Skill catalog

Every skill is a SKILL.md bundle. The Platform Agent’s live in agents/platform/skills/; the Cluster Agent’s live in agents/cluster/skills/ and are scaffolded into each per-cluster profile. An agent loads them on demand based on the description: field in each skill’s frontmatter — clicking through to source below gives you the full procedure the agent follows.

For how skills are structured and invoked, see Concepts → Skills.

The catalogue

Generated from the name and description frontmatter of every agents/platform/skills/*/SKILL.md and agents/cluster/skills/*/SKILL.md.

Cluster lifecycle

Skill	Description
cluster-agent-lifecycle	Create, delegate to, and tear down per-cluster Cluster Agent Hermes profiles. Use whenever a GKE cluster is onboarded or deleted, or whenever a single-cluster runtime debugging/operations task should be delegated to that cluster’s Cluster Agent.
gke-cluster-creation	Plans and executes GKE cluster creation, provisioning, and production readiness audits using pre-defined templates (Autopilot, Standard Regional, GPU/AI Inference, AI Hypercompute). Use when creating GKE clusters, provisioning GKE environments, selecting cluster modes, or auditing GKE clusters. Don’t use for application onboarding or deployment configuration (use gke-app-onboarding instead).
gke-multitenancy	Plans and configures multi-tenancy on GKE. Covers namespace isolation, RBAC planning for teams, resource quotas, LimitRanges, network isolation, and cost allocation. Use when designing GKE multi-tenancy, configuring GKE namespaces, setting up resource quotas, or isolating GKE teams. Don’t use for single-tenant cluster configuration or general deployment instructions (use gke-basics or gke-app-onboarding instead).
manage-cluster	Bring an existing GKE cluster under management on user request (e.g. “manage my cluster <name> in <location>”) by creating its Cluster Agent profile. Use whenever a user asks to manage/onboard/watch a specific existing cluster.

Workloads

Skill	Description
gke-app-onboarding	Manages GKE application onboarding, covering containerization, deployment manifests, and migration. Use when onboarding or deploying an application to GKE for the first time, or containerizing an app for GKE. Don’t use for general GKE cluster administration or upgrades (use gke-basics or gke-upgrades instead).
gke-batch-hpc	Runs batch and HPC workloads on GKE, utilizing job queues and parallel processing. Use when running GKE batch jobs, configuring GKE HPC, or setting up GKE job queues. Don’t use for standard web application deployments (use gke-app-onboarding instead).
gke-workload-scaling	Specific workflows for scaling GKE workloads using HPA and VPA, as well as best practices for autoscaling configuration.
gke-workload-security	Workflows for auditing and hardening the security of GKE workloads.
gke-workload-troubleshooting	Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts.
workload-rebalancing	Orchestrate cross-cluster workload rebalancing using the kanban board with the validation-then-declare pattern. Use when fleet utilization shows one cluster overutilized and another with headroom and a workload should move.

Cost and capacity

Skill	Description
gce-compute-fleet-audit	Audits standalone GCE virtual machines, Managed Instance Groups (MIGs), serial console boot failures, and guest OS daemon health.
gke-cluster-autoscaler	Trigger on mention of GKE cluster autoscaler, node autoscaling, node pool auto-creation / node auto-provisioning. Provides guidance on enabling and optimizing cluster autoscaler, best practices, and troubleshooting issues such as nodes not scaling up or down, zonal stockouts, or capacity buffers. Do not use for ComputeClass-specific YAML generation or priority configuration (defer to gke-compute-classes skill).
gke-compute-classes	Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto Provisioning configuration or general GKE cluster creation.
gke-cost-analysis	Answer natural language questions and perform analysis on GKE cluster and workload costs using BigQuery billing exports, cost allocation data, and live cluster monitoring metrics. Use when querying GKE costs across projects, namespaces, or workloads, analyzing billing reports in BigQuery (bq), checking cluster cost budgets (gcloud billing), or diagnosing cost drivers like pod requests vs. actual utilization (kubectl top). Don’t use for applying cost optimization changes, creating rightsizing manifests (VPA/MPA), or selecting ComputeClasses (use gke-cost-optimization instead).
gke-cost-optimization	Optimizes GKE costs, rightsizes workloads, and configures Spot VMs, CUDs, cost allocation, and resource quotas. Use when optimizing GKE cluster or workload costs, configuring GKE cost allocation or quotas, rightsizing CPU/memory requests, or selecting Spot VMs and machine types. Don’t use for general compute class provisioning or GPU Selection (use gke-compute-classes instead).
gke-productionize	Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don’t use for deep-dive single-domain implementation (use specific domain skills like gke-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).

Security and compliance

Skill	Description
gke-backup-dr	Configures GKE Backup Plans and restore workflows. Use for backup policies, disaster recovery, or GKE cluster restores. Don’t use for database backups.
gke-platform-security	Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don’t use for workload-level security (Workload Identity, SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security instead).

Networking and storage

Skill	Description
gcp-networking-fabric-audit	Audits VPC subnet IPAM capacity, Cloud NAT ephemeral port exhaustion, Private Service Connect routing, and Cloud Armor WAF policies.
gke-networking	Plans, configures, and manages core GKE cluster networking. Covers private clusters, VPC-native configurations, DNS, node egress, Dataplane V2, and IP planning. Use when designing GKE networking layouts, configuring private clusters, setting up Dataplane V2, planning GKE IP ranges, or managing VPC- native cluster modes. Don’t use for application ingress, load balancing, or service networking (use gke-service-networking instead).
gke-service-networking	Configures GKE edge networking, traffic routing, load balancing, and private service endpoints. Use when configuring Gateway API manifests, standard Ingress, Cloud Armor WAF security policies, Container-Native Load Balancing (NEGs), Private Service Connect (PSC), or Google-managed SSL certificates on GKE. Don’t use for core cluster IP planning, Dataplane V2 network policies, or node NAT egress (use gke-networking instead).
gke-storage	Guidance on managing storage in Google Kubernetes Engine (GKE) clusters.

AI and inference

Skill	Description
gke-ai-troubleshooting-handle-disruption-gpu-tpu	Diagnoses, predicts, and mitigates node disruptions during Compute Engine host maintenance and hardware or software maintenance events for GPU and TPU workloads on GKE. Use when diagnosing node disruptions, predicting host maintenance events on GPU/TPU nodepools, inspecting node interruption PromQL metrics, auditing node taints, or configuring workload protection strategies (graceful termination, opportunistic maintenance, PodDisruptionBudgets). Don’t use for general GKE cluster creation, network policy configuration, or non-disruption workload deployment.
gke-ai-troubleshooting-jobset-interruption	Diagnoses GKE JobSet interruptions, restarts, and preemptions for AI/ML training workloads autonomously. Use when troubleshooting JobSet restart loops, spot VM preemptions, node readiness failures, host VM issues, or coordinator worker crashes. Don’t use for general GKE cluster creation, basic workload deployment, or non-JobSet application issues.
gke-ai-troubleshooting-tpu-vbar-oom	Diagnoses and prevents vbar_control_agent segfaults, out-of-memory (OOM) errors, and TPU device initialization failures on TPU v6e nodes in GKE caused by race conditions during TPU device resets or high-frequency metrics polling. Use when troubleshooting vbar_control_agent crashes, memory cgroup OOMs in serial console logs, tpu-device-plugin metrics checksum corruption errors, or custom TPU metrics collection conflicts on GKE TPU v6e nodes. Don’t use for general non-TPU container OOM troubleshooting or standard GKE node lifecycle operations.
gke-golden-path	Provides GKE golden path configuration defaults, production readiness checklists, and cluster default patterns. Use when designing GKE clusters, verifying GKE production readiness, or checking configurations against GKE defaults. Don’t use for setting up workload autoscaling specifically (use gke-workload-scaling instead).
gke-inference	Deploys and optimizes AI/ML inference workloads on GKE, using GPUs, TPUs, and model servers. Use when deploying GKE inference servers, configuring GKE GPU resources for inference, or deploying LLMs on GKE. Don’t use for generic batch jobs or HPC task queues (use gke-batch-hpc instead).
gke-tpu-dynamic-slices-monitoring	Monitors, troubleshoots, and manages GKE TPU Dynamic Slices custom resources. Use when checking TPU slice lifecycle states, troubleshooting slice provisioning failures, validating single-slice or multi-slice (JobSet) workload manifests, or safely patching stuck finalizers and disabling the slice controller. Don’t use for generic GKE cluster node pool creation or standard non-TPU workload management (use gke-basics or gke-cluster-creation instead).
gke-tpu-metrics-monitoring	Monitors and troubleshoots GKE TPU workloads, nodes, and node pools using GKE system metrics and PromQL. Use when monitoring TensorCore duty cycle, TPU memory, node readiness, multi-host TPU node pool availability, host maintenance or preemption interruptions, and calculating MTTR or MTBI metrics for GKE TPUs. Don’t use for general non-TPU GKE workload monitoring or non-metric TPU debugging.

Observability

Skill	Description
gke-basics	Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, configuring Workload Identity, or deciding between Autopilot and Standard modes. Don’t use for specialized GKE networking (use gke-networking), advanced security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).
gke-observability	Workflows for setting up and auditing observability (logging, monitoring, tracing) on GKE.
kube-agents-observability	Audit, monitor, and debug the logging, tracing, metrics, and API/dashboard observability of the Platform Agent.

Reliability

Skill	Description
gke-reliability	Workflows for ensuring high availability and reliability of GKE workloads.
gke-upgrades	Plans, executes, and validates Google Kubernetes Engine (GKE) cluster upgrades and maintenance operations for both Standard and Autopilot clusters. Produces upgrade plans, pre/post-upgrade checklists, maintenance runbooks with gcloud commands, release channel strategy, and troubleshooting guides. Handles node pool upgrade strategies (surge, blue-green), version compatibility, PDB management, and workload-specific concerns (stateful, GPU, operators). Use this skill whenever the user mentions GKE upgrades, Kubernetes version bumps, node pool maintenance, GKE patching, cluster version management, release channel selection, maintenance windows, surge upgrades, stuck upgrades, or any GKE lifecycle management task — even casual mentions like “we need to upgrade our clusters” or “plan our next GKE maintenance” or “our upgrade is stuck.” Don’t use for GKE cluster creation, application onboarding, general networking/routing setup, or security policy configurations (use gke-basics or relevant GKE skills instead).

Manifests and remediation

Skill	Description
gke-manifest-generation	Generates and updates secure, production-ready Kubernetes YAML manifests optimized for GKE Autopilot and GKE Standard clusters. Use when creating or modifying GKE deployment manifests, configuring container security contexts, setting CPU/memory resource limits, defining readiness/liveness/startup probes, mounting secrets and volumes, configuring GKE Gateway API routes, targeting Spot VMs, or deploying AI model inference workloads (vLLM, TGI, Gemma). Don’t use for live cluster operations, pod troubleshooting (use gke-workload-troubleshooting), or cluster infrastructure provisioning (use gke-cluster-creation).
submit-suggestion	Propose declarative configuration updates securely by committing file changes and submitting GitHub Pull Requests (PRs) for SRE review. Not for fleet-audit finding fixes — the fleet-audit skill opens and tracks those PRs itself.

Meta

Skill	Description
fleet-audit	Publish the findings of an autonomous fleet audit as one continuously-rewritten GitHub issue per audit stream, and propose fixes as narrow remediation pull requests.
github-issue-resolver	Autonomously poll, triage, investigate, and resolve unaddressed open issues on our target GitHub repository strictly within authorized scope.
pr-conversation	Answer a reviewer who addressed you on one of your own pull requests — read the thread, answer or amend the branch, and reply in the thread.

Cluster Agent (per-cluster runtime)

Skill	Description
gke-observability	Workflows for setting up and auditing observability (logging, monitoring, tracing) on GKE.
gke-reliability	Workflows for ensuring high availability and reliability of GKE workloads.
gke-storage	Guidance on managing storage in Google Kubernetes Engine (GKE) clusters.
gke-workload-scaling	Specific workflows for scaling GKE workloads using HPA and VPA, as well as best practices for autoscaling configuration.
gke-workload-security	Workflows for auditing and hardening the security of GKE workloads.
gke-workload-troubleshooting	Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts.

Adding a new skill

See Concepts → Skills for the process. New skills land under agents/platform/skills/<name>/SKILL.md; if they should also run on schedule, add an entry to agents/platform/cron/jobs.json.