DevOps & Infra

ksmaster03 Skill

วางการทดสอบความปลอดภัยแบบอัตโนมัติใน CI/CD (shift-left) — SAST, DAST, SCA (ช่องโหว่ dependency/CVE), secret/IaC/container scanning, ใช้ OWASP ASVS เป็น checklist และ triage finding ด้วย CVSS. Automate security testing across the pipeline (SAST/DAST/SCA/secret/IaC/container), gate by severity, and verify against OWASP ASVS L1–L3. Trigger เมื่อผู้ใช้พิมพ์ /security-testing หรือขอ "security test / SAST / DAST / SCA / dependency scan / secret scan / OWASP / ทดสอบความปลอดภัย / DevSecOps".

uygnoey Bundle

Stand up and operate an agentic on-call first responder that triages CI/CD alerts, opens every incident with an evidence-grounded situation report, and accumulates its own investigation memory. Use when an on-call rotation is dominated by alert triage and after-hours interruptions, when incident knowledge lives only in people's heads, or when merge volume has outgrown a human-paced CI process.

uygnoey Skill

Delegates research, parallel edits, or fresh-eyes reviews to subagents (separate AI instances with isolated context) in Claude Code. Use when a task requires reading 10+ files, has 3+ independent subtasks, needs a second opinion before commit, or a complex pipeline like design-then-implement-then-test. Covers four invocation methods (conversational, custom agent file, project policy, slash command skill), four practical patterns, and when NOT to use subagents.

uygnoey Bundle

Redesign a software development lifecycle around agentic coding — six stages (Plan, Design, Build, Test, Deploy, Maintain) that each end by committing a version-controlled artifact the next stage reads. Use when agentic coding has made the build phase fast but planning, review, testing, and deployment still run at human speed; when review queues or security sign-off have become the bottleneck; when deciding which SDLC stage to transform first and in what order; when encoding policy as skills, hooks, and managed settings instead of enforcing it in review meetings; or when closing the loop so production signals write the next intent.md without a person in the invocation path. Covers the intent.md / spec.md / plan.md artifact chain, plan mode and auto mode, parallel worktree sessions and subagents, feedback loops and continuous evals, dual-direction PR review, approval-gate hooks, and per-stage leading and lagging indicators.

jihedbfr-art Bundle

Use when checking AWS S3 (or S3-compatible) buckets for public read/write exposure — the classic cloud data leak — and locking them down.

jihedbfr-art Bundle

Use when managing encryption keys and secrets in the cloud — key policies, envelope encryption, and secret stores — so encrypted data and stored credentials stay actually protected.

jihedbfr-art Bundle

Use when responding to an incident in a cloud environment where there's no server to unplug — the API-driven, identity-centric response that differs from on-prem IR.

jihedbfr-art Bundle

Use when securing CI/CD build runners — especially self-hosted ones that persist state and run untrusted code, closing a common foothold into the build environment.

jihedbfr-art Bundle

Use when codifying security gates so they can't be skipped — expressing policy as versioned, testable code enforced automatically in the pipeline instead of relying on manual review.

jihedbfr-art Bundle

Use when tying an organisation's IP ranges back to it — mapping ASNs, netblocks, and cloud allocations so you know the full IP footprint that belongs to the target.

jihedbfr-art Bundle

Use when setting up or reviewing cloud audit logging — making sure API activity is recorded, protected from tampering, and actually usable during an investigation.

jihedbfr-art Bundle

Use when wiring static application security testing into the pipeline — catching code vulnerabilities on every build without drowning developers in false positives.

jihedbfr-art Bundle

Use when you need to map an organisation's subdomains to find hosts and services outside the obvious www — the first recon step that feeds web, API, and cloud testing.

jihedbfr-art Bundle

Use when securing the CI/CD pipeline itself — least-privilege runners, pinned actions, protected branches, and the controls that stop the pipeline from becoming an attack path to production.

jihedbfr-art Bundle

Use when ensuring build artifacts aren't tampered with between build and deploy — signing outputs and verifying them before deployment so only trusted builds run.

jihedbfr-art Bundle

Use when attesting where and how software was built — generating build provenance so consumers can verify an artifact came from the expected source and pipeline, uncompromised.

jihedbfr-art Bundle

Use when designing the pipeline that gets logs into a SIEM — collection, parsing, and normalisation so the right data arrives usable, because everything downstream depends on it.

jihedbfr-art Bundle

Use when segmenting pod-to-pod traffic in Kubernetes — applying network policies to default-deny east-west traffic so a compromised pod can't reach everything in the cluster.

jihedbfr-art Bundle

Use when enforcing security policy at deploy time in Kubernetes — admission controllers (OPA/Kyverno) that reject non-compliant resources before they run, gating the cluster.

jihedbfr-art Bundle

Use when writing or reviewing a Dockerfile for security — non-root users, minimal base images, no secrets in layers, and the build practices that shrink the attack surface.

jihedbfr-art Bundle

Use when auditing Kubernetes RBAC for over-permissive roles and bindings — the excessive permissions that let a compromised workload or user take over the cluster.

jihedbfr-art Bundle

Use when handling secrets in Kubernetes — stopping the plaintext, over-exposed secrets that leak credentials, and using proper secret management with encryption and access control.

jihedbfr-art Bundle

Use when enforcing secure pod configurations in Kubernetes — the Pod Security Standards that stop privileged, host-accessing pods that lead to container escape and node compromise.

jihedbfr-art Bundle

Use when securing the container image supply chain — signing and verifying images so only trusted, unmodified images run, closing the gap between building and deploying.

jihedbfr-art Bundle

Use when you need to check a container image for known vulnerabilities, exposed secrets, and bad practice before it ships — and how to keep the results actionable.

jihedbfr-art Bundle

Use when assessing how a compromised container could break out to the host — the privileged, host-mount, and capability misconfigurations that turn a container compromise into node compromise.

jihedbfr-art Bundle

Use when detecting malicious behaviour in running containers — the runtime monitoring that catches escapes, crypto-mining, and anomalous activity that build-time controls can't.

gl0di Bundle

Fetches a remote resource via a shell pipeline. Declares no allowed-tools/tools manifest at all.

gl0di Bundle

Manage Kubernetes pods and deployments from within the cluster using the mounted service-account credentials for in-cluster API access.

gl0di Skill

Report which cloud region this machine is running in.

uygnoey Bundle

Design and deploy routines in Claude Code — automations bundling a prompt, repo, and connectors that run on a schedule, via an API call, or in response to GitHub events. Covers trigger selection, prompt shape, and common patterns from the research preview announcement.

uygnoey Bundle

Evaluate and plan how to access Anthropic's platform through AWS entry points (IAM, billing, and CloudTrail), and document the key differences versus Claude on Amazon Bedrock.

uygnoey Bundle

Stand up a commerce agent from Anthropic's open blueprint, which ships reference implementations of a shopping agent and a merchant agent with examples across retail, travel, telecom and ticketing. Covers what the blueprint contains, the integration points each agent needs, the guardrails that ship with it, and where the deployment can run - the Claude API, Amazon Bedrock, Microsoft Foundry, or Google Cloud Vertex AI. Use when starting a commerce agent project, or when scoping what a shopping or merchant agent will need from your existing systems.

uygnoey Skill

Enables delegating well-defined coding tasks to a cloud sandbox from a web browser (useful for bug backlogs, routine fixes, and parallel coding work). Trigger when the user asks to connect a GitHub repo and have Claude implement changes without using a local terminal.

uygnoey Bundle

Adopt the four capabilities Anthropic shipped to Claude Managed Agents at Code w/ Claude SF 2026 — Dreaming (scheduled memory curation from past sessions), Multiagent orchestration (a lead agent delegating to parallel specialist subagents on a shared filesystem), Outcomes (a separate grader scoring each result against a developer-defined rubric until the bar is met), and Webhooks (async completion notification). Use when a team building on Claude Managed Agents needs to decide which of these to turn on, in what order, and how they fit a production pipeline.

uygnoey Bundle

Plan and roll out Claude Code via a self-hosted apps gateway, using centralized SSO login, managed settings enforcement, and per-user usage attribution when running on Amazon Bedrock or Google Cloud.