Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/arjunprabhulal/devops-skills/cloud-networkingnpx skills add arjunprabhulal/devops-skills --skill cloud-networkinggit clone --depth 1 https://github.com/arjunprabhulal/devops-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arjunprabhulal/devops-skills/cloud-networking)<a href="https://agentmods.dev/skills/arjunprabhulal/devops-skills/cloud-networking"><img src="https://agentmods.dev/badge/skills/arjunprabhulal/devops-skills/cloud-networking.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00114 | $0.01059 |
| Opus 5 | $0.00057 | $0.00530 |
| Sonnet 5 | $0.00023 | $0.00212 |
| Haiku 4.5 | $0.00011 | $0.00106 |
Grade A, and why
cloud-networking scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud Networking
A cloud network is software pretending to be wires, and that means every routing decision is explicit and reviewable in a way a physical network never was. The cost of that explicitness is that nothing connects by default — every path between two resources exists because someone configured it, which is a feature once you stop fighting it.
Treat the network layout as a security boundary first and a connectivity convenience second. Every path that traffic can take should be one someone deliberately allowed, not one that happened to work.
1. Plan CIDR ranges before you provision anything
Subnet ranges are painful to change after resources are placed in them, and overlapping ranges are what block a future VPC peering or transit connection. Pick address space with room for growth and with an eye toward every network you might ever need to connect to — including a data center's existing ranges and other cloud accounts' VPCs.
| Decision | Get it wrong and… |
|---|---|
| CIDR too small | you run out of IPs and must re-subnet under pressure |
| CIDR overlaps peer network | peering or transit connection becomes impossible without renumbering |
| No reserved space for future subnets | new tiers (data, private endpoints) have nowhere to go |
Done when: the CIDR plan has documented headroom and has been checked against every network it may ever need to peer or connect with.
2. Separate public and private subnets by function, not convenience
Anything that doesn't need a public IP shouldn't have a route to the internet gateway. Public subnets hold load balancers and bastion/NAT infrastructure; private subnets hold everything else, reaching the internet only through a NAT gateway if they need outbound access at all. This is the single biggest reduction in attack surface available at the network layer, and it costs nothing but discipline in the route table.
Done when: no compute or data resource holding sensitive data has a route to an internet gateway.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 90 lines · 114 tokens per session scan A 8088e8d7f5ca
cloud-networking is a skill published in the GitHub repository arjunprabhulal/devops-skills (2 stars, last pushed 10d ago), licensed MIT. It adds 114 tokens to every session and 1,059 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-platform-deploy
Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a…
agent-platform-tuning
Agent Platform Model Tuning. Use when you need to fine-tune open models or Gemini models using Agent Platform infrastructure. Don't use for model training outside Agent Platform, model deployment to endpoints (use agent-platform-deploy), or managing serving endpoints (use agent-platform-endpoint-management).
application-design-center-design-deploy
Processes GCP infrastructure design and deployment workflows within Application Design Center (ADC). Use when: - Designing GCP infrastructure with Terraform. - Validating local HCL. - Performing best-practice plan scans. - Importing templates to Application Design Center (ADC). - Deploying templates. - Troubleshooting…
cloud-logging-cross-project-configuration
Configure and troubleshoot Google Cloud cross-project centralized logging and read-time aggregation. Use when: - Setting up log routing from multiple projects/folders/organizations to a central log bucket. - Creating cross-project log sinks and configuring central log buckets. - Troubleshooting cross-project routing.…
cloud-run-basics
Manages Cloud Run services, jobs, and worker pools. Use when you need to deploy applications responding to HTTP requests (services), run event-triggered or scheduled tasks (jobs), or handle always-on pull-based background processing (worker pools).
gcloud
Provides safety-critical validation, guardrails, and data reduction for gcloud CLI operations across Google Cloud Platform (GCP) services and infrastructure. Use when planning, generating, constructing, proposing, describing, or executing any gcloud CLI commands - including when answering questions about gcloud…