Skills¶
The name and the description come from each skill file. The playbook stays in the repository. Filter this list, or use the search in the header.
Principles¶
principle-change-safety
Apply before any change to Azure or AWS infrastructure, Terraform, or a GitHub Actions or Azure DevOps pipeline. Read the plan, name the blast radius, make one change at a time and promote it through environments.
Open the skillprinciple-cost-awareness
Apply before you ship a change that adds or resizes Azure or AWS resources, or that increases log, NAT, public IP or data-transfer use. Price the monthly cost, set a budget alert and drop spend the design does not need.
Open the skillprinciple-everything-as-code
Apply when Azure, AWS, Terraform or pipeline resources change, including a portal or console edit. Codify the change in the repository and import any drift so the next plan matches what is running.
Open the skillprinciple-idempotent-automation
Apply when writing or rerunning Terraform, scripts, GitHub Actions or Azure DevOps pipelines. A second run with the same inputs must succeed, change nothing further and be safe to start twice.
Open the skillprinciple-least-privilege
Apply when granting IAM, Azure RBAC or pipeline access for Azure, AWS, Terraform, GitHub Actions or Azure DevOps. Give each identity only the actions and scope the job needs, including GITHUB_TOKEN permissions and service connection scope.
Open the skillprinciple-no-static-credentials
Apply before a pipeline or workload authenticates to Azure or AWS, and again if a credential leaks. Use OIDC or workload identity federation and short-lived tokens. Revoke and rotate anything that has leaked.
Open the skillprinciple-observe-before-you-fix
Apply before changing Azure, AWS, Terraform or a pipeline to fix a failure or an alert. Read the actual logs, metrics and error text first, then fix the root cause those records show.
Open the skillprinciple-resource-baseline
Use when you create an Azure or AWS resource. Take the name from the scheme you already use, set the tags that account requires, and deny delete on state and vaults.
Open the skillprinciple-rollback-first
Apply before any production change to Azure, AWS, Terraform, or a GitHub Actions or Azure DevOps pipeline. Write the rollback, rehearse it on a non-production environment and keep it ready before the change starts.
Open the skillprinciple-stop-at-approval
Use when an agent is about to apply, merge, deploy, or grant access for Azure, AWS, Terraform, or a pipeline. Prepare the diff and stop at the human approval that already exists.
Open the skillTerraform¶
terraform-drift
Detect and reconcile Terraform drift on Azure and AWS. Use when a scheduled plan exits with changes you did not ship, or Activity Log or CloudTrail shows a change made outside the code.
Open the skillterraform-module-design
Design Terraform modules for Azure and AWS. Use when you add or change a child module: typed inputs and outputs, a pinned registry or git tag, and no provider block inside the module.
Open the skillterraform-plan-review
Review a Terraform plan before any Azure or AWS apply. Use when a pull request changes infrastructure: read the full plan, flag destroys and grants, name the blast radius, and apply only a saved plan file.
Open the skillterraform-state-backends
Configure remote Terraform state with locking for Azure and AWS. Use when you add a backend, split state by environment, move or import resources, or restore a versioned state blob or object.
Open the skillterraform-static-analysis
Run Terraform fmt, validate, tflint, Checkov and Trivy on Azure and AWS code. Use when a pull request changes Terraform, or when you wire the same checks into pre-commit and the pipeline.
Open the skillterraform-testing
Test Terraform modules before they ship to Azure or AWS. Use when a module change needs a plan assertion with mocked providers, or a short-lived apply in an ephemeral test subscription or account.
Open the skillterraform-workspaces-environments
Separate Terraform environments for Azure and AWS. Use when you choose a directory, workspace or Terragrunt layout, or when you promote one pinned module version to the next environment.
Open the skillAzure¶
azure-aks
Use when you create or upgrade an AKS cluster. Prefer a private cluster, Azure CNI overlay, Azure RBAC and workload identity, keep system and user pools apart, and move one Kubernetes minor at a time.
Open the skillazure-bicep-awareness
Use when you read, preview or take over a Bicep or ARM stack. Compile and run what-if before you deploy, keep Bicep if it already owns an Azure-only stack, and move to Terraform only when the rest of the estate is Terraform.
Open the skillazure-cost-review
Use before a change that adds Azure spend, and when you read a bill. Check Cost Management, set a budget alert, right-size from metrics, and list orphaned disks, public IPs, idle load balancers and unused application gateways.
Open the skillazure-key-vault
Use when you create a Key Vault or let a pipeline or app read it. Turn on RBAC authorization, purge protection and a private endpoint, split secrets, keys and certificates, and keep values out of logs and plan output.
Open the skillazure-landing-zones
Use when you add or change an Azure landing zone. Set the management group hierarchy, keep each subscription as the isolation boundary, and pin a reviewed hub or Virtual WAN module behind a federated pipeline identity.
Open the skillazure-networking
Use when you change hub or spoke networks, peering, routes, NSGs, private endpoints or Private DNS. Send traffic through the hub firewall and name every route, zone and peering the change can break.
Open the skillazure-rbac-entra
Use when you grant Azure RBAC or Entra access to a person, a workload or a pipeline. Assign the narrowest built-in or custom role at the resource, use Privileged Identity Management for people, and federate pipeline identities.
Open the skillAWS¶
aws-cloudwatch
Use when you add logs, metrics, alarms or a dashboard. Set a retention on every log group, alarm on the symptom the user hits, and read the series before you change the resource.
Open the skillaws-codepipeline-awareness
Use when you read, change or replace a CodePipeline or CodeBuild project. Keep a working pipeline on its current tool, and start a new deploy on GitHub Actions with OIDC.
Open the skillaws-cost-review
Use before a change that adds AWS spend, and when you read a bill. Check Cost Explorer, set a budget, right-size from Compute Optimizer, and include NAT, public IPv4 and cross-AZ data transfer.
Open the skillaws-ecs
Use when you create or deploy an ECS service. Prefer Fargate, split the task role from the execution role, and put the service behind a load balancer with a deployment circuit breaker.
Open the skillaws-eks
Use when you create or upgrade an EKS cluster. Prefer a private API endpoint, Pod Identity for new pods, managed node groups or Karpenter, and move one Kubernetes minor at a time.
Open the skillaws-iam-least-privilege
Use when you add or widen an IAM policy, role or permission boundary. Write the API calls the job makes, validate the policy, and keep AdministratorAccess off pipelines and people.
Open the skillaws-organizations-scps
Use when you add an account, an OU or a service control policy. Keep workloads out of the management account, treat an SCP as a ceiling that does not grant access, and leave Control Tower policies untouched.
Open the skillaws-secrets-ssm
Use when you store a secret or a configuration value in AWS. Put rotating credentials in Secrets Manager, put other secrets in Parameter Store as SecureString, and scope the pipeline to one ARN.
Open the skillaws-vpc
Use when you add or change a VPC, subnet, route, NAT gateway, VPC endpoint, security group or Transit Gateway. Keep data subnets private and send S3 and DynamoDB through gateway endpoints.
Open the skillPipelines¶
pipelines-artifacts-releases
Use when you build an image or a package and promote it. Build once, deploy the digest, attach provenance and an SBOM, and keep registry tags immutable.
Open the skillpipelines-azure-devops-yaml
Use when you write, change, or diagnose an Azure DevOps YAML pipeline. Read a failed run before you edit it, put checks on the resource, and deploy with workload identity federation.
Open the skillpipelines-environments-approvals
Use when a pipeline deploys to a shared environment. Require a reviewer on the GitHub environment or an Azure DevOps check, and bind the federated subject to that environment.
Open the skillpipelines-github-actions-authoring
Use when you add or edit a GitHub Actions workflow. Pin every action to a reviewed commit SHA, keep permissions least privilege, and stop overlapping deploys with timeouts and concurrency.
Open the skillpipelines-github-actions-debugging
Use when a GitHub Actions run fails, hangs or stays queued. Read the failed logs, re-run with debug logging, and fix the runner or the step instead of hiding the failure with a retry.
Open the skillpipelines-oidc-federation
Use when a GitHub Actions or Azure DevOps pipeline logs in to Azure or AWS. Federate the identity with an exact subject and drop any stored cloud key or client secret.
Open the skillpipelines-reusable-templates
Use when you share a GitHub Actions workflow, a composite action or an Azure DevOps template. Pin the caller to a reviewed ref and pass named secrets instead of inheriting every secret.
Open the skillpipelines-runners
Use when you add or harden a GitHub Actions runner or an Azure DevOps agent pool. Keep it ephemeral, keep cloud keys off the host, and keep untrusted builds away from the production network.
Open the skillpipelines-terraform-workflow
Use when a pipeline runs Terraform for Azure or AWS. Lint with no cloud credential, plan on the pull request and comment a summary, then apply the saved plan from the merge commit after the environment approves, one environment at a time.
Open the skillGitHub¶
github-pull-requests
Use when you open or review a GitHub pull request. Target the default branch, wait for the ruleset and the checks, and stop before you approve or merge your own change.
Open the skillgithub-repositories
Use when you create or protect a GitHub repository. Keep it private unless the change says otherwise, protect the default branch with a ruleset, and turn on secret scanning where the plan allows.
Open the skillAzure DevOps¶
azuredevops-repositories
Use when you create or protect an Azure DevOps Git repository, or you open or review its pull request. Require a reviewer who is not the author, and do not bypass branch policy.
Open the skillServiceNow¶
servicenow-changes
Use when you raise or handle a ServiceNow change for the signed-in user. Default to a normal change, write the backout, and stop before approval or implementation.
Open the skillservicenow-incidents
Use when you open or update a ServiceNow incident for the signed-in user. Search the open queue first, set impact and urgency, and resolve only after the user confirms the symptom has stopped.
Open the skillservicenow-problems
Use when you open or update a ServiceNow problem for the signed-in user. Relate the incidents that share a cause, record a workaround, and send the fix through a change.
Open the skillservicenow-queue
Use when you look up what is open for a person in ServiceNow. Call the instance as that user, list their incidents, problems, changes, and requests, and do not create a record from this list.
Open the skillservicenow-requests
Use when the signed-in user wants a ServiceNow catalog item. Search the catalog, submit that item with their variables, and stop before you approve the request.
Open the skillKubernetes¶
k8s-dockerfile-hardening
Use when you write or review a Dockerfile. Build in stages, run as a non-root user, pin the base image by digest, and scan the image before anyone deploys it.
Open the skillk8s-helm-review
Use when you add or upgrade a Helm chart. Require a values schema, read the rendered manifests, run helm diff, and keep a tested rollback to the previous release.
Open the skillk8s-manifest-review
Use when you add or review a Kubernetes workload. Set requests and a memory limit, probes, a restricted security context, a disruption budget and a NetworkPolicy before the manifest is applied.
Open the skillGitOps¶
gitops-argocd-flux
Use when you deliver workloads with Argo CD or Flux. Promote a digest through overlays, keep production sync from deleting on the first apply, and store secrets with SOPS or External Secrets.
Open the skillPolicy¶
policy-as-code
Use when you add or change a policy on a Terraform plan or a Kubernetes manifest. Run Conftest in CI, start Azure Policy and admission in audit, and keep an SCP as the AWS ceiling.
Open the skillOperations¶
ops-access-review
Use when someone joins, moves, or leaves, or you review who still has standing access on Azure or AWS. Remove what the job no longer needs, and keep break-glass out of daily use.
Open the skillops-backup-restore
Use when you protect or restore data on Azure or AWS. Name the recovery point and the restore time, lock the backup vault, and prove a restore on a copy before you delete anything.
Open the skillops-blast-radius
Use when you plan a change across Azure, AWS, or a pipeline. Name every subscription, account, cluster, and pipeline the change can touch before you apply it.
Open the skillops-certificates
Use when a TLS certificate is expiring or you issue, renew, or bind one on Azure or AWS. Inventory every listener, renew into the store you already use, and prove the new certificate before you remove the old one.
Open the skillops-incident-response
Use when a production service is failing. Name a lead, set a severity from user impact, mitigate with a rehearsed rollback, and send updates on a fixed cadence.
Open the skillops-observability-alerts
Use when you add an alert or an SLO. Page on the symptom the user hits, attach one runbook, and wire Azure Monitor or CloudWatch only after you have read the series.
Open the skillops-postmortem
Use when a SEV1 or SEV2 incident is over. Write a blameless postmortem with the timeline, the contributing factors, and action items that each have an owner and a date.
Open the skillops-rollback-plan
Use when a change can reach production. Write the rollback for that change type, Terraform, deploy, migration, network, or IAM, and rehearse it before the change starts.
Open the skillops-runbook-authoring
Use when you write or update a runbook. Give each step a command, the output you expect, and the person to escalate to when that output does not appear.
Open the skillops-scripting-standards
Use when you write a Bash, PowerShell, or Python automation script. Fail on errors and unset variables, support a dry run, and make a second run change nothing.
Open the skillops-secrets-handling
Use when a secret is created, copied, or leaked. Keep one home in Key Vault, Secrets Manager, or SOPS, and rotate a leaked value before you close the leak.
Open the skillModes¶
jay-mode
Use when a request covers Azure, AWS, Terraform, a pipeline, a GitHub or Azure DevOps repository, or ServiceNow, and more than one skill could fit. Take the first matching row. That row names the one skill to load.
Open the skillsetup-jstack
Use when you install jstack for Cursor, GitHub Copilot, or Claude Code. Sync only the skills that machine or repository needs, and prove the copy with a dry run.
Open the skillStill open¶
The areas above are in the repository. Live trials in Cursor, GitHub Copilot, and Claude Code are still open, and the v0.1.0 tag is not cut. That work is issue 1.