DevOps & Infra

vincentchuwaichow Bundle

Govern Huawei Cloud OBS (Object Storage Service) data perimeters — bucket policy and ACL public exposure, Block Public Access configuration, VPC endpoint binding for private access, WORM (Object Lock), cross-region replication compliance, and MLPS 2.0 data residency enforcement.

vincentchuwaichow Bundle

Use this skill to reconcile the Terraform or OpenTofu record with reality without destroying anything: classify drift and decide whether to adopt, revert, or accept it; plan a brownfield import with the right `id`/`identity` addressing and a no-op verification gate; and carry renames or restructures with `moved` and `removed` blocks instead of state surgery. Advisory only — it reads plans and source, never runs `import` or a state command.

vincentchuwaichow Bundle

Use this skill to decide what verification a Terraform or OpenTofu change actually needs and what each option proves: `validate` versus a plan, `terraform test` run blocks with `command = plan` versus `command = apply`, mock providers, and assertions on the properties that would cause an outage. Procedure only — it produces a verification plan, not a pass/fail verdict; the owning agent (`terraform-reviewer` for module contracts, `terraform-plan-blast-radius-agent` for change safety) issues the verdict.

vincentchuwaichow Bundle

Govern Alibaba Cloud Container Registry (ACR) — Enterprise Edition vs Personal Edition selection, image vulnerability scanning, namespace IAM least privilege, image retention policies, cross-region replication, and supply chain security posture.

vincentchuwaichow Bundle

Azure Cosmos DB Application Developer

vincentchuwaichow Bundle

Use this skill to diagnose and design platform reliability using system-table evidence, job and pipeline execution review, cluster policies, instance pools, quota headroom, and disaster-recovery posture: job timeouts and retries, run-history retention, managed DR design, incident-evidence preservation, and quota limits. Reads job and pipeline definitions, cluster policies, system-table schemas, and incident logs; never executes queries or triggers live operations.

vincentchuwaichow Bundle

Assess Huawei Cloud cost efficiency using the Well-Architected Framework Cost Optimization pillar: ECS flavor selection including Kunpeng Arm, Yearly/Monthly vs Pay-Per-Use billing, Spot Instances, Enterprise Project cost attribution, and Cost Center monitoring.

vincentchuwaichow Bundle

Static review flashlight for SuiteCloud Development Framework project structure, deployment controls, and environment promotion governance. Validates manifest.xml completeness, deploy.xml ordering, customrole permission XML against the 684-code SDF catalog, required documentation artifacts, and SuiteScript version gates. TRIGGER when: user asks to review an SDF project, validate a manifest.xml or deploy.xml, check deployment configuration, review environment promotion from sandbox to production, verify SuiteCloud release process, check for SuiteScript 1.0 code before deployment, confirm documentation artifacts are present, or audit SDF customrole permissions in a deployment object. Trigger phrases: sdf project structure, validate manifest xml, deploy xml review, sandbox to production netsuite, suitecloud deployment, sdf customdeploy, netsuite release pipeline, sdf environment promotion, suitescript version gate, architecture md missing. DO NOT TRIGGER when: the question is specifically about role SoD or permi

vincentchuwaichow Bundle

Use this skill to statically review containerized/serverless Python runtime behavior: PID 1 and signal handling, worker/process model, graceful shutdown, read-only-filesystem and cold-start assumptions, and dependency footprint. Reads Dockerfiles, process/server config, and source only; it never builds or runs a container.

vincentchuwaichow Bundle

Generates SOQL queries from natural-language requirements without executing them. T0 generation skill — emits ready-to-paste SOQL with selectivity analysis, governor-limit guidance, and a 100-point quality score. Pairs with salesforce-soql-explorer-skill for live execution. TRIGGER when: user describes a query in plain English, asks for SOQL syntax help, needs an aggregate or relationship query, wants a pipeline hygiene query, needs report-equivalent SOQL. Trigger phrases: "write SOQL for", "how do I query", "give me a SOQL query", "find all opportunities where", "count contacts with", "pipeline by stage SOQL", "stale leads query". DO NOT TRIGGER when: the query needs to be executed live (use salesforce-soql-explorer-skill); when DML is required (T3 — escalate); when the user wants permission-set diagnostic SOQL (specialized form — use salesforce-permission-model-review-skill).

vincentchuwaichow Bundle

Cross-functional coordination protocol governing data privacy, analytics, and AI governance handoffs in SAP landscapes. Covers PII in Datasphere data products, analytics exports from SAP Analytics Cloud, RAG pipelines, embedding generation, prompt logging, SAP Generative AI Hub usage, Joule adoption, and model outputs that could leak sensitive business data. Defines data classification, consent and purpose limitation gates, approval requirements, and audit packaging. Never mutates live systems and never bypasses any guarded-mutating gate.

vincentchuwaichow Bundle

Use this skill to decide whether Terraform or OpenTofu dependencies come from where their authors intended and whether that trust is actually enforced at install time: provider source addresses and namespace lookalikes, `.terraform.lock.hcl` coverage across every platform that runs `init`, the `h1:`/`zh:` hash schemes, mirrors and `dev_overrides` that bypass verification, and module sources pinned to mutable references. Static review of declarations, lock files, and CLI configuration only.

vincentchuwaichow Bundle

Govern Alibaba Cloud OSS data perimeters — bucket ACL and policy conflict resolution, Block Public Access configuration, cross-account access via RAM role, VPC endpoint binding for private access, WORM (Object Lock), and MLPS 2.0 data residency compliance.

vincentchuwaichow Bundle

Investigate Amazon RDS and Aurora-specific incidents involving latency, connection exhaustion, slow queries, lock waits, storage pressure, CPU/I/O saturation, replica lag, failover behavior, Performance Insights, and database capacity. Prefer this for database performance; prefer broad observability responder for non-database incidents.

vincentchuwaichow Bundle

Guard live ARM, Bicep, and Deployment Stack changes with what-if evidence, denySettings review, changeset diff, rollback posture, and approval gates.

vincentchuwaichow Bundle

Azure Resource Health Incident Triage

vincentchuwaichow Bundle

Use this skill to review Databricks account and workspace topology for scalability and Well-Architected alignment: metastore-per-region constraint, workspace segmentation ratios, serverless vs classic placement, catalog organisation, cross-region and cross-organisation access patterns, and platform quota headroom. Reads workspace inventory and compute/metastore assignments only; never accesses live workspaces or requires credentials.

vincentchuwaichow Bundle

Use this skill to verify Structured Streaming query correctness and recovery: state-schema immutability, checkpoint compatibility across restarts, watermark semantics, trigger selection (AvailableNow, Once, ProcessingTime), exactly-once vs at-least-once sinks, foreachBatch idempotency, RocksDB and changelog checkpointing, serverless constraints, and restart/backfill safety. Reads query source, state schema, and checkpoint configuration only; never executes queries and never assumes DBR version features without verification.

vincentchuwaichow Bundle

Guard Hetzner Cloud server creation, destruction, type changes (rescale), and power operations with mandatory server ID, region, explicit human approval, target confirmation, account, and rollback plan. Server deletion is irreversible without a prior snapshot. Use only when live server lifecycle operations are required and all pre-flight checks are confirmed.

vincentchuwaichow Bundle

Plan and execute Huawei DRS (Data Replication Service) migration and real-time sync tasks, CDM (Cloud Data Migration) batch ETL jobs, and DMS (Distributed Message Service) Kafka cluster operations with safe cutover sequencing.

vincentchuwaichow Bundle

Gate Huawei Cloud CBC budget threshold changes, Reserved Instance purchases, and CUD commitments — budget threshold reduction can trigger service suspension and RI/CUD are non-refundable committed spend.

vincentchuwaichow Bundle

Operate Huawei SecMaster (integrated SIEM/SOAR/threat intelligence), HSS (Host Security Service) host intrusion detection, CFW (Cloud Firewall), WAF (Web Application Firewall), Anti-DDoS, and VSS (Vulnerability Scan Service) for comprehensive cloud security operations.

vincentchuwaichow Bundle

Use this skill when reviewing External Secrets Operator (ESO) configuration, including SecretStore, ClusterSecretStore, ExternalSecret, and PushSecret resources. Trigger when a user provides ESO YAML manifests, asks about secret rotation interval compliance, questions whether ClusterSecretStore scope is too broad, or wants to audit the auth method used to reach an external secret store (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault, 1Password).

vincentchuwaichow Bundle

SAP Analytics Cloud Planning Governance Review

vincentchuwaichow Bundle

Deploy and operate Function Compute 3.0, SAE (Serverless App Engine) applications, and EDAS microservice apps. Guide the serverless vs. PaaS vs. container platform choice for each workload type.

vincentchuwaichow Bundle

Audit and govern Alibaba Cloud KMS key lifecycles, Certificate Manager, SSM (Secrets Manager), and HSM key operations. Ensure encryption-at-rest coverage and rotation compliance across CMKs, envelope encryption, and certificate lifecycle.

vincentchuwaichow Bundle

Gate RAM policy/role mutations against the Alibaba Cloud account hierarchy. RAM AdministratorAccess assignment, policy deletion with active STS tokens, and Resource Directory Control Policy changes carry account-wide or org-wide blast radius. This guard enforces blast-radius assessment, STS token impact analysis, and explicit authority approval before any policy mutation is executed.

vincentchuwaichow Bundle

Assess Alibaba Cloud cost posture: ECS instance family rightsizing, Savings Plans and Reserved Instance coverage, Preemptible Instance adoption, cost allocation tagging, OSS storage tiering, analytics pricing, and idle resource elimination.

vincentchuwaichow Bundle

Triage AWS tickets and alerts using priority, owner, evidence, incident context, escalation path, OpsCenter, health signals, and safe next steps. Prefer this for non-destructive request coordination and escalation; prefer deep domain skills for implementation or root-cause investigation.

vincentchuwaichow Bundle

Azure App Service Production Readiness

vincentchuwaichow Bundle

Guard live App Service slot swaps with sticky-settings audit, warmup probe verification, swap-with-preview staging, and instant rollback posture.

vincentchuwaichow Bundle

Guard live permanent Microsoft Entra ID and Azure RBAC role assignments with scope audit, principal-type risk classification, dangerous-role detection, and explicit approval gates before write. Use only when a direct (non-PIM) role assignment is intentionally requested against a confirmed target.

vincentchuwaichow Bundle

Gate BigQuery dataset deletion, table truncation, and authorized view changes against a full downstream dependency audit and export confirmation. Dataset deletion is immediate and permanent with no recycle bin — this guard ensures no dataset is deleted without enumerating all tables, scheduled queries, Data Transfer jobs, Looker connections, and Dataflow pipelines that depend on it.

vincentchuwaichow Bundle

Triage GCP operational alerts, incidents, and support tickets — P0/P1/P2/P3 classification, GCP Premium/Enhanced Support SLA enforcement, war room coordination, evidence collection from Cloud Monitoring and Cloud Logging, and safe escalation paths.

vincentchuwaichow Bundle

Coordinate Huawei Cloud cost anomaly detection — CBC Cost Center delta analysis (>15% day-over-day threshold), budget alert configuration via Budget Management, ECS/GaussDB Yearly/Monthly vs On-Demand mode cost anomalies, OBS request cost spikes, unattached EVS volume waste, DWS idle cluster detection, and reserved instance coverage gaps.

vincentchuwaichow Bundle

Engineer and review Huawei Cloud ELB traffic configurations — dedicated vs shared ELB type selection, HTTP/HTTPS/TCP/UDP protocol listener setup, health check configuration, WAF integration on ELB, backend server group routing, connection draining, and TLS policy enforcement on Dedicated ELB.