DevOps & Infra

vincentchuwaichow Bundle

Map AWS compliance evidence for audits across Security Hub controls, AWS Config rules/conformance packs, Audit Manager assessments, evidence folders, manual evidence, AWS Artifact reports, CloudTrail, and control narratives. Use for evidence packaging and audit readiness, not general security hardening.

vincentchuwaichow Bundle

Review AWS cost optimization and FinOps posture across Cost Explorer, Budgets, Cost Optimization Hub, Compute Optimizer, Savings Plans, Reserved Instances, tagging, showback, idle resources, rightsizing, storage, data transfer, and forecast risk. Use when the user asks to reduce or explain AWS cost.

vincentchuwaichow Bundle

Patch AWS deployment hotfix config, release parameters, manifest mistakes, environment drift, rollback blockers, and rollout blockers in-repo. Use for rapid non-destructive deployment corrections; do not use for live deploy/apply/destroy actions.

vincentchuwaichow Bundle

Review AWS IAM identity policies, trust policies, resource policies, permission boundaries, SCPs, session policies, role design, pass-role, federation, and Access Analyzer findings for least-privilege risk. Prefer KMS/secrets steward for key/secret lifecycle design and S3 perimeter governor for S3 exposure/data-perimeter posture unless the request is primarily policy surgery.

vincentchuwaichow Bundle

Review Amazon S3 data perimeter and exposure posture across Block Public Access, Object Ownership, ACL removal, bucket/access point policies, TLS-only access, encryption, replication, lifecycle, logging, cross-account access, and prefix boundaries. Prefer this for S3 data exposure; prefer IAM skill for generic policy surgery.

vincentchuwaichow Bundle

Review broad AWS security posture across Security Hub CSPM, GuardDuty, Inspector, Macie, Config, CloudTrail, IAM, public exposure, vulnerability findings, and remediation governance. Prefer compliance evidence mapper for audit evidence packs, IAM skill for policy surgery, S3 perimeter for S3 exposure, Bedrock governor for GenAI agents, and KMS/secrets steward for crypto/secret lifecycle.

vincentchuwaichow Bundle

Azure Cost Estimation Review

vincentchuwaichow Bundle

Azure Landing Zone Architect

vincentchuwaichow Bundle

Guard live AKS deployment rollouts with PDB audit, maxUnavailable/surge validation, rollout pause/undo gates, and post-rollout health verification.

vincentchuwaichow Bundle

Azure Resilience BCDR Review

vincentchuwaichow Bundle

Azure WAF Reliability

vincentchuwaichow Bundle

Audit GCP IAM bindings across the resource hierarchy (org/folder/project), identify overprivileged Service Accounts, review Workload Identity Federation configurations, evaluate org policy conditions, and recommend least-privilege remediation. Prefer gcp-secret-kms-lifecycle-steward for KMS/Secret Manager lifecycle design and gcp-vpc-service-controls-architect for perimeter access policy posture unless the request is primarily IAM binding surgery.

vincentchuwaichow Bundle

Govern GCP Artifact Registry — container image signing via Binary Authorization, vulnerability scanning via Container Analysis, repository IAM least privilege, artifact retention policies, and supply chain security posture.

vincentchuwaichow Bundle

Review GCP security posture via Security Command Center findings, CIS GCP Benchmark gaps, org policy enforcement baseline, Assured Workloads controls, Binary Authorization, and CSPM recommendations. Prefer gcp-iam-least-privilege-review for IAM binding surgery and gcp-vpc-service-controls-architect for VPC-SC perimeter design unless the request is primarily broad posture hardening.

vincentchuwaichow Bundle

Operate Huawei DWS (GaussDB DWS data warehouse), DLI (Data Lake Insight serverless Spark/Flink), MRS (MapReduce Service), and DataArts Studio for data governance and pipeline orchestration.

vincentchuwaichow Bundle

Manage Huawei ECS (Elastic Cloud Server) instance lifecycle, AS (Auto Scaling) group configuration and health, IMS (Image Management Service) golden image management, DeH (Dedicated Host) tenancy, and CSBS backup snapshot governance.

vincentchuwaichow Bundle

Analyze Alibaba Cloud spend via Cost Manager, optimize Savings Plans and Reserved Instance coverage, design resource tagging strategy, investigate budget drift, and right-size over-provisioned ECS, RDS, and MaxCompute resources.

vincentchuwaichow Bundle

Plan Alibaba Cloud migrations using SMC (Server Migration Center), DTS (Data Transmission Service) for data sync, OSSImport for object storage migration, and design cutover sequencing with rollback paths.

vincentchuwaichow Bundle

Manage OSS lifecycle policies, bucket policy and ACL governance, NAS/CPFS shared file storage, cross-region replication, and access control hardening for Alibaba Cloud object and file storage.

vincentchuwaichow Bundle

Assess Alibaba Cloud workload security posture: RAM least-privilege, VPC isolation, KMS/HSM encryption, Cloud Security Center threat detection, ActionTrail audit, WAF/Anti-DDoS web protection, and Chinese regulatory compliance (MLPS 2.0, DSL, PIPL).

vincentchuwaichow Bundle

Design, review, and improve AWS DevOps Agent-compatible skills, investigation workflows, learned skills, tool-use best practices, agent type targeting, frontmatter descriptions, reference materials, and operational output contracts. Use when creating or adapting skills for AWS DevOps Agent or AWS-style incident agents.

vincentchuwaichow Bundle

Azure AI Foundry Ops Governor

vincentchuwaichow Bundle

Azure Network Topology Review

vincentchuwaichow Bundle

Use this skill for Cilium network policy review across the three policy formats (Kubernetes NetworkPolicy, CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy), L7 policy via embedded Envoy, ClusterMesh cross-cluster semantics, Hubble flow observability, and CiliumEgressGatewayPolicy. Trigger when the user asks whether a network policy is too broad, whether default-deny is in place, whether L7 rules will actually be enforced, whether ClusterMesh policy semantics are correct, or whether an egress gateway IP collision is possible.

vincentchuwaichow Bundle

Use this skill when reviewing the architecture of an ASP.NET Core HTTP API — middleware ordering in the request pipeline, dependency-injection service lifetimes, CORS policy, model validation on bound input, API versioning, error and exception responses, rate limiting, and the boundary between health and readiness endpoints. Trigger when a user provides ASP.NET Core source (Program.cs, startup wiring, controllers, minimal-API endpoints) or sanitized appsettings, asks whether their API pipeline is wired correctly, or wants to know why requests behave unexpectedly across the middleware chain. This skill reviews source and sanitized configuration statically; it never runs the app or calls endpoints.

vincentchuwaichow Bundle

Produce OpenCost-compatible namespace, pod, and workload cost allocation tables from user-supplied cluster shape data and public cloud pricing. Input is cluster topology provided by the caller; no cluster credentials or live API access are required or accepted. Output maps to FOCUS v1.2 columns.

vincentchuwaichow Bundle

Design and operate Anthos / GKE Enterprise fleet management, Config Management (GitOps with Policy Controller), multi-cloud Kubernetes across GCP, AWS, and Azure.

vincentchuwaichow Bundle

Govern Google Cloud Storage data perimeters — uniform bucket-level access enforcement, public access prevention, VPC Service Controls perimeter coverage, IAM Conditions for time-bounded access, Object Lifecycle policies, and data residency compliance.

vincentchuwaichow Bundle

Plan and execute migrations to GCP using Migrate to Virtual Machines, Database Migration Service, Storage Transfer Service, and design cutover sequencing with rollback plans.

vincentchuwaichow Bundle

Pre-change blast radius analysis for Huawei Cloud — Organizations SCP cascade scope, IAM agency dependency chain, VPC route table and VPC Peering impact, GaussDB instance class change disruption, CCE node pool resize safety, and Enterprise Project boundary clarity.

vincentchuwaichow Bundle

Use this skill when statically reviewing a Flyway or Liquibase schema-migration PR for rolling or blue-green deploy safety — immutable applied-migration discipline (checksum/history-table drift on an edited already-applied migration), expand-contract phasing for column/table drops and renames, destructive DDL (drop column/table, type narrowing, NOT NULL without a default on a populated table) landing in the same release that stops using it, long-locking DDL on large tables, out-of-order migrations, non-idempotent repeatable migrations, and a stated rollback/backfill plan. Trigger when a user provides migration scripts or changelogs, a schema diff, or asks whether a migration is safe to ship, safe to roll back, or safe to run alongside an older application version during rollout. Reads migration files and sanitized schema/config only; it never opens a database connection, runs a migration, or queries live schema state.

vincentchuwaichow Bundle

Review OVHcloud IAM policies for overly permissive allow rules, missing deny blocks, unscoped URNs, absent condition blocks (IP CIDR, resource tag, expiration), and identity-group hygiene. Use when the user needs to audit access control, review `ovh_iam_policy` Terraform resources, assess OAuth2 service account scopes, or validate conditional access configuration against the principle of least privilege.

vincentchuwaichow Bundle

Design and review OVHcloud network topology including vRack private network segmentation, VLAN configuration, Public Cloud private network attachment, dedicated server connectivity, load balancer placement, DNS zone design, security group rules, and blast-radius scoping for topology changes. Use when the user needs vRack design guidance, network isolation review, or Terraform IaC review for `ovh_vrack` and related resources.

vincentchuwaichow Bundle

Use this skill to create a branch and pull request for a bounded code/dependency remediation and run approved isolated (non-production) validation against it. Mutating-runtime: it can never merge, deploy, or weaken a policy, gate, or test.

vincentchuwaichow Bundle

SAP HANA Cloud Performance and Cost Review

vincentchuwaichow Bundle

Use this skill to review a Terraform or OpenTofu module as a reusable contract: whether its inputs are constrained rather than merely documented, whether its outputs promise more than intended, where each invariant belongs, whether a change is breaking for existing callers, and whether a proposed one-off module should exist at all given the platform modules already available. Static review of source and sanitized variable files only — it never runs the engine, contacts a registry, or reviews a plan.