platform-skills

Generate and enforce policy gates for AI coding agents (Copilot, Claude Code) — real-time session hooks that deny protected-path edits and dangerous commands, plus a merge-time backstop for anything that bypasses them. Use when asked to "govern AI agents", "block AI from touching secrets", "add an AI policy gate", or "why did the AI agent hook not fire".

Generate and enforce policy gates for AI coding agents (Copilot, Claude Code) — real-time session hooks that deny protected-path edits and dangerous commands, plus a merge-time backstop for anything that bypasses them. Use when asked to "govern AI agents", "block AI from touching secrets", "add an AI policy gate", or "why did the AI agent hook not fire".

Generate, convert, and maintain animated GitHub-safe Markdown documents with animated SVG diagrams. Covers four SVG patterns (architecture flow, lifecycle loop, field carousel, timeline phases), guided interview for any doc type (README, architecture guide, runbook, API reference, tutorial, RFC, post-mortem, how-it-works, or custom), converting existing plain Markdown, diffing for stale diagrams, quality auditing, local preview, and multi-platform export. Use when asked to "create a README for X", "write an architecture doc", "animate this guide", "convert my doc to animated", "check if my diagrams are stale", or "export my doc for Confluence".

Generate, convert, and maintain animated GitHub-safe Markdown documents with animated SVG diagrams. Covers four SVG patterns (architecture flow, lifecycle loop, field carousel, timeline phases), guided interview for any doc type (README, architecture guide, runbook, API reference, tutorial, RFC, post-mortem, how-it-works, or custom), converting existing plain Markdown, diffing for stale diagrams, quality auditing, local preview, and multi-platform export. Use when asked to "create a README for X", "write an architecture doc", "animate this guide", "convert my doc to animated", "check if my diagrams are stale", or "export my doc for Confluence".

Structured guidance for AWS CloudFront distributions, WAF web ACLs, Lambda@Edge, CloudFront Functions, Firewall Manager multi-account enforcement, and IAM/IRSA patterns. Covers OAC, cache policies, security headers, managed rule groups, rate limiting, FMS FIRST/MIDDLE/LAST ownership model, and production-ready Terraform generation.

Structured guidance for AWS CloudFront distributions, WAF web ACLs, Lambda@Edge, CloudFront Functions, Firewall Manager multi-account enforcement, and IAM/IRSA patterns. Covers OAC, cache policies, security headers, managed rule groups, rate limiting, FMS FIRST/MIDDLE/LAST ownership model, and production-ready Terraform generation.

Manage AWS profiles for MCP servers — discover SSO, Granted and role-chain profiles, check authentication with STS, switch configured profiles, and scan AWS Organization accounts. TTL is unknown unless the user shares an expiry timestamp without credentials.

Manage AWS profiles for MCP servers — discover SSO, Granted and role-chain profiles, check authentication with STS, switch configured profiles, and scan AWS Organization accounts. TTL is unknown unless the user shares an expiry timestamp without credentials.

Azure identity (Workload Identity, OIDC, Entra ID), resource tagging, AKS platform patterns, RBAC scoping, and production-readiness review — with Terraform generation.

Azure identity (Workload Identity, OIDC, Entra ID), resource tagging, AKS platform patterns, RBAC scoping, and production-readiness review — with Terraform generation.

Back up and restore Kubernetes workloads with Velero, and prove recovery works. Covers Velero on EKS via Flux (IRSA, S3 backup location, EBS snapshots), schedules and retention, what a backup does not contain, restore drills that restore a namespace into an isolated copy and measure recovery time, cross-cluster disaster recovery with a read-only backup location, and GameDay pairing with chaos experiments. Use when asked to "set up cluster backups", "test our restore", "what's our recovery time", "restore a deleted namespace", or "plan DR to another cluster". Breaking things on purpose → /platform-skills:chaos. Upgrade rollback by blue/green → /platform-skills:cluster-upgrade.

Back up and restore Kubernetes workloads with Velero, and prove recovery works. Covers Velero on EKS via Flux (IRSA, S3 backup location, EBS snapshots), schedules and retention, what a backup does not contain, restore drills that restore a namespace into an isolated copy and measure recovery time, cross-cluster disaster recovery with a read-only backup location, and GameDay pairing with chaos experiments. Use when asked to "set up cluster backups", "test our restore", "what's our recovery time", "restore a deleted namespace", or "plan DR to another cluster". Breaking things on purpose → /platform-skills:chaos. Upgrade rollback by blue/green → /platform-skills:cluster-upgrade.

Design, run, and debug Chaos Engineering experiments on Kubernetes using Litmus Chaos v3 and Chaos Mesh v2. Covers fault injection (pod-delete, network-loss, CPU stress, node-drain), steady-state hypothesis probes, GameDay runbooks, scheduled experiments, DORA feedback loop, and RBAC setup. Use when asked to "inject a pod fault", "run a GameDay", "schedule chaos experiments", or "debug why my ChaosEngine is stuck".

Design, run, and debug Chaos Engineering experiments on Kubernetes using Litmus Chaos v3 and Chaos Mesh v2. Covers fault injection (pod-delete, network-loss, CPU stress, node-drain), steady-state hypothesis probes, GameDay runbooks, scheduled experiments, DORA feedback loop, and RBAC setup. Use when asked to "inject a pod fault", "run a GameDay", "schedule chaos experiments", or "debug why my ChaosEngine is stuck".

Bootstrap Checkov on a developer laptop, run static or plan-level Terraform security scanning for AWS/Azure/GCP/EKS, resolve private GitHub modules with a GITHUB_PAT you export, generate pre-commit hooks, produce multi-format output (cli/json/sarif/junit), and fix violations with AI-generated patches. Use when asked to "scan my Terraform", "run checkov", "check my IaC for security issues", "set up checkov pre-commit", or "fix checkov findings".

Bootstrap Checkov on a developer laptop, run static or plan-level Terraform security scanning for AWS/Azure/GCP/EKS, resolve private GitHub modules with a GITHUB_PAT you export, generate pre-commit hooks, produce multi-format output (cli/json/sarif/junit), and fix violations with AI-generated patches. Use when asked to "scan my Terraform", "run checkov", "check my IaC for security issues", "set up checkov pre-commit", or "fix checkov findings".

Plan, run and roll back a Kubernetes minor-version upgrade, EKS first. Finds removed APIs in Git, rendered Helm charts and the live cluster with pluto and EKS upgrade insights, checks add-on compatibility (VPC CNI, CoreDNS, kube-proxy, Karpenter, Flux, KEDA, admission webhooks) against the target version, finds PodDisruptionBudgets that block node drains, plans the node rotation per pool, and picks the right rollback, including EKS one-step version rollback within 7 days or a blue/green cluster. Use when asked to "upgrade the cluster to 1.x", "what breaks if we upgrade", "find deprecated APIs before the upgrade", "why is the node drain stuck", or "roll back the EKS upgrade". One PR diff with a deprecated API → /platform-skills:pr-review. Karpenter's own upgrade → /platform-skills:karpenter.

Plan, run and roll back a Kubernetes minor-version upgrade, EKS first. Finds removed APIs in Git, rendered Helm charts and the live cluster with pluto and EKS upgrade insights, checks add-on compatibility (VPC CNI, CoreDNS, kube-proxy, Karpenter, Flux, KEDA, admission webhooks) against the target version, finds PodDisruptionBudgets that block node drains, plans the node rotation per pool, and picks the right rollback, including EKS one-step version rollback within 7 days or a blue/green cluster. Use when asked to "upgrade the cluster to 1.x", "what breaks if we upgrade", "find deprecated APIs before the upgrade", "why is the node drain stuck", or "roll back the EKS upgrade". One PR diff with a deprecated API → /platform-skills:pr-review. Karpenter's own upgrade → /platform-skills:karpenter.

Review pull requests to this repo (a Claude Code / Copilot / Cursor platform-engineering skill plugin) for technical accuracy, security posture, structural consistency with existing domains, and completeness. Use this for any PR touching commands/, references/, examples/, skills/platform-skills/SKILL.md, or the plugin catalog files (plugin.json, marketplace.json, COMMANDS.md, HOW_IT_WORKS.md, GETTING_STARTED.md).

Analyze git diffs or staged changes and generate conventional commit messages that explain WHY a change was made. Supports auto-detecting type and scope, intelligent file staging, and interactive overrides. Use when asked to "write a commit message", "generate a commit", "describe my changes", "commit this", "summarize my diff", or "/commit".