Skip to content
Get packs

Guide · Agent skill

How to use the Google Cloud Networking Observability agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The google-cloud-networking-observability skill teaches an AI agent how to investigate networking problems in a Google Cloud project, such as dropped packets, blocked connections, NAT port exhaustion and latency. It is aimed at cloud and network engineers who want fast answers about traffic without writing every query by hand. After this guide you will know what a skill is, how to install this one, how to ask for work in plain language, and what safety limits apply.

Google Cloud Networking Observabilitygoogle/skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this page and unzip it. The folder is named google-cloud-networking-observability.
  2. 2Place the folder. Move it to ~/.claude/skills/ for personal use, or to a project's .claude/skills/ folder to limit it to that project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
  3. 3Check your access. Confirm you have a Google Cloud project and IAM permissions to read logs, metrics and network resources.
  4. 4Describe the problem. Ask in plain language, naming the project, the resource and a time window such as the last 12 hours.
  5. 5Review the query. Read the SQL or command the agent prints before it runs, and approve it if it matches your intent.
  6. 6Read the answer. Check the direct result and the Flow Analyzer link the agent provides.
  7. 7Verify before changing anything. Cross-check findings with your own tools before making any production change.

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and reference files that an AI agent loads when a request matches the skill's description. This skill is for Google Cloud networking observability. Once installed, the agent is guided to pick the right data source for your question: VPC Flow Logs, firewall logs, Cloud NAT logs, threat logs, networking metrics or Connectivity Tests.

The skill asks the agent to run a minimal query, show the answer quickly, and read its detailed reference guides only when they are needed. It also helps estimate VPC Flow Logs cost.

  • Investigate dropped or blocked traffic and drop reasons
  • Check firewall rules, NAT gateways and Private Service Connect traffic
  • Look at traffic volume, top talkers and latency
  • Run Connectivity Tests to find firewall or routing blocks between endpoints
  • Estimate VPC Flow Logs cost

Install the skill from a ZIP file

Download the ZIP for this skill from this page and unzip it. The skill folder is named google-cloud-networking-observability and contains a SKILL.md file at its top level.

For a personal install, place the folder in ~/.claude/skills/. To limit the skill to one project, place it in that project's .claude/skills/ folder instead.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

  • Personal: ~/.claude/skills/
  • Single project: the project's .claude/skills/ folder
  • Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with natural requests

You do not need to name the skill. The skill's description covers requests about dropped network traffic, packet drops, drop reasons, VPC Flow Logs, NAT, firewall or threat logs, latency and throughput metrics, and Connectivity Tests. Describe the problem, the project and the timeframe, and the agent will decide which source to use.

Include the resource name if you know it, such as a NAT gateway or VPN tunnel. Give a time window like 'the last 12 hours' so the agent can calculate the range on its first turn.

  • Why are connections to 10.0.2.15 on port 443 being blocked in project my-project over the last 6 hours?
  • Which NAT gateway had the most dropped packets this week?
  • Estimate the monthly cost of VPC Flow Logs for subnet prod-subnet.
  • Run a connectivity test from instance web-1 to database-1 and tell me if the path is open.

What the agent does while it works

The skill sets a few working rules. The agent prefers BigQuery linked datasets for high-volume analysis, inspects one sample log record before writing complex queries, and uses MCP servers first. It uses gcloud or bq only when MCP servers are unavailable, and falls back to curl templates for metrics.

It is told to stop once it has a direct answer, including a zero or 'no traffic' result, and not to run extra checks unless you ask. It is also told to print the generated SQL before running it and to link to the Flow Analyzer in the Google Cloud Console.

  • Prefers BigQuery linked datasets such as _AllLogs for trends and top talkers
  • Shows generated SQL for review before execution
  • Links to the Flow Analyzer in the Google Cloud Console
  • Reports zero or no-data results as the final state for that timeframe

What you need before you start

You need a Google Cloud project and IAM access that lets you read logs, metrics and network resources. The skill queries live logs and metrics, so it will not work without credentials. The skill uses the gcloud CLI and bq CLI, the Cloud Monitoring, BigQuery and Cloud Logging MCP servers (preferred), and curl for the metrics API fallback.

  • A Google Cloud project with IAM read access to logs, metrics and network resources
  • gcloud CLI and bq CLI (used when MCP servers are unavailable)
  • Cloud Monitoring, BigQuery and Cloud Logging MCP servers (preferred)
  • curl for the metrics API fallback

Safety notes: scripts and network access

This skill runs scripts and uses the network. It can run gcloud and bq commands against real infrastructure. The skill's own rules forbid the agent from writing and running local shell scripts or Python files for data retrieval, and ask it to use direct bq, curl and gcloud calls instead.

Treat the agent's suggestions as leads to verify. The skill's guidance favours speed over cross-checking, so do not make production changes based on the agent's suggestion alone. The skill also excludes general VM provisioning and non-networking tasks.

  • Review the SQL and commands the agent prints before they run
  • Do not make production changes on the agent's suggestion alone
  • Connectivity Tests can create and then delete test resources; the reference says the delete command must be the final tool call and its output is shown as proof
  • Confirm an instance is RUNNING: a REACHABLE result is a static configuration analysis and does not guarantee traffic will flow

What people use it for

  • Finding which firewall rule is denying connections to a service
  • Spotting NAT port exhaustion by counting dropped NAT allocations per gateway
  • Listing top talkers in VPC Flow Logs over a chosen time window
  • Checking whether a network path is configured to allow traffic between two instances with Connectivity Tests
  • Estimating the cost of turning on VPC Flow Logs before enabling them

Frequently asked questions

How do I install the google cloud networking observability skill?

Download the ZIP from this page and unzip it. Place the google-cloud-networking-observability folder in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder. In the Claude apps you can upload it under Settings → Capabilities → Skills.

What do I need to use this skill?

You need a Google Cloud project and IAM access to read logs, metrics and network resources. The skill also uses the gcloud and bq CLIs, the Cloud Monitoring, BigQuery and Cloud Logging MCP servers (preferred), and curl for the metrics API fallback.

Is the google cloud networking observability skill free?

The skill is published under the Apache-2.0 licence. This page does not state pricing for Google Cloud services that its queries may use, so check your own Google Cloud billing for logs and queries.

Does this skill run scripts or use the network?

Yes. The skill runs scripts and uses the network, and it can run gcloud and bq commands against live infrastructure. Its rules tell the agent not to write local shell or Python scripts for data retrieval, and to show SQL before execution.

What is the difference between VPC Flow Logs, firewall logs and Cloud NAT logs?

VPC Flow Logs capture sample IP traffic to and from network interfaces, which suits volume trends and top talkers. Firewall logs record connection attempts matched by firewall rules, which suits DENY events. Cloud NAT logs audit translations through NAT gateways and help with port exhaustion.

Why does my query return no results or fail with an Unrecognized name error?

If a VM name returns nothing, the subnetwork may be set to EXCLUDE_ALL_METADATA, so retry using the internal IP in jsonPayload.connection.src_ip. For Unrecognized name errors, the skill's guidance is to check the table schema with bq show --schema and test the query with a dry run before running it.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits cloud and network engineers who troubleshoot blocked or dropped traffic in a Google Cloud project and want fast, query-backed answers. It is not suited to general VM management, to people without credentials for a Google Cloud project, or to anyone who would make production changes on the agent's word alone; for those, use your own verified tools and review processes.

Download the skill