Cloud & Platform Engineering Skills¶
43 production-grade skills for Cloud, Platform, SRE, Security and FinOps engineering — portable across Claude Code, Antigravity/Gemini CLI, Codex, Cursor and GitHub Copilot.
Each skill states its own activation triggers and, critically, when to route elsewhere. Load one skill, never the library.
DevOps Core¶
| Skill | Level | Load when |
|---|---|---|
| backup-and-disaster-recovery | senior | Use when designing a DR strategy, setting RPO/RTO targets, automating backups, or running a restore or failover exercise." |
| cicd-pipeline-design | mid | Use when a pipeline is slow because every job reinstalls dependencies, when long-lived AWS or cloud access keys stored as CI secrets must be removed, or when building, gating and speeding up a build-test-deploy workflow." |
| configuration-management-ansible | mid | Use when applying a hardening or CIS baseline repeatably across many Ubuntu or RHEL hosts, refactoring a monolithic playbook into roles, or fixing a playbook that reports 'changed' on every run." |
| database-devops-lifecycle | senior | Use when adding, renaming or dropping a column on a large Postgres or MySQL table without downtime, running migrations from a deploy pipeline, or diagnosing read replicas lagging behind the primary and serving stale data." |
| devops-metrics-dora-kpis | senior | Use when measuring delivery performance, building an engineering-metrics dashboard, or diagnosing why throughput or stability is poor." |
| docker-containerization-basics | junior | Use when writing or reviewing a Dockerfile, shrinking image size, fixing slow builds, or hardening containers before they reach a registry." |
| enterprise-iac-governance-terragrunt | staff | Use when Terraform has been copy-pasted across many accounts or environments, or when non-compliant resources such as unencrypted or untagged S3 buckets must be blocked in CI before apply rather than found afterwards." |
| git-branching-merge-strategies | junior | Use when choosing a branching model, defining merge/rebase rules for a team, resolving conflicts, or recovering from a bad commit, push, or revert. |
| gitops-multi-cluster-argo-flux | senior | Use when managing many clusters or environments declaratively, deciding how to structure repositories, branches and overlays to promote a release from staging to production, or debugging an Application stuck OutOfSync." |
| helm-kubernetes-deployment | mid | Use when authoring or reviewing a Helm chart, templating Kubernetes manifests, or debugging a failed or stuck Helm release." |
| linux-sysadmin-troubleshooting | junior | Use when a server or VM is degraded, crawling, or unresponsive and needs live hands-on diagnosis, when writes fail with 'No space left on device' despite free space, or when a stuck process must be traced." |
| performance-load-testing | mid | Use when writing a k6 or Locust script, deciding whether an API can handle a peak traffic event, capacity planning before launch, or investigating why average latency looks fine while users report slowness." |
| scripting-and-automation | mid | Use when writing, reviewing, or hardening an operational script, cron job, or internal CLI tool." |
| terraform-iac-modules | mid | Use when structuring or restructuring a Terraform repository across dev, staging and production environments, writing reusable modules, configuring a state backend, or investigating unexplained infrastructure drift. |
| zero-downtime-release-strategies | senior | Use when releasing to a small percentage of traffic first while watching error rate and latency, when a bad deploy must roll back automatically without a human, or when choosing between canary, blue-green and rolling deployment." |
DevSecOps & SecOps¶
| Skill | Level | Load when |
|---|---|---|
| ai-agent-security-llm-threats | senior | Use when an agent is given tools or credentials, when retrieved documents or repository files could carry injected instructions, or when reviewing an AI feature before it reaches production." |
| cloud-security-posture-cspm-cis | senior | Use when auditing an account or organization's security posture, finding unused and over-permissive permissions across hundreds of roles, preparing for a CIS or compliance review, or triaging misconfiguration findings." |
| container-runtime-security-falco | senior | Use when alerting on attacker behaviour inside a running container such as an interactive shell being opened in production, writing or tuning a noisy Falco rule, or triaging a runtime alert." |
| detection-engineering-threat-hunting | senior | Use when security alerts are too noisy to act on, when deciding which detections to write and which telemetry to collect first, or when hunting for attacker activity nothing has alerted on." |
| policy-as-code-opa-kyverno | senior | Use when privileged containers or pods without resource limits must be rejected at admission rather than reported, when admission policies need tests so a rule cannot silently stop matching, or when choosing between Kyverno and OPA Gatekeeper." |
| secops-incident-triage-forensics | staff | Use when a host, container or cloud credential is suspected compromised, when a leaked access key found in a public repository has already been used, or when capturing evidence." |
| secrets-management-vault-kms | senior | Use when a database password or API key sits in a plain Kubernetes Secret or a manifest checked into Git, or when workloads need credential material injected at runtime without storing it." |
| shift-left-security-sast-sca | mid | Use when adding code, dependency or image scanning to a CI pipeline, when a scanner reports hundreds of findings that developers now ignore and gates need tuning for false positives, or when a customer or auditor asks for an SBOM produced by the build." |
| supply-chain-security-slsa-sigstore | senior | Use when release artifacts or container images need signing, provenance or attestation, when a customer or auditor asks which SLSA level a build meets, or when only trusted and verified images should be allowed to run in a cluster." |
SRE & Observability¶
| Skill | Level | Load when |
|---|---|---|
| chaos-engineering-resilience-testing | senior | Use when a failover or redundancy claim has never actually been tested, when planning a GameDay or resilience exercise, or when deciding whether it is safe to inject failure into production and how to bound it." |
| incident-management-and-postmortem | staff | Use when running or improving incident response, declaring severity, coordinating an active outage, or writing a post-mortem." |
| infrastructure-host-monitoring | mid | Use when standing up monitoring or dashboards across a fleet of nodes, authoring or tuning infrastructure alert rules, or arranging to be paged before a filesystem fills rather than after it is already full." |
| prometheus-grafana-otel-tracing | senior | Use when instrumenting services so a latency spike can be followed to the exact trace and log line, building the metrics-logs-traces stack, or fixing missing telemetry and cardinality blowups." |
| sli-slo-error-budget-design | senior | Use when defining reliability targets or an SLO target for a user-facing API or service, replacing noisy threshold alerts with burn-rate alerts, or governing releases against a spent budget." |
AWS¶
| Skill | Level | Load when |
|---|---|---|
| aws-cloud-migration-strategies | senior | Use when planning a datacenter exit or lease expiry, deciding whether a legacy monolith should be rehosted or refactored, or moving a large Oracle, SQL Server or Postgres database with minimal downtime." |
| aws-eks-enterprise-patterns | senior | Use when designing, scaling, hardening, or upgrading an EKS cluster, or fixing pod IP exhaustion and node-scaling problems." |
| aws-iam-zero-trust-policies | senior | Use when writing or reviewing an SCP or IAM policy, scoping down a role that has AdministratorAccess, or designing multi-account guardrails and federated access." |
| scalability-high-availability-patterns | senior | Use when a service must survive an availability zone failure, when it collapses under traffic spikes and drags downstream services with it, or when CPU is the wrong autoscaling signal." |
Azure¶
| Skill | Level | Load when |
|---|---|---|
| azure-aks-enterprise-landing-zones | senior | Use when building or hardening AKS to an enterprise baseline, when AKS pods must authenticate to Key Vault or other Azure services without any stored secret, or when enforcing Kubernetes governance on Azure." |
| azure-cloud-engineering-patterns | senior | Use when designing an Azure landing zone or network topology, making Storage, SQL or other PaaS unreachable from the internet, or enforcing tagging and allowed regions across every subscription." |
GCP¶
| Skill | Level | Load when |
|---|---|---|
| gcp-cloud-engineering-patterns | senior | Use when designing a Google Cloud resource hierarchy or network, letting GitHub Actions or another external CI deploy to GCP without a service account key, or building a data perimeter." |
| gcp-gke-autopilot-multi-tenant | senior | Use when designing a multi-tenant GKE platform, isolating tenant workloads, or choosing between Autopilot and Standard." |
Platform Engineering¶
| Skill | Level | Load when |
|---|---|---|
| api-gateway-service-mesh | senior | Use when configuring ingress routing, enforcing zero-trust service-to-service traffic, or debugging mesh routing and mTLS failures." |
| cloud-native-microservices-patterns | senior | Use when pods are killed during a deploy and drop in-flight requests, when Kubernetes restarts a container that is merely slow to start, or when refactoring a service to run correctly on Kubernetes." |
| internal-developer-portal-backstage | staff | Use when building self-service so developers can create a new production-ready service in one click, defining golden paths, onboarding services into a catalog, or measuring platform adoption." |
| serverless-event-driven-architecture | senior | Use when designing event-driven flows, choosing FIFO versus standard for per-customer ordering at high throughput, or when events are lost, duplicated or throttled." |
FinOps¶
| Skill | Level | Load when |
|---|---|---|
| finops-framework-inform-optimize-operate | senior | Use when a cloud bill has jumped unexpectedly and the driver is unknown, when deciding whether to buy commitments, or when charging shared spend back to teams." |
Productivity¶
| Skill | Level | Load when |
|---|---|---|
| write-a-skill | staff | Use when creating, refactoring, auditing, or reviewing an AI agent skill in this repository or any skills library." |
Quality gates¶
Every skill passes four gates before merge — structure and mirror sync, offline routing and content-coverage evals, the 8-point compliance inspection, and generated-target freshness. See CONTRIBUTING.md.