snowflake-pack

Audit Snowflake effective access and produce a safe least-privilege change packet. Trace account-role inheritance, primary and secondary roles, managed-access schemas, ownership, direct-to-user/PUBLIC grants, orphaned principals, and existing-versus-future-grant conflicts. Use when access is unexpectedly broad or denied, a role graph needs review, or an authorization cleanup needs evidence. Trigger with phrases like "Snowflake access audit", "trace Snowflake grants", "why can this user read", "Snowflake RBAC drift", or "future grants conflict".

Audit and analyze Snowflake warehouse, serverless, Adaptive, storage, transfer, and AI cost evidence with a typed ledger that prevents double counting and exposes freshness, attribution, control, and invoice boundaries. Use when a Snowflake bill increased, a team needs chargeback/showback evidence, credits appear unexplained, or an operator asks which usage merits investigation. Trigger with "Snowflake bill increased", "find idle Snowflake credits", "Snowflake cost attribution", or "untagged Snowflake spend". Do not use to mutate cost controls or claim savings.

Assess trusted Snowflake data metric function coverage and expectation evidence without reading customer rows. Use when evaluations, definitions, schedules, notifications, anomaly state, or monitoring coverage may be incomplete or unhealthy. Trigger with "Snowflake data quality", "DMF expectation", "definition drift", "missing evaluation", or "notification gap".

Review and safely diagnose Snowflake infrastructure and database deployments across the snowflakedb/snowflake Terraform 2.x provider, grants/state/imports, schemachange versioned and repeatable migrations, Snowflake CLI/drivers, and behavior-change releases. Use before a production deploy, when a plan wants to replace or revoke grants, state is unreadable, a migration checksum drifts, or a CLI/driver upgrade changes behavior. Produces a zero-change/plan verdict, ordered remediation, and tested rollback requirements. It never applies, destroys, deploys, runs mutating SQL, or edits state/history automatically. Trigger with "Snowflake Terraform plan", "grant import", "terraform state", "schemachange checksum", "repeatable migration", "Snowflake CLI upgrade", "driver BCR", or "rollback Snowflake deploy". Use when a production change needs a current plan, migration-integrity, toolchain, or rollback gate.

Analyze Snowflake failover-group RPO/RTO readiness from independently trusted, privacy-preserving live receipts without executing refresh, failover, failback, redirect, cancellation, resume, or session changes. Use when an owner needs a Business Critical disaster-recovery preflight, replication failure diagnosis, dangling-reference check, or operator-executed drill proof. Trigger with "Snowflake failover drill", "replication RPO", "failback proof", or "secondary refresh".

Audit trusted Snowflake classification, tags, masking, row access, projection, join, aggregation, and privacy-policy evidence without reading customer data. Use when governance enforcement may be missing or ambiguous. Trigger with "Snowflake governance coverage", "policy precedence", "tag policy gaps", "classification failure", or "POLICY_CONTEXT verification".

Preflight Snowflake Native App package releases from trusted, privacy-safe provider evidence without publishing, upgrading, altering, granting, or approving anything. Use when reviewing manifest/setup safety, security-scan gates, version and release-directive validation, App Spec or privilege changes, upgrade-cohort compatibility, and rollback readiness. Trigger with "Native App release", "application package scan", "upgrade cohort", or "App Spec".

Analyze Snowflake pipelines spanning tasks, streams, dynamic tables, and Snowpipe from bounded read-only evidence. Use when a pipeline is stale, skipped, suspended, lagging, duplicating rows, or missing notifications; trigger with "stream stale", "task suspended", "dynamic table lag", or "Snowpipe not loading". The skill returns evidence gaps, bounded hypotheses, and an ordered recovery plan; it never mutates Snowflake.

Audit, analyze, and diagnose completed or failed Snowflake queries from query history, Query Insights, and GET_QUERY_OPERATOR_STATS evidence. Use when investigating slow queries, queueing, lock waits, local or remote spill, poor pruning, exploding joins, repeated query-hash regressions, or requests for a defensible query root-cause packet. Trigger with "Snowflake query spilled", "why is this Snowflake query queued", "Snowflake query ID", "exploding join", or "Snowflake pruning regression". Do not use for generic SQL tutoring, automatic query rewrites, warehouse resizing, cancellation, or clustering changes.

Pilot a Snowflake authentication modernization without lockouts or credential exposure. Inventory PERSON, SERVICE, and LEGACY_SERVICE users; map named workloads to WIF, key pair, OAuth, or bounded PAT; and audit managed MCP/OAuth session controls. Use when replacing Snowflake passwords, reviewing service identities, planning workload identity federation, or scoping MCP OAuth. Trigger with phrases like "Snowflake auth migration", "service user password", "Snowflake WIF", "key pair rotation", or "MCP OAuth role scope".