anmolnagpal
UserMulti-tool DevOps skills for Claude Code, Cursor, and Codex — Terraform, Kubernetes, Docker, GitHub Actions, GitLab CI, AWS FinOps, OWASP security.
Categories
Indexed Skills (19)
ci
GitLab CI/CD pipeline review and scaffolding for Terraform and Helm/EKS deployments, including individual stages, jobs, manual gates on prod stages, and pipeline credentials. Use when user says 'review my pipeline', 'check my gitlab-ci', 'scaffold a pipeline', 'is my CI correct', 'is my pipeline gated before prod', 'add a stage', 'add a deploy job', 'add a helm deploy stage', 'my pipeline leaks credentials', 'why does staging deploy with prod credentials', 'staging and prod share a job', or when working in .gitlab-ci.yml files. Anything expressed as a pipeline, stage, or job belongs here.
docker
Docker operations, Dockerfile best practices, Compose, image optimization, and registry workflows. Use when user says 'review my Dockerfile', 'optimize my image', 'reduce image size', 'container won't start', 'set up compose', 'multi-stage build', or when working in Dockerfile, docker-compose*.yml, or .dockerignore files.
github-actions
GitHub Actions workflow review, scaffolding, and security hardening. Use when user says 'review my workflow', 'check my actions', 'scaffold a workflow', 'is my CI correct', 'pin actions', 'OIDC to AWS', or when working in .github/workflows/*.yml files.
github
GitHub repository operations: PRs, issues, releases, branch protection, CODEOWNERS, Dependabot, and repo settings audits. Use when user says 'review my PR', 'create a release', 'cut a release', 'tag a release', 'set up branch protection', 'add CODEOWNERS', 'audit repo settings', 'is Dependabot configured', or asks about GitHub repo configuration. Repo settings and metadata, not workflow files; /clouddrove:github-actions owns .github/workflows.
k8s
Kubernetes and Helm review and scaffolding for EKS workloads. Use when user says 'review my helm values', 'before I deploy', 'scaffold a new service', 'check values.yaml', or when working in values.yaml, Chart.yaml, or Helm template files.
tf
Generic Terraform review, scaffolding, and version upgrades for AWS infrastructure using the terraform-aws-modules ecosystem. Use when user says 'review my terraform', 'before I raise an MR', 'scaffold a lambda/rds/s3/eks/vpc', 'check my .tf files', 'upgrade provider', or when working in .tf or .tfvars files. NOTE: if the repo has an `_modules/` directory wrapping `clouddrove/*/aws` modules, use /clouddrove:wrapper-tf instead — the two patterns conflict.
wrapper-tf
Team standard for AWS Terraform repos built on the CloudDrove wrapper-module pattern. Use when working in a repo with an `_modules/` directory that wraps `clouddrove/*/aws` modules, scaffolding a new wrapper module, generating Terraform GitHub Actions CI, reviewing wrapper-pattern PRs, or mapping the pattern to SOC2/GDPR controls. Supersedes /tf on CloudDrove repos.
appsec
Application-level security review: dependency manifests for known-vulnerable packages, missing HTTP security headers, permissive CORS configuration. Use when user says 'review my dependencies', 'check for vulnerable packages', 'run a dependency audit', 'audit security headers', 'review CORS config', or when working in package.json/package-lock.json, go.mod/go.sum, requirements.txt/poetry.lock, Gemfile.lock, Cargo.toml/Cargo.lock, pom.xml, or server/app config with CORS or header middleware.
deploy
Deployment strategy, production-readiness gating, and rollback planning for AWS/EKS services. Use when user says 'how should I deploy this', 'blue-green or canary', 'are we ready to ship', 'production readiness', 'plan a rollback', 'pre-deploy check', or before a first production release. Pairs with /k8s, /ci, /github-actions, /tf which own the per-artifact checks.
owasp
Security review requiring judgment about exploitability: injection and input handling, authentication and session management, authorization, secret storage and cryptography, and Agentic AI risks, against OWASP Top 10:2025 and ASVS 5.0. Use when user says 'review for security', 'is this secure', 'review this endpoint for injection', 'check for SQL injection or XSS', 'review auth/authorization', 'how are we storing secrets', 'check how we store secrets in this service', 'is this crypto correct', or when writing cryptography, session management, or AI agent code. Judges reachability and impact in this codebase; /clouddrove:appsec owns the deterministic checks a tool can answer (lockfile CVEs, missing headers, wildcard CORS).
gitops
Argo CD and Flux review and scaffolding: mutable source refs, AppProject wildcard grants, unguarded auto-prune, sync waves and dependency ordering, selfHeal drift enforcement, and per-environment separation. Use when user says 'review my argocd', 'review my Application', 'check my flux config', 'set up gitops', 'why did argo delete my resources', 'app of apps', 'review my Kustomization', or when working in argocd/, flux-system/, AppProject, ApplicationSet, or Flux GitRepository/Kustomization/HelmRelease manifests.
incident
Runbooks, on-call readiness, incident response, and blameless postmortems: write a runbook for a service, audit whether a service can be operated at 03:00 before a rotation starts, find alerts that have no runbook, run a severity and escalation model, and turn an incident timeline into a postmortem. Use when user says 'write a runbook', 'review my runbooks', 'are we ready for on-call', 'are we ready to put this service on-call', 'which alerts are missing runbooks', 'set up incident response', 'define severity levels', 'write a postmortem', 'incident retro', or when working in docs/runbooks/ or docs/incidents/. Owns the response side; /clouddrove:observability owns whether a signal exists and reaches anyone, this owns whether the human it wakes knows what to do.
observability
Observability review and scaffolding: centralized logging, log retention, metrics scraping, alert rules that page a human, distributed tracing, dashboards, and SLO/SLI definition. Use when user says 'review my monitoring', 'do we have enough observability', 'am I flying blind', 'set up alerts', 'write alert rules', 'define an SLO', 'review my prometheus config', 'check log retention', or when working in prometheus/alertmanager/otel-collector config, ServiceMonitor manifests, or CloudWatch log-group and alarm Terraform.
tf-plan
Review a Terraform plan before applying it: destroys and replacements of data-bearing resources, secrets readable in plan output, out-of-band drift, blast radius, and whether the apply is bound to the plan you actually reviewed. Use when user says 'review my plan', 'is this plan safe to apply', 'check tfplan', 'what will this destroy', 'why is it replacing', 'review before apply', or shares terraform plan output. Complements /clouddrove:tf and /clouddrove:wrapper-tf, which review .tf source; this reviews the diff Terraform intends to make.
logging
Review whether security-relevant logging is enabled, complete, shipped off-host, and tamper-resistant across Kubernetes and the cloud control plane. Use when user says 'review my audit logging', 'is audit logging on', 'check my k8s audit policy', 'are we logging API-server access', 'review GKE/AKS logging', 'do we capture admin activity', or when working in audit-policy.yaml, kube-apiserver manifests, or GKE/AKS Terraform. Covers generic Kubernetes audit policy, GKE Cloud Logging + audit config, AKS diagnostic settings, and cross-cloud audit-log immutability. For AWS CloudTrail/flow-log/EKS-audit/S3-access IaC use /clouddrove:tf (SEC-LOG-*); for log retention/centralization, metrics, and SLOs use /clouddrove:observability (OBS-LOG-*).
adr
Capture architectural decisions that have already been made, as structured ADRs (Architecture Decision Records). Use when user says 'record this decision', 'ADR this', 'why did we choose X', 'document this trade-off', 'we decided to...', or when a choice between alternatives has been settled and needs writing down. This records a decision; it does not make one. A question of the form 'should we use X or Y' is a design discussion, not an ADR request.
finops
AWS cost optimization — waste detection, right-sizing, Savings Plans, RIs, EKS cost, multi-account governance. Use when user says 'reduce AWS bill', 'find waste', 'right-size this', 'should I buy SP or RI', 'gp2 vs gp3', 'EKS is expensive', 'NAT gateway cost', or asks about AWS cost optimization.
skill-name-here
What this reviews or produces, then when to reach for it. Use when user says '<a phrase they would actually type>', '<another one>', or when working in <the files this applies to>. This is the only text the model reads when deciding whether to load the skill, so write triggers, not a summary.
skill-creator
Create, edit, evaluate, and debug the skills in this repo, including running their evals and fixing a description that fails to trigger. Use when user says 'help me build a new skill', 'add a skill for X', 'run the evals for the tf skill', 'run the behavioral evals', 'my skill is not triggering', 'fix this skill's description', 'improve this skill's rule catalog', 'add a rule ID', or 'benchmark a skill'. Operates on the skills themselves rather than on infrastructure: a request to review actual Terraform or Kubernetes belongs to that domain skill.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.