DevOps & Infra

vincentchuwaichow Bundle

Review Hetzner Cloud infrastructure posture including Firewall inbound and outbound rules and server attachment, Load Balancer health check configuration and target pool design, private Network topology, Floating IP and Primary IP exposure, and region distribution across fsn1, nbg1, and hel1. Use when the user asks to audit or improve Hetzner Cloud network security or architecture.

vincentchuwaichow Bundle

Manage Huawei DEW (Data Encryption Workshop) — KMS key lifecycle and rotation, CSMS secret rotation automation, CBH (Cloud Bastion Host) privileged access session management, and DBSS database encryption and SQL audit.

vincentchuwaichow Bundle

Review and advise on Dynamics 365 Sales revenue operations — pipeline and opportunity management, sales forecasting, lead qualification, sales accelerator configuration, CRM data hygiene, and sales insights. Detects pipeline trust gaps, forecast inaccuracy, CRM hygiene failures, and revenue leakage patterns. Refuses to approve live production forecast configuration or sales-process changes without live-guard escalation. Static review and advisory only.

vincentchuwaichow Bundle

Flashlight skill for reviewing NetSuite platform foundation configurations aligned to the SuiteFoundation Specialist certification (N16300GC10). T0 static review — no live account connection required. TRIGGER when: user asks to review record form layouts, saved search criteria or results columns, dashboard portlet configuration, custom field definitions, custom list or segment setup, subsidiary hierarchy, or basic role and permission baselines in NetSuite. Trigger phrases: review my saved search, check my record form, audit our custom fields, validate subsidiary setup, review role permissions, inspect dashboard configuration, SuiteFoundation review. DO NOT TRIGGER when: request involves SuiteScript code analysis (use netsuite-application-developer-agent), OAuth or TBA authentication setup (use netsuite-sso-oauth-tba-agent), financial close controls or posting periods (use netsuite-financial-foundations-agent), SDF project deployment pipeline (use netsuite-sdf-devops-release-agent), or any live account mutatio

vincentchuwaichow Bundle

Use this skill to statically review Python data-pipeline reliability (Airflow, Dagster, Prefect, PySpark): task idempotency and safe backfills, partitioning and late-data handling, schema evolution and data contracts, checkpointing, retry policy, and data-quality gates. Reads DAG/pipeline source and configuration only; it never runs a pipeline, triggers a backfill, or connects to a warehouse.

vincentchuwaichow Bundle

Deploy or modify SAP Cloud Integration iFlows and integration artifacts using a mandatory 17-step guarded mutation sequence covering classification, target tenant confirmation, criticality, requester, approver (integration-owner required), ticket, scope, read-only current state, diff of artifact changes, blast radius (downstream partners and throughput), rollback (previous version redeploy), post-change verification via message monitoring, and audit evidence. Refuses if any step is missing, if integration-owner approval is absent, or if a diff has not been produced. Use when a confirmed and approved iFlow deployment or integration artifact change in a non-development Cloud Integration tenant must be executed under traceable controls.

vincentchuwaichow Bundle

Review Terraform and ROS (Resource Orchestration Service) changes targeting Alibaba Cloud — blast radius analysis, resource deletion detection, cross-stack dependency impact, Resource Directory scope, and rollback plan completeness.

vincentchuwaichow Bundle

Correct AWS ECS and Fargate service definitions, task definition config, deployment parameters, health checks, environment settings, and rollout wiring in-repo. Use for non-destructive repo fixes only; do not force deployments or mutate live services from this role.

vincentchuwaichow Bundle

Review AWS event-driven system design across EventBridge, event buses, Pipes, SQS, SNS, Step Functions, event schemas, filtering, cross-account routing, retries, DLQs, replay, idempotency, monitoring, and event-loop risk. Prefer serverless production readiness for Lambda runtime/deployment readiness.

vincentchuwaichow Bundle

Operate guarded live AWS deployment changes with explicit account, region, profile, approval, dry-run, rollback, and verification gates. Use only when the target environment is confirmed and a live deployment action is intentionally requested.

vincentchuwaichow Bundle

Investigate broad AWS incidents and observability gaps using CloudWatch metrics, logs, alarms, traces, EventBridge events, service health, runbooks, timelines, blast radius, root-cause discipline, and post-incident actions. Prefer RDS/Aurora investigator for database-specific performance incidents.

vincentchuwaichow Bundle

Azure Governance Policy Guardrails

vincentchuwaichow Bundle

Azure Migrate Landing Zone Cutover

vincentchuwaichow Bundle

Azure WAF Cost Optimization

vincentchuwaichow Bundle

Use this skill to review a Declarative Automation Bundle configuration, authentication setup, and deployment flow against production readiness criteria: bundle structure, deployment modes, run-as identity boundaries, variable resolution timing, OAuth and environment-variable authentication, Terraform versus direct deployment, Git folder segregation, and CI/CD gate design. Reads bundle configuration, CI/CD workflows, and Git branch structure; never executes commands, never deploys, and never accepts credentials.

vincentchuwaichow Bundle

Use this skill when reviewing a .NET Aspire AppHost or service-defaults project for cloud-native readiness — health checks on declared service dependencies, service dependency wiring, resiliency policies on outbound calls, configuration and secret hygiene, configuration drift between the AppHost and service projects, container readiness evidence, and the boundary between Aspire's development-time composition model and a real deployment platform. Trigger when a user provides an Aspire AppHost project, a ServiceDefaults project, an Aspire manifest, or sanitized appsettings, asks whether their Aspire solution is cloud-native ready, or treats the AppHost as a production deploy target. This skill reviews source and sanitized configuration statically; it never runs the AppHost or deploys.

vincentchuwaichow Bundle

Review GCP Pub/Sub, Eventarc, Cloud Tasks, Cloud Scheduler, and Workflows designs — dead-letter topics, message ordering, idempotency, fan-out blast radius, schema registry, and retry storm risk.

vincentchuwaichow Bundle

Respond to incidents and set up observability using Cloud Monitoring, Cloud Logging, Error Reporting, Cloud Trace, and SLO burn rate alerting.

vincentchuwaichow Bundle

Guard Hetzner Cloud Firewall rule mutations and server attachment changes with mandatory pre-mutation snapshot of current rules, blast-radius review, explicit human approval, target confirmation, account, region, and rollback plan. Use only when live Firewall rule changes are required and all pre-flight checks are confirmed.

vincentchuwaichow Bundle

Audit Huawei Cloud IAM fine-grained policies, SCP (Service Control Policy) at Organizations level, agency trust relationships (cross-account delegation), and enterprise project permission boundaries.

vincentchuwaichow Bundle

Govern Huawei Cloud SWR (Software Repository for Container) — image retention policy, vulnerability scanning via VSS (Vulnerability Scan Service) integration, namespace permission least privilege, cross-region image replication, and supply chain security posture.

vincentchuwaichow Bundle

Review IONOS managed Kubernetes cluster and node pool configuration covering cluster readiness, node pool sizing and autoscaling, workload placement strategies, PodDisruptionBudget coverage, control-plane upgrade safety, kubeconfig management, LAN attachment, and GDPR-compliant cluster region selection. Use when the user asks to assess, configure, or troubleshoot IONOS managed Kubernetes clusters or node pools.

vincentchuwaichow Bundle

Audit IONOS Cloud security and compliance posture covering GDPR data residency and data sovereignty, ISO 27001 control alignment, encryption at rest and in transit, private LAN isolation, IAM role and bearer token hygiene, regional endpoint correctness, audit trail coverage, and vulnerability posture. Use when the user asks to assess, improve, or evidence IONOS Cloud security or GDPR compliance.

vincentchuwaichow Bundle

Use this skill when statically reviewing a Spring Boot, Quarkus, or Micronaut service for production readiness — externalized configuration, health/readiness/liveness endpoint wiring, graceful shutdown, jakarta namespace correctness plus the framework's JDK floor, build-time DI/AOT reflection safety, profile/config validation, and dependency BOM alignment. Trigger when a user provides a build file (pom.xml/build.gradle), application.properties/application.yml (sanitized), or source annotations and asks whether a service is ready to ship, what a pre-production checklist should cover, or why a rolling deploy drops requests or a native build fails at runtime. Reads source and sanitized configuration only; it never builds, runs, invokes a JDK, opens a live connection, or asserts framework EOL dates from memory.

vincentchuwaichow Bundle

Use this skill when an operator is about to promote an NVIDIA NIM container from staging to production and needs a runtime-evidence go/no-go decision. The skill executes a fixed allowlist of cosign/crane/oras/grype commands against the candidate image, then emits a signed attestation JSON whose verdict is one of promote, block, or manual-review. Trigger when the user asks "is this NIM safe to promote", "verify this container before deploy", or hands the agent a `nvcr.io/...` image reference and a current-prod digest. Live tier counterpart to `nvidia-ngc-nim-supply-chain-governor` (which is static-review only).

vincentchuwaichow Bundle

Use this skill to make Snowflake consumption accountable: decompose warehouse, serverless, AI, storage and transfer spend; distinguish budgets from resource monitors and find the uncontrolled surface; attribute credits by query tag, object tag and warehouse; design defensible chargeback; investigate anomalies and forecast variance; and evaluate optimization economics. Trigger on any cost, credit, budget, attribution, or spend-anomaly question. Static review only: it never resizes a warehouse, never sets a limit, and never calls a reduction a saving without volume-normalized evidence.

vincentchuwaichow Bundle

Use this skill to decide whether a Terraform core upgrade, a provider major upgrade, or a move between Terraform and OpenTofu is safe to adopt, in what order, and with what rollback. Enumerates breaking changes for the exact version pair, separates errors from forced replacements, tracks deprecation exposure, and treats the engine choice as a divergence register rather than a preference. Static review of version constraints, lock files, and upgrade guidance only.

vincentchuwaichow Bundle

Use this skill to judge whether the pipeline that executes Terraform or OpenTofu changes can be trusted with its privileges: runner identity lifetime and scope, the plan-versus-apply credential split, whether apply consumes the reviewed saved plan, how cleartext-sensitive plan artifacts move between stages, approval integrity, and every trigger that can reach the apply path. Static review of pipeline and runner configuration only — it never triggers, modifies, or approves anything.

vincentchuwaichow Bundle

Query Alibaba Cloud ActionTrail management API call history, build governance audit reports, create SLS-based compliance evidence trails, and detect anomalous admin activity patterns.

vincentchuwaichow Bundle

Harden Alibaba Cloud security posture via Security Center (threat detection, vulnerability scanning, baseline checks), WAF, Anti-DDoS Pro, Cloud Firewall, and Network Traffic Analysis (NTA).

vincentchuwaichow Bundle

Gate Azure budget action changes and GPU/HPC SKU provisioning against approved spend limits, with quota audits and emergency spend-stop playbooks.

vincentchuwaichow Bundle

Gate Entra ID PIM eligible role activations with justification, MFA, ticket binding, time-bound scope, and approval workflow gates before any privileged Azure role becomes active.

vincentchuwaichow Bundle

Analyze BigQuery slot reservation sizing, BI Engine acceleration, query cost estimation, dataset governance (expiration, access controls), and partitioning/clustering optimization to reduce on-demand scan costs.

vincentchuwaichow Bundle

Review GCP Certificate Manager and classic Google-managed TLS certificates — certificate map configuration, DNS authorization, CAA record validation, certificate rotation automation, wildcard vs SAN design, and expiry monitoring.

vincentchuwaichow Bundle

Review Hetzner Cloud cost posture across server type selection, idle Volumes, unattached Floating IPs and Primary IPs, underutilized Load Balancers, Storage Box consumption, and snapshot accumulation. Use when the user asks to reduce or explain Hetzner Cloud spend.

vincentchuwaichow Bundle

Manage IEF (Intelligent Edge Fabric) edge node lifecycle, edge application deployment as container workloads, IoT device twin management, and cloud-edge-device unified control plane with offline operation support.