DevOps & Infra

delorenj Bundle

Builds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail, and ADOT (AWS Distro for OpenTelemetry), AND enables/onboards services to Application Signals using ADOT auto-instrumentation SDKs. Covers Log Insights queries, alarms (metric, composite, anomaly), dashboards, custom metrics/EMF, X-Ray tracing and sampling, ADOT collector config, CloudTrail auditing, and end-to-end Application Signals enablement via ADOT SDKs (CloudWatch Observability EKS add-on, CloudWatch Agent IAM, OTLP endpoints, ServiceEvents, Dynamic Instrumentation), breakpoint and snapshot in Dynamic Instrumentation, live data capture in running service, debug without redeploying. Applies to CloudWatch, alarms, dashboards, EMF, X-Ray, traces, CloudTrail, ADOT, monitoring, synthetics/canaries, OR enabling/onboarding/instrumenting a service for Application Signals. Not for app logging or security threat detection.

dykyi-roman Skill

Analyzes PHP code for SSRF vulnerabilities. Detects unvalidated URLs, internal network access, DNS rebinding, cloud metadata access, URL parsing bypass attempts.

kevinnft Bundle

Generate architecture diagrams with draw.io in headless/server environments (WSL2, VPS, Docker)

kevinnft Skill

Run 150+ AI applications in the cloud via the inference.sh platform. Triggers on "generate image with FLUX", "create video", "use Veo/Seedance", "run inference.sh", "infsh CLI", "single key for image+video+LLM". One API key covers image generation (FLUX, Reve, Seedream, Grok, Gemini), video (Veo, Wan, Seedance, OmniHuman, HunyuanVideo), LLMs (Claude, Gemini, Kimi, GLM-4), search (Tavily, Exa), 3D (Rodin), social (Twitter/X), and audio (TTS, voice cloning).

delorenj Bundle

Gets AWS credentials for CLI/SDK access via `aws login`. Activates when a developer needs to authenticate to AWS for local development, when an AWS operation fails due to missing or expired credentials, or when someone asks about setting up AWS access. Triggers: "set up AWS", "configure AWS", "aws login", "get credentials", "authenticate", "session expired", "token expired", "no credentials", "AccessDeniedException" with no configured credentials.

delorenj Bundle

Author, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation.

delorenj Bundle

Diagnose and clean up the big-chungus home server. Finds what is killing processes or containers, attributes crash loops, kill loops, healthcheck storms, OOM, swap pressure, and docker bloat, then fixes and prunes safely. Use when the user says "what is killing my server", "server is slow", "server locked up", "server is dying", "high load", "what's eating CPU", "what's eating memory", "spring cleaning", "maintenance sweep", "cleanup the server", "docker cleanup", "too many containers", "disk full", "prune docker", or asks why a unit/container keeps restarting, who restarted X, or why load spiked. Built around scripts/sweep.sh (one-shot evidence report), references/server-map.md (system baselines), and references/forensics-playbook.md (attribution patterns); uses srvls, systemd, journalctl, docker, Prometheus, hindsight. Do NOT use for debugging one project's application code, provisioning new services or stacks (use delonet-conventions), or Cloudflare/network routing issues.

jacob-balslev Skill

Use when reviewing code for security vulnerabilities, threat-modelling a new feature, implementing authentication or authorization, handling user input, hardening dependencies or CI/CD against software-supply-chain compromise, or auditing a codebase against the current OWASP Top 10 (2025, with the 2021 mapping retained). Covers broken access control (incl. SSRF), security misconfiguration, software supply chain failures, cryptographic failures, injection (SQL, NoSQL, command, LDAP, XSS), insecure design, authentication failures, software/data integrity failures, security logging and alerting failures, and mishandling of exceptional conditions (fail-open error paths, error leakage). Do NOT use for general code review (use `code-review` for the holistic per-PR pass), for chasing a known production bug (use `debugging`), for defending an LLM against prompt/RAG injection or agent-tool-authority abuse (use `prompt-injection-defense`), or for writing a security policy doc (use `documentation`).

delorenj Bundle

AWS SDK for JavaScript v3 development patterns. Use when writing JavaScript or TypeScript code that uses AWS services via @aws-sdk/* packages (aws-sdk-js-v3), or when asked about schemas, runtime validation, serialization, or code generation in the context of the JS/TS AWS SDK.

delorenj Bundle

AWS SDK for Swift development patterns. Use when writing Swift code that uses AWS services via aws-sdk-swift package.

delorenj Bundle

AWS SDK for Python (boto3/botocore) development patterns. You MUST use this skill when writing Python code that uses AWS services via boto3 or botocore. This includes creating service clients or resources, configuring sessions and credentials, handling errors with ClientError, using paginators and waiters, S3 file transfers and presigned URLs, DynamoDB table operations, and any boto3/botocore client configuration. Use this skill whenever Python code imports boto3 or botocore, or when the user asks about AWS operations in Python.

dykyi-roman Skill

Analyzes CI/CD pipeline logs to identify failure causes. Parses error messages, detects common failure patterns, and provides fix recommendations.

dykyi-roman Bundle

Generates minimal, safe fixes for CI configuration issues. Provides fix templates for dependency, test, lint, infrastructure, Docker, and timeout failures.

jacob-balslev Skill

Use when designing or maintaining the shape of a repository's git history — choosing a branching model, deciding rebase vs merge, sizing commits, linking commits to tracker tickets, tagging releases, running parallel work across worktrees, and resolving the merge conflicts that arise from any of the above. Covers trunk-based development, short-lived feature branches, atomic commit discipline, linear-history conventions (rebase + squash), release tagging with annotated tags and SemVer, hotfix flows from tags, and worktree lifecycle for parallel agents or contributors. Do NOT use for the words inside the commit message (Conventional Commits format, identifier naming — use `naming-conventions`), for chasing a release-pipeline failure (use `debugging`), or for reviewing a PR's content (use `code-review`). Do NOT use for draft a Conventional Commits message for this change. Do NOT use for the release pipeline failed at the tag-creation step — find out why. Do NOT use for review this PR before we merge it.

jacob-balslev Skill

Use when reasoning about how a database schema changes over time without breaking deployed application code — the multi-release path from current to target schema: the expand/contract pattern (parallel change), zero-downtime change rules, the backwards/forwards compatibility envelope (deploy ordering + rollback), the catalog of schema changes (add/drop/rename column, type change, add constraint/index) and the safe procedure for each, dual-write/dual-read transitions with a named source-of-truth, the lock-acquisition hazard (bounded lock_timeout + retry), cross-engine online-change mechanisms (Postgres CONCURRENTLY/NOT VALID, MySQL Online DDL, gh-ost/pt-osc, Vitess/PlanetScale), view-based multi-version tooling (pgroll, Reshape), and migration-lint enforcement (Strong Migrations, Squawk, Atlas). Do NOT use for executing one migration (use database-migration), schema design from scratch (use data-modeling), query tuning (use query-optimization), or partitioning (use sharding-strategy).

delorenj Bundle

Operate the merged DeLoNET Daily Report — one deterministic pipeline that writes the daily developer journal from the Candystore audit trail and git history, plus Hermes fleet health, nightly PR maintenance from pr-crusher state, and a report-delivery self-check that catches its own missed runs. Deterministic local collectors emit schema-validated SectionArtifacts with honest complete/partial/stale/failed status, a manifest enumerated from config (never from disk), one bounded LLM narration pass, and atomic immutable archive generations behind a current.json pointer. Use for reportctl, `reportctl verify`, daily journal or daily report work, section/collector configuration, coverage and freshness, stale or missing sections, archive publication, and diagnosing a report that silently did not run. Replaces the retired candystore-daily-journal skill. Do not use for Hermes fleet provisioning, Bloodbank schema changes, external news reporting, or general cron administration.

delorenj Bundle

Build reusable directional-feedback loops for any creative/agentic pipeline. Use when replacing binary thumbs-up/down with structured critique vectors (more/less/avoid/replace), compiling feedback into weight adjustments, ranking candidates with those vectors, and iteratively improving outputs with deterministic artifacts.

kevinnft Skill

Prepares production launches. Use when preparing to deploy to production. Use when you need a pre-launch checklist, when setting up monitoring, when planning a staged rollout, or when you need a rollback strategy.

kevinnft Skill

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

kevinnft Bundle

Use cloud browser services (Browserbase) for Cloudflare bypass, JavaScript rendering, and stealth scraping when local tools fail

dykyi-roman Bundle

Docker knowledge base for PHP projects. Provides patterns, best practices, and guidelines for Dockerfile, Compose, security, and production readiness.

delorenj Bundle

Diagnose and repair the HeyMa audio pipeline (Wax): recording, ingest, transcription, diarization, enrichment passes, S3/MinIO archive, Bloodbank events, the tray, and the wax CLI. Use whenever a recording did not become a finished transcript, transcripts keep bare timestamp filenames instead of summary slugs, speakers are not labelled, the tray looks fine but nothing is happening, waxd seems wedged, audio is missing, or any wax command misbehaves. Also use before changing anything in components/wax so you start from a known state. Triggers: pipeline broken, transcription not running, no diarization, no speaker labels, enrichment pass failed, title-slug failed, filenames not renamed, wax status, waxd, tray green but broken, silent failure, transcript missing, audio not archived, MinIO/S3 archive, outbox stuck, wax doctor. Do NOT use for authoring a NEW enrichment pass (use create-enrichment-pass), for Bloodbank schema/event-contract work (use bloodbank-integration), or for non-HeyMa repos.

delorenj Bundle

Keep the self-hosted Hindsight memory system healthy across all banks on a schedule. Runs three families of upkeep workflows — tune-up (system health: reap orphaned/stuck async jobs, repair missing public.* maintenance functions, clear failed operations, flag per-bank anomalies), optimization (prune stale/low-value memories, trigger consolidation, cross-bank pollination, novel synthesis of emergent insights), and karpathy-wiki (nightly compile of newly-retained memories into a Karpathy LLM wiki). Use when scheduling or running Hindsight memory upkeep — "nightly/weekly memory maintenance", "prune memory", "consolidate banks", "memory wiki", "hindsight health check", "dead/stuck jobs", "reap orphans", "queue is stuck", "cross-bank synthesis", or wiring cron/systemd timers for memory maintenance. Do NOT use for one-off recall/retain during normal work (use the hindsight skill), for infra-level debugging of the Hindsight container/host (use server-maintenance), or for non-Hindsight datastores.

delorenj Bundle

Operate and maintain the Hermes fleet: shared config/registry/install, PM template and deploy contract, real named profiles with generated base-plus-delta config, ignored local runtime, systemd units, fleet self-checks/backfills, credential migration, transactional config recovery, and TTS defaults. Use for Hermes fleet updates, `~/.hermes/*`, `hermes-agent-template`, PM deployment verification, generated profiles, gateway/heartbeat state, fleet audits, MCP drift, template propagation, or voice changes. Do NOT use for project bootstrap/identity requests (→ 33god-projects), Plane ticket operations (→ project-lifecycle), Bloodbank event schemas (→ bloodbank-integration), or generic config fan-out (→ agent-config-fanout).

jacob-balslev Skill

Use when observing representative real users attempting realistic tasks on a prototype or live product to surface usability issues: moderated or unmoderated, remote or in-person, concurrent or retrospective think-aloud, task scenarios, participant screening, tree/first-click testing for IA findability questions, pilot runs, severity rating, sample sizing by claim type, and ethical recording/consent. Do NOT use for automated test suites, code coverage, CI pipelines, unit/integration testing, load testing, or replacing participants with AI/synthetic users; those are engineering verification or synthetic-analysis concerns, not human-behavior observation. Do NOT use for Add unit tests for the order-total calculation function. Do NOT use for Set up the CI pipeline for the new repo. Do NOT use for Run a load test against the checkout API. Do NOT use for Run a card sort to design the navigation hierarchy and labels for this site. Do NOT use for Cluster the findings from ten completed user sessions into themes.

dykyi-roman Skill

Analyzes existing CI/CD configurations. Detects issues in GitHub Actions and GitLab CI files, checks for best practices, caching efficiency, and security concerns.

delorenj Bundle

Enrich a markdown file's YAML frontmatter — stamp the repo's base schema, then fill context-aware values (incl. why the file exists / its role in the plan) interpolated from the driving agent's memory. Pipeline link #3, after folder-triage (type) and domain-triage (entity). Uses the `frontmatters` CLI (`apply-base`, `set`, `validate`) as the editor and the repo's Hermes PM memory + Hindsight bank as the context source — no new agent. Base schema is declared per-repo (vault `frontmatter-category-map.json`, a `.curator/taxonomy.yaml` frontmatter block, or a base.yaml). Use when applying base frontmatter, backfilling missing metadata, setting frontmatter key=values, writing context-aware tags/summary/why-created, or validating frontmatter against a schema. Do NOT use for type classification (folder-curator), entity detection/routing (domain-triage), memory mechanics (hindsight), or authoring schemas themselves. Biases: apply base first, never clobber, preserve key order, memory-informed values over guesses.

delorenj Bundle

Author custom starship prompt modules ([custom.NAME] blocks in starship.toml) for outside-the-box prompt segments beyond starship's built-in modules. Use when adding a custom prompt segment that runs a shell command, conditionally appears in specific dirs, or surfaces git/env/API/file state. Covers detect_files, detect_folders, detect_extensions, when conditions, shell selection (sh/bash/zsh/pwsh/nushell), require_repo, format/style strings, and a recipe cookbook (k8s context in helm dirs, AWS profile, weather, AI usage cost, now-playing, build status, branch staleness, Tailscale, package.json scripts, deployment env). Triggers on "starship custom module", "custom starship prompt", "starship.toml [custom.", "make my prompt show X", "outside-the-box prompt segment", "creative starship module". Do NOT use for built-in starship module config (see starship.rs/config), powerlevel10k / oh-my-zsh / pure / spaceship, generic shell config, or starship install.

delorenj Bundle

Architecture principles and the custom-node catalog for building n8n workflows on DeLoNET/33GOD. Use when creating, reviewing, or refactoring ANY n8n workflow for the pipeline — including the canonical signed Plane webhook ingress — deciding node boundaries (atomic single-responsibility nodes vs a god-node executeCommand/localFileTrigger shell script), emitting pipeline lifecycle events to Bloodbank instead of ad-hoc ntfy, choosing community vs custom nodes, packaging custom nodes as n8n-nodes-* micro-packages, rebuilding the inbox/transcribe pipeline, or applying n8n instance conventions (PM2 :5678, raw-body HMAC, per-webhook secret selection, availableInMCP, archive-outside-watch-root, direct API PUT for tags/description). Do NOT use for whether-to-use-n8n-vs-bloodbank routing (delonet-workflow-router), the event schema/envelope contract itself (bloodbank-integration), or infra paths/containers/creds (delonet-conventions).

jacob-balslev Skill

Use when designing a color system — palette construction, semantic color tokens, WCAG contrast pairings, perceptual scale generation in OKLCH/LCH/HCT, wide-gamut fallbacks, and light/dark/high-contrast parity. Do NOT use for single brand-color picks, runtime theme-switching mechanics, token delivery architecture, or non-color design tokens. Do NOT use for Pick the brand's primary color from scratch with no system constraints. Do NOT use for Implement prefers-color-scheme detection, localStorage persistence, and anti-flash script. Do NOT use for Design the full DTCG token build pipeline for all token categories. Do NOT use for Choose spacing values for the layout grid. Do NOT use for the palette, the scale construction, the semantic color roles, and the contrast pairings against every surface (use dark-mode-implementation).

jacob-balslev Skill

Use when designing what information reaches an LLM agent before it reasons — system prompt, persistent memory, always-loaded rules, injected skills, and the user prompt — or when diagnosing why an agent produced a wrong answer despite a clear instruction. Covers the four context failure modes (missing, stale, wrong, overwhelming), the five-layer context stack, four context quality metrics (injection precision and recall, utilization, freshness), the Frequent Intentional Compaction (FIC) protocol, subagent delegation for context-heavy work, and the failure-mode decision tree. Do NOT use for prompt wording (use `prompt-craft`), authoring a new SKILL.md (use `skill-scaffold`), or deciding which skill the router activates for a given query (use `skill-router`). Do NOT use for improve this prompt's wording to get better outputs. Do NOT use for scaffold a new SKILL.md for our team's deploy procedure. Do NOT use for the router picked the wrong skill for this query — debug it.

delorenj Bundle

Guides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK). Use when reasoning about messaging and streaming patterns. In general, use specific skills or documentation searches for detailed service-specific questions. Do NOT use for MSK or Managed Service for Apache Flink questions, prefer specific skills.

delorenj Bundle

Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer, look up service pricing, query CUR with Athena, detect cost anomalies, scope costs to billing views, and monitor Free Tier usage. Triggers on: AWS bill, cost analysis, reduce spend, savings plan, reserved instance, right-size, budget alert, cost optimization, pricing, free tier, cost anomaly, CUR, cost audit, billing view, billing view ARN.

delorenj Bundle

Use this skill when installing applications, packages, tools, or services on the system. Handles Python (uv), Node/JS/TS (bun), Docker containers, and GitHub-sourced installations with mise-managed tools and ecosystem integration patterns.

dykyi-roman Skill

Detects secrets and credentials in Docker configuration. Scans Dockerfile, Compose, and .env files for exposed passwords, tokens, and keys.

dykyi-roman Skill

Checks Docker security for PHP projects. Detects root user, exposed secrets, privileged mode, and missing security configurations.