Snowflake Pack

> Ten model-neutral, evidence-driven operator skills for Snowflake cost, > performance, pipelines, deployments, authentication, access governance, data > quality, and failover readiness.

Start in 30 seconds

Install the pack:

/plugin install snowflake-pack@claude-code-plugins-plus

That is the Claude Code install projection. The skill instructions and Python analyzers do not call a model-specific API: Agent Skills-compatible harnesses can load the skill directories directly, and any automation can invoke the bundled analyzers from Python 3.10+ without an adapter.

For a harness-neutral entry point, list the production workflows and inspect the arguments for the one you need:

python3 shared/snowflake_operator.py list
python3 shared/snowflake_operator.py query-id-forensics --help

Then analyze a redacted evidence receipt without granting Snowflake credentials or network access to the dispatcher:

python3 shared/snowflake_operator.py access-review \
  --input ./access-evidence.json \
  --output ./access-report.json

The dispatcher is a thin transport layer: it calls the skill's canonical Python analyzer, preserves its output and exit status, and contains no Snowflake decision logic. Evidence collection remains a separate, explicitly configured step.

Then describe the problem in plain language:

• “Why did our Snowflake bill jump?”
• “Find the root cause of query 01b....”
• “Why did this dynamic table stop refreshing?”
• “Is this Terraform upgrade safe?”
• “Move our service users off passwords.”
• “Why can this role read that table?”
• “Are our data-quality expectations actually covering the critical tables?”
• “Which sensitive assets are not effectively protected by governance policies?”
• “Can this failover group meet our RPO and RTO?”
• “Is this Native App candidate safe to promote for explicit approval?”

The matching skill asks for the smallest useful evidence set, analyzes it without changing the account, and produces a reviewable report or change packet.

The ten skills

Collect live evidence without an adapter

Every workflow can analyze a supplied redacted JSON receipt. For an existing least-privilege Snowflake CLI connection, the shared collector can also produce a normalized, source-stamped receipt for any supported surface:

python3 shared/evidence/collect_snowflake_evidence.py \
  --surface query \
  --connection readonly-observer \
  --source-max-age-seconds 2700 \
  --output ./snowflake-query-evidence.json

Supported surfaces are cost, query, pipeline, access, auth, data-quality, replication, selector-bound governance-, and selector-bound native-app- current evidence. The collector statically rejects mutating SQL, does not accept credentials, records view/timestamp/hash provenance, and treats permission gaps as missing evidence rather than permission to escalate. If a receipt sets truncation_possible: true, narrow or partition the requested window before making any completeness, absence, or pass claim. For the query surface, choose the incident freshness bound before collection; receipt schema 2 records the dataset maximum, declared bound, and collection time for the query-forensics schema 2.0 analyzer. The analyzer derives freshness from the anchor query row only; a newer unrelated history row cannot make an old anchor fresh. It also binds metadata.history_source and metadata.role to the receipted source and anchor role_name. Full confirmed claims require a surface-compatible terminal status and at least one bound operator row; running queries and missing operator evidence remain partial even when their optional arrays are empty. Every JSON/Markdown string passes a final recursive credential/raw-SQL redaction boundary.

The receipt's embedded SHA-256 is an internal consistency checksum, not proof of who collected it or where it came from. Query-forensics therefore withholds confirmed, freshness, completeness, operator, comparison, and ROI claims unless the fully normalized schema 2.0 bundle matches a digest recorded separately at a trusted local boundary. At that boundary, after mapping the reviewed collector rows into the normalized bundle, record its canonical digest: