isolation (PZI) and Physical Zone Separation (PZS) standards. It provides a severity-based scoring matrix and generates remediation commands for unprotected instances, requiring explicit user confirmation before executing any backup creation or configuration changes.

skills/cloud/google-cloud-filestore-auditing · high confidence

Adds a new skill that provides structured workflows for diagnosing and remediating Google Cloud IAM access denials. The skill supports two modes: a Requester Flow for developers to perform self-service Just-In-Time (JIT) PAM activations or escalate structured tickets, and a Resolver Flow for administrators to analyze policies using the Policy Troubleshooter, manage deny exemptions, and provision least-privileged roles. It includes Python scripts to automate least-privileged role discovery and error ID troubleshooting, along with reference guides defining safety guardrails and Human-in-the-Loop approval tiers for role provisioning.

skills/cloud/iam-helper-for-troubleshooting · high confidence

Added a new agent skill that safely simulates and applies Google Cloud IAM v1 (Allow) policy changes for Projects, Folders, or Organizations. The skill enforces a strict workflow: it retrieves the current policy, prepares the proposed changes, and runs a Policy Simulator replay of the last 90 days of access logs to detect potential breakage. A helper script analyzes the simulation results, and the policy is only applied if no access is revoked; otherwise, the user is informed of the specific disruptions. This prevents accidental loss of access to active workloads during IAM modifications.

skills/cloud/iam-helper-for-policy-simulator · high confidence

Introduces the \cloud-monitoring-chart-generation\ skill, which transforms PromQL or ListTimeSeries JSON payloads into valid Google Cloud Monitoring Server-Driven UI (SDUI) \Widget\ Protocol Buffer textprotos. The skill executes a three-stage pipeline: \compute\_labels\ generates baseline titles and axis labels; an LLM synthesizes a \SemanticPlotSpec\ (title, axis label, plot type, unit override); and \assemble\_widget\_proto\ constructs the final textproto, automatically using UUID-based filenames to prevent parallel execution collisions. The output is designed for ingestion by the Cloud Monitoring Dashboards API, gcloud CLI, or declarative dashboard pipelines, with strict validation ensuring mutually exclusive query types (PromQL vs. ListTimeSeries) and structural integrity.

skills/cloud/cloud-monitoring-chart-generation · high confidence

A new skill has been added to automate the migration of dbt models from Snowflake to Google Cloud BigQuery. This tool provides a Python-based translation engine and a guided workflow that handles dialect translation, Jinja macro masking, AST-based configuration transformation, and standardization of JSON extraction and type casting. It leverages the BigQuery Migration Service for bulk SQL translation and enforces Google-specific coding standards, including mandatory copyright headers and explicit type safety, to ensure the resulting BigQuery models are compliant and ready for use.

skills/cloud/dbt-sf-to-bq-translator · high confidence

Added the \iam-helper-for-privileged-access-management\ skill to the Google Cloud skills library, providing step-by-step guidance for managing the lifecycle of on-demand, temporary access via Privileged Access Manager (PAM). This skill enables users to create, read, update, and delete PAM entitlements, request temporary access elevations, and approve or deny pending grant workflows. It includes reference documentation for requester and approver modes, a YAML template for entitlement configurations, and helper scripts to search for eligible entitlements across the resource hierarchy (projects, folders, and organizations).

skills/cloud/iam-helper-for-privileged-access-management · high confidence

A new guided skill has been added to help users migrate existing AI inference workloads (from Cloud Run, Gemini API, or Gemini Enterprise Agent Platform) to self-hosted inference on Google Kubernetes Engine (GKE). The skill provides a structured, four-phase workflow—Discovery, Solution Design, Implementation, and Validation—using native \gcloud\ and \kubectl\ commands. It includes template manifests for vLLM deployments, Custom Compute Classes (CCC) for GPU provisioning, GKE Gateway API configurations for load balancing, and model staging jobs, ensuring best practices like Workload Identity, secure secret handling, and Cloud Storage FUSE integration are followed during the migration.

skills/cloud/google-cloud-solution-guided-gke-ai-migration · high confidence

Added a new skill that guides the design and implementation of secure, multi-tier serverless web applications on Google Cloud using Cloud Run and Cloud SQL for PostgreSQL. The skill provides a structured workflow for requirements discovery, architecture design, and implementation, including a Terraform template (assets/main.tf) that enforces strict network isolation via Private Service Connect, Direct VPC Egress, and Cloud NGFW firewall policies. It supports both custom domain deployments with Google-managed SSL certificates and sandbox testing with self-signed certificates, and includes guidance for optional features like Memorystore for Redis caching, Cloud CDN, and VPC Service Controls.

skills/cloud/google-cloud-solution-n-tier-serverless-web-app · high confidence

Added a new skill that provides guidance, configuration templates, and scripts for designing and securing Google Cloud Agent Gateway solutions. This includes assets for ingress (CLIENT\_TO\_AGENT) and egress (AGENT\_TO\_ANYWHERE) patterns, covering Model Armor guardrails, IAP authorization policies, and hybrid VPN connectivity. The skill also supplies deployment scripts for importing Agent Gateways and Authz policies, along with validation scripts to verify security controls and troubleshoot common failures.

skills/cloud/google-cloud-solution-multi-agent-security · high confidence

Added a new diagnostic skill for GKE TPU v6e nodes that guides users through identifying and resolving \vbar\_control\_agent\ segfaults, out-of-memory errors, and TPU device initialization failures caused by race conditions during device resets or high-frequency metrics polling. The skill provides a structured workflow to check serial console logs for OOMs, investigate \tpu-device-plugin\ metrics fetch failures, and inspect for conflicting custom metrics collection, along with a validation script to verify the associated Cloud Logging queries.

skills/cloud/gke-ai-troubleshooting-tpu-vbar-oom · high confidence

This change introduces the 'Developer Device Platform' skill, providing guidance and scripts for managing remote Android devices on Google Cloud. It includes a main instruction file (SKILL.md) detailing setup, reservation, and session management workflows, along with reference documents for specific API operations like reserving devices, checking status, and canceling sessions. Additionally, it adds a Python script (demo\_adb\_forwarder.py) to establish ADB connections to remote devices via the Device Streaming API.

skills/cloud/developer-device-platform-basics · high confidence

The GKE TPU monitoring capabilities have been renamed to align with the \gke-ai-troubleshooting\ naming convention. This includes the \gke-ai-troubleshooting-tpu-dynamic-slices-monitoring\ skill, which provides guidance for monitoring and troubleshooting TPU Dynamic Slices (including lifecycle states, provisioning failures, and finalizer management), and the \gke-ai-troubleshooting-tpu-metrics-monitoring\ skill, which covers monitoring GKE TPU workloads, nodes, and node pools using system metrics and PromQL queries.

skills/cloud/gke-ai-troubleshooting-tpu-dynamic-slices-monitoring, skills/cloud/gke-ai-troubleshooting-tpu-metrics-monitoring · high confidence

This change adds Python and Node.js dependency manifests for several new agent skills, establishing the runtime environment for the Agent Platform. Specifically, it defines requirements for the alert-configuration skill (using google-cloud-monitoring and google-cloud-aiplatform), the inference skill (using google-genai and openai), the tuning skill (using google-cloud-aiplatform and datasets), and the filestore-nfs-browser skill (using fastapi and uvicorn). It also introduces a basic Node.js application manifest for the GKE app-onboarding skill and a minimal manifest for the skill-registry.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• First survey — no prior run to compare against. CAI 59.

• Code Health 78
• Architecture 100
• Maturity 70
• Readiness 39
• Security 86

• 300 commits — 277 feature/other, 23 fixes

• skills/cloud — 212 commits
• (root) — 31 commits
• plugins/cloud — 31 commits
• skills/ads — 16 commits
• .agents/plugins — 4 commits
• (repo) — 3 commits
• skills/analytics — 2 commits
• skills/developers — 1 commit

• fix: - Fixed CONTRIBUTING.md formatting - Removed metadata from gke-basics/SKILL.md for consistency with other skills
• fix: Fix broken AlloyDB API reference link in alloydb-basics skill.
• fix: Fix broken Bigtable SQL reference link in bigtable-basics skill.
• fix: Fix broken documentation links in gke-platform-security skill.
• fix: Fix broken documentation links in gke-workload-security skill.
• fix: Fix broken load balancing overview link in google-cloud-global-frontend-configuration skill.
• fix: Fix broken relative links in ima-sdk-tvos-guide.md.
• fix: Fix broken rollout sequencing link in gke-upgrades skill.
• fix: Fix defects in finding-google-skills, and correct the google-cloud-developer homepage
• fix: Fix gke-workload-security skill file paths to use relative paths
• fix: Fix google-agents-cli-onboarding tables
• fix: Fix metadata tags format for GCS skills and re-enable in Cloud Skill Registry
• fix: Fix note call-out in top level README.
• fix: Fix relative markdown links in agent-platform-alert-configuration documentation.
• fix: Fix silent-null bucket inspection projection
• fix: Fixed broken link
• fix: Fixed broken link
• fix: Fixes to instructions for utility library installation
• fix: Minor fixes for the agent-platform-alert-configuration skill: - Update the SKILL.md instruction example to use single quotes ('${var.gen_ai_agent_name}') so that bash passes the string literal directly without attempting variable expansion. - In analyze_traffic.py, update argparse so that using --metric-type is required.
• fix: Revert the google-secops plugin release
• …and 280 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

google/skills was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.