DevOps & Infra

h3y6e Bundle

Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or deploying alerting policies to monitor agent latency, error rates, token usage, and quality metrics. Don't use for standard infrastructure monitoring unrelated to AI agents, or when the agent is not instrumented with OpenTelemetry (for Reliability, Cost, Safety, Security alerts). NOTE: Reliability, Cost, Safety, and Security alerts use generic OTel metrics and work across runtimes (such as Cloud Run, Vertex AI). Quality alerts rely on Vertex AI Online Monitors and are strictly bound to Vertex AI deployments.

h3y6e Skill

Generates cost optimization guidance for Google Cloud workloads based on the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate a workload, identify cost requirements and constraints, and provide actionable recommendations for build, deploy, and manage the workload cost-efficiently in Google Cloud.

h3y6e Skill

Guides agents and users through migrating from Gemini API in Google AI Studio to Gemini Enterprise Agent Platform (formerly Vertex AI). Use this skill when moving applications to Google Cloud, to leverage Cloud credits, or to unify inferencing with other Cloud infrastructure (IAM, billing, telemetry).

h3y6e Bundle

Investigates Google Cloud networking issues by analyzing logs, metrics, and diagnostics. Use when investigating VPC Flow Logs (including cost estimation), NAT, firewall, or threat logs, querying latency and throughput metrics, or running Connectivity Tests for path diagnostics. Don't use for generic VM management or non-observability tasks.

h3y6e Bundle

Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects, billing association, and centralized logging and monitoring. Deploys Google Cloud's recommended security controls and architecture. Use when setting up a new Google Cloud Organization or establishing a secure, enterprise-grade landing zone foundation. Don't use for individual project onboarding (use google-cloud-recipe-onboarding or product-specific skills instead).

h3y6e Skill

Generates operations-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Operational Excellence pillar of the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate a workload, identify operational requirements, and provide actionable recommendations for deployment, monitoring, and incident management.

h3y6e Skill

Generates performance-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Performance Optimization pillar of the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate a workload, identify performance requirements, and provide actionable recommendations for resource allocation, modular design, and elasticity.

aeondave Skill

scikit-learn model inspection workflow for loading persisted estimators, pipelines, and tree models. Use when you need to inspect `joblib` or pickle-based model artifacts, view parameters, feature names, importances, or pipeline structure, or run lightweight predictions for analysis.

aeondave Bundle

Build, review, debug, and scaffold professional Arduino projects across classic AVR boards (`Uno`, `Nano`, `Mega`), Renesas-based R4 boards (`Uno R4 Minima`, `Uno R4 WiFi`, `Nano R4`), ESP32-based Arduino boards, and other common Arduino-family targets. Use when asked for sketches, `.ino` files, Arduino IDE 2, Arduino CLI, PlatformIO, or Arduino Cloud workflows, board-specific pin maps, wiring/BOM notes, unit tests, debug plans, upload/serial monitor troubleshooting, or refactors that must stay practical on real hardware.

aeondave Bundle

Lab/CTF: cloud security challenges; AWS/GCP/Azure creds, buckets, IAM, metadata, KMS/secrets, snapshots, object versions, identity chains.

aeondave Bundle

Lab/CTF: OSINT challenges; people/usernames/email, domains/infra, images/video/geolocation, DNS/archive/social/public records.

aeondave Skill

Auth/lab ref: ProjectDiscovery tool for mapping IP ranges from ASN data. For passive recon to discover the full IP space owned by a target organization before port sweeping, and to identify cloud vs.

aeondave Skill

Auth/lab ref: modular AWS exploitation framework for authorized cloud assessments.

aeondave Bundle

Auth assessment: cloud security methodology; AWS/Azure/GCP IAM, storage, metadata, containers, serverless, workload identity, evidence routing.

tibursocampos Bundle

Write multi-stage Dockerfiles, .dockerignore, and docker-compose for local dev. Use when dockerizing a project or invoking /containerize.

tibursocampos Bundle

Scaffold a message consumer in a .NET workspace (MassTransit, RabbitMQ, Azure Service Bus when detected, or similar). Collects requirements first. Use when creating a consumer or invoking /scaffold-message-handler.

ngocsangyem Bundle

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review".

ngocsangyem Bundle

Diagnoses and fixes bugs, type errors, lint failures, CI/CD issues, and runtime errors via root-cause-first investigation. Use for defect remediation. NOT for investigation without a fix (see mk:investigate); NOT for build-only compilation errors (see mk:build-fix).

ngocsangyem Bundle

Orchestrates single-task implementation pipeline: plan → test → build → review. Shipping is an explicit follow-up. Use for feature work, plan execution, or fixes scoped to a single task. NOT for green-field product builds (see mk:autobuild); NOT for auto-invoked workflow orchestration (see mk:workflow-orchestrator).

ngocsangyem Bundle

Ship workflow with explicit scopes: prepare stages and commits locally; release pushes and creates a PR; publish manages issues and versioning. Use when asked to "ship", "deploy", "push to main", "create a PR", or "merge and push". Proactively suggest when the user says code is ready or asks about deploying. Supports official (→ main) and beta (→ dev/develop) ship modes with auto-detection.

ngocsangyem Bundle

Plan and implement infrastructure, containers, CI/CD, deployment safety, observability, and rollback changes. Use for Docker, IaC, cloud runtime, Kubernetes, pipeline, deployment, or operational reliability work. Does not read dotenv files or approve/release deployments.

ngocsangyem Bundle

Use when creating a new project from scratch — orchestrates the full journey from idea to running code. Research → design → plan → scaffold → implement → docs. Explicit invocation only — never auto-activates. CLI = project infrastructure (.claude/), bootstrap = application code + full pipeline. NOT for autonomous multi-hour builds of specified products (see mk:autobuild); NOT for single-task feature work on existing projects (see mk:cook).

ngocsangyem Bundle

Routing skill — recommends the correct mk:confluence-* leaf for any Confluence Cloud task. Triggers: 'confluence', 'wiki page', 'spec page', ambiguous Confluence intent. NOT an executor — every actual operation forks via a leaf skill.

ngocsangyem Bundle

Browser automation CLI for AI agents using agent-browser. Use for navigating websites, clicking/filling pages, screenshots, data extraction, web app testing, exploratory QA, dogfooding, Electron apps, Slack automation, Vercel Sandbox browser runs, AWS AgentCore cloud browsers, auth-heavy flows, and long autonomous browser sessions. Prefer over generic browser tools when a fresh/tool-managed Chrome session is fine. NOT for the user's real Chrome cookies/profile (see mk:chrome-profile); NOT for reusable Playwright specs (see mk:qa-manual).

ngocsangyem Skill

Resolve an in-progress git merge or rebase conflict end to end: read the conflict state, recover each side's original intent, resolve every hunk, run the project's checks, and prepare the merge/rebase for an explicitly approved finish. Use when asked to "resolve merge conflicts", "fix this rebase", "finish the merge", or when `git status` shows conflicted (unmerged) paths. NOT for the full ship pipeline that merges the base branch first (see mk:ship); NOT for debugging a runtime bug or test failure unrelated to a conflict (see mk:investigate / mk:fix).

odjaramillo Skill

Automate GitHub workflows with AI assistance. Includes PR reviews, issue triage, CI/CD integration, and Git operations. Use when automating GitHub workflows, setting up PR review automation, creating GitHub Actions, or triaging issues.

odjaramillo Skill

Docker containerization expert with deep knowledge of multi-stage builds, image optimization, container security, Docker Compose orchestration, and production deployment patterns. Use PROACTIVELY for Dockerfile optimization, container issues, image size problems, security hardening, networking, and orchestration challenges.

purpleailab Bundle

Drive Decepticon — an autonomous multi-agent red-team framework — over MCP to run authorized penetration tests and bug-bounty engagements end to end, then watch and steer them live from chat. Launch an engagement against a target, poll its transcript to narrate progress, send messages to refocus it, and pull findings as SARIF. Use when the user asks to run a pentest/red-team engagement, hunt a bug bounty, do recon, exploit/scan a host, web app, API, network, cloud, Active Directory, mobile app, or smart contract WITH Decepticon — or to check/resume a running engagement or report what Decepticon found. Triggers: run a decepticon engagement, pentest this with decepticon, bug bounty, recon this target, red team this, scan this host, resume the engagement, what did decepticon find, decepticon status. Do NOT use for ad-hoc local tool runs (running nmap/sqlmap/ffuf directly) when no Decepticon server is involved — this drives the Decepticon orchestrator, not raw tools.

purpleailab Skill

Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.

purpleailab Skill

Five-stage modular vulnerability pipeline orchestrator. Delegates scan → detect → verify → patch → exploit through OPPLAN objectives. Load at orchestrator startup.

purpleailab Skill

Anti-bot evasion, proxy rotation, credential retrieval from password managers, and stealth HTTP tooling for covert web operations.

purpleailab Skill

Hunt Server-Side Request Forgery (CWE-918) through taint analysis from user-controlled URLs to HTTP client sinks. Covers cloud metadata pivoting, DNS rebinding, gopher smuggling, and the IMDSv1 → IAM role chain that turns SSRF into RCE.

purpleailab Skill

CI/CD pipeline attack category — poisoned pipeline execution, GitHub Actions expression injection, self-hosted runner abuse, secrets/OIDC exfil. Routing skill: fingerprint the CI provider + workflow surface, then load the matching leaf.

purpleailab Skill

Container / Kubernetes attack category — pod escape, RBAC abuse, runtime CVE exploitation, socket-mount escape. Routing skill: identify the surface (pod-internal RCE vs API-level vs build-pipeline), then load the matching sub-skill.

purpleailab Skill

Kubernetes attack playbook — service-account token theft, RBAC abuse, pod escape, hostPath mount abuse, kube-api-server pivoting.

purpleailab Skill

Pivot from SSRF or RCE to cloud Instance Metadata Service (IMDS) — extract IAM role creds, instance identity, user-data secrets.