Google

Analyze configuration and operational metrics for Managed Service for Apache Airflow environments. Use CPU, memory, disk, restart, and workflow parsing data to recommend resource sizing and configuration changes based on observed bottlenecks and environment health.

• Review environment sizing and scaling settings
• Investigate frequent component restarts
• Find bottlenecks in workflow file parsing

Builds an Apigee proxy that inspects an agent’s model requests and responses through Google Cloud Agent Gateway. It measures token usage by model, identifies callers, and can add prompt screening or a cache for similar prompts.

• Measure token usage by model
• Identify callers behind model requests
• Add Model Armor prompt screening

Match Google Cloud data residency and access requirements to available data boundary frameworks and cloud controls. Compare ranked recommendations in a table, see requirement gaps, and receive deployment guidance with built-in frameworks prioritized.

• Finding frameworks for data residency requirements
• Comparing framework coverage and major requirement gaps
• Planning deployment for existing or new projects

Design and create custom cloud controls and frameworks for Google Cloud data boundary requirements that existing resources cannot meet. Receive prepared configuration fields for manual setup, or approve creation through the agent.

• Designing controls for requirements existing frameworks cannot meet
• Preparing configuration fields for the Google Cloud console
• Creating a framework that groups newly authored controls

Diagnose GKE TPU slice creation failures caused by shared nodes. Check slice status, partition labels, and monitoring data to identify conflicting resource groups, then provide resolution steps for the user to apply.

• Investigating node overlap behind SliceCreationFailed
• Finding slices that share nodes across partition shapes
• Checking whether resource conflicts existed at incident time

Diagnose GKE TPU node pool creation or expansion failures despite reserved capacity. Trace which virtual machines and unhealthy node pools occupy reservation slots, check automatic repair settings, and provide remediation steps for the user to apply.

• Investigate TPU capacity errors despite a reservation
• Identify node pools occupying reserved TPU capacity
• Check automatic repair settings on unhealthy TPU nodes

Configure authentication and per-project request limits for Google Cloud API Gateway. Secure access to Cloud Run backends, validate quota changes against existing configurations, and investigate HTTP 429 or Service Control Quota errors, including on MCP-enabled gateways.

• Configure API key and JWT authentication
• Restrict direct access to Cloud Run backends
• Validate request quota changes before deployment

Diagnose GKE TPU virtual machines that remain in repair by checking instance status, host events, and automatic repair history. Understand the impact on grouped TPU nodes and identify recovery steps for the user to apply.

• Investigating TPU VMs that remain in REPAIRING
• Assessing how a failed node affects a TPU slice
• Checking automatic repair history and failure reasons

Diagnose GKE TPU slice creation failures and pending JobSets caused by unstable managed instance groups, the underlying VM groups. Read-only checks examine logs, instance status, upgrades, and repairs to identify causes and suggest user-applied fixes.

• Investigating TPU SliceCreationFailed errors
• Checking whether pending JobSets relate to MIG instability
• Tracing stalled node pool upgrades or repairs

Expose REST APIs as tools for AI agents through Google Cloud API Gateway using MCP, a protocol for connecting agents to tools. Covers OpenAPI migration, authentication, client connections, validation, and troubleshooting.

• Expose existing REST APIs as agent tools
• Migrate OpenAPI 2.0 specifications for MCP
• Protect tool listings with JWTs or API keys

Creates Terraform configuration for Google Cloud Monitoring notification channels, including email, Slack, and Pub/Sub, and attaches channels to existing alert policies. It also checks Pub/Sub topic compatibility and publishing permissions when inspecting the cloud environment.

• Configuring email or Slack alert notifications
• Adding notification channels to existing alert policies
• Checking Pub/Sub topic compatibility and publishing permissions

Assess existing Google Cloud folders and projects through read-only discovery. Compare resource locations, service usage, and customer-managed encryption requirements with Assured Workloads frameworks, then report suitable options and policy readiness findings.

• Assess an existing folder or project's policy readiness
• Compare EU or US data boundary frameworks
• Review location, service, and encryption readiness

Guides migration of existing codebases to Rust without unsafe code, covering architecture, implementation, testing, and output comparisons. It measures performance before and after optimization and produces an interactive HTML report documenting results and unresolved differences.

• Migrating a GitHub or local codebase to Rust
• Comparing original and migrated program outputs
• Measuring and optimizing a Rust port

Implement Google sign-in for web applications using Google Identity Services. Add sign-in buttons or One Tap, verify ID tokens as proof of identity, configure browser security policies, and handle sessions, sign-out, and account disconnection.

• Adding Google sign-in to a React or Next.js application
• Verifying ID tokens and restricting Workspace domains
• Configuring One Tap and preventing automatic sign-in after logout

Helps address Google Cloud Security Command Center findings by planning targeted fixes for permissions, misconfigurations, vulnerabilities, and combined attack paths. It includes impact checks, verification, rollback steps, and execution after user approval.

• Fix excessive permissions flagged by Security Command Center
• Plan fixes for exposed buckets or firewall rules
• Address attack paths involving multiple security issues

Investigate slow TPU training on GKE by comparing diagnostic events with one-minute monitoring metrics. Separate memory or CPU bottlenecks from hardware and network issues, and identify the appropriate next steps.

• Investigating slower TPU training without pod crashes
• Checking PERFORMANCE_DEGRADATION events
• Separating resource bottlenecks from infrastructure issues

Investigate stalled TPU training across multiple slices on GKE using hang reports, logs, and latency metrics. Separate compilation inconsistencies and data input stalls from hardware or network faults, and identify the relevant nodes for further investigation.

• Investigating HANG_DETECTED logs during TPU training
• Separating input stalls from hardware faults
• Mapping reported faulty instances to GKE nodes

Investigate slow or failing requests in Google Cloud using Cloud Trace. Filter traces by duration or error status, inspect spans representing individual operations, and retrieve related Cloud Logging entries to investigate bottlenecks and exceptions.

• Find requests exceeding a latency threshold
• Inspect operation hierarchies within a trace
• Investigate failures using related application logs

Diagnose unresponsive GKE GPU or TPU nodes and pods stuck terminating through read-only checks of node status, logs, serial output, and repair history. Receive documented recovery guidance to apply yourself.

• Investigate nodes stuck in NodeStatusUnknown
• Find kernel panic or hardware failure evidence
• Check node auto-repair settings and failures

Implement and debug Google OAuth 2.0 refresh tokens bound to a client key. Covers key generation, signed DPoP proofs that demonstrate key possession, and nonce challenge retries in WebCrypto and JavaScript environments.

• Bind Google OAuth refresh tokens to a client key
• Debug DPoP proof signatures and nonce retries
• Plan a backend for a browser application using DPoP

Check Google Cloud IAM allow policy changes against the last 90 days of access logs. The skill identifies access that could be lost and applies changes only after a successful simulation and user approval.

• Checking access impact before removing a role
• Reviewing allow policy changes across resource scopes
• Applying policy changes after simulation and approval

Guides authentication and access permissions for Google Cloud users and applications. It helps choose credentials for local development, production services, or external clouds, with guidance on short-lived credentials and avoiding downloaded service account keys.

• Set up credentials for local Python development
• Configure Cloud Run access to Cloud SQL
• Connect workloads on AWS or Azure to Google Cloud

Diagnoses applications that fail to start or repeatedly crash on GKE, Google's managed Kubernetes service. It examines logs, events, memory use, image pulls, and connectivity, then proposes configuration patches or commands without applying live changes.

• Investigate repeated container restarts
• Diagnose memory exhaustion
• Find causes of image pull or scheduling failures

Design and deploy a Google Cloud global external Application Load Balancer with caching and web attack protection. Matches settings to workload types, discovers existing backends, and generates Terraform or gcloud deployment scripts.

• Design global web delivery across multiple backends
• Choose caching settings for static content and APIs
• Configure Cloud Armor protection for each workload