VincentChuWaiChow

@vincentchuwaichow source repo

760 skills
0 followers
1 day ago last updated

▌
Snowflake Compliance Evidence Auditor · vincentchuwaichow bundle
Use this skill to establish whether a Snowflake control is provable to an auditor: evidence collection from ACCESS_HISTORY, LOGIN_HISTORY, grant history and Trust Center, control mapping with named gaps, audit-period coverage, evidence freshness and retention limits, and segregation-of-duties analysis derived from the grant graph. Trigger when the question is proof rather than configuration. It never implements a control and never states a compliance conclusion.

0
installs
▌
Typescript Runtime Boundary Contract · vincentchuwaichow bundle
Use this skill to statically review whether every value entering a TypeScript program from outside it — HTTP, queue, environment/configuration, database reads, third-party SDKs, webhooks, `JSON.parse`, files, and agent/tool calls — is parsed against a schema rather than asserted. Covers `unknown`-first ingestion, schema/type single-source-of-truth, generated-type drift, and validation error leakage. Reads source and sanitized configuration/schema files only; it never designs a validator in the abstract and never contacts a live system.

0
installs
▌
Typescript Static Enforcement Policy · vincentchuwaichow bundle
Use this skill to statically review TypeScript static-enforcement policy: strict-family flag policy and silent loosening across a program graph (strict defaults true since TypeScript 6.0), per-package divergence, typed-lint rule selection and Project Service configuration, editor-versus-CI parity, `@ts-ignore`/`@ts-expect-error`/lint-disable suppression policy, lint-versus-typecheck duplication, and the typescript-eslint supported-version window. Reads configuration and lint config only; it never runs the linter or the compiler.

0
installs
▌
Alibaba Event Driven Architecture Review · vincentchuwaichow bundle
Review Alibaba Cloud EventBridge, MNS (Message Notification Service), RocketMQ, and MSE event-driven designs — dead-letter queues, message ordering, idempotency, retry storm prevention, schema registry, and consumer group lag monitoring.

0
installs
▌
Alibaba Observability Incident Responder · vincentchuwaichow bundle
Respond to Alibaba Cloud incidents using CloudMonitor alarms, SLS log analytics, ARMS APM distributed tracing, and alert governance for ECS, RDS, ACK, and network services.

0
installs
▌
Argo Rollouts Progressive Delivery Review · vincentchuwaichow bundle
Use this skill when reviewing Argo Rollouts progressive delivery configuration. Trigger when the user asks about canary or blue-green Rollout strategy correctness, AnalysisTemplate success/failure conditions, traffic weighting provider alignment, canaryService isolation, PDB deadlock risk with Rollout maxSurge settings, automated rollback posture, or manual vs automated promotion configuration.

0
installs
▌
Audit Evidence Mapping Protocol · vincentchuwaichow bundle
Use this skill when compliance controls must be mapped to audit evidence, when evidence collection, retention policy, and legal-hold status need to be assessed across Microsoft 365 workloads, or when an attestation package must be assembled for an auditor or regulator. Defines the end-to-end flow from control identification through evidence discovery, gap analysis, retention verification, legal-hold confirmation, and attestation sign-off. Does not serve as an authorization to release evidence to external parties; that requires a human compliance or legal owner. Does not replace qualified legal or audit counsel.

0
installs
▌
Copilot Data Readiness Protocol · vincentchuwaichow bundle
Copilot Data Readiness Protocol

0
installs
▌
Databricks Data Quality Observability · vincentchuwaichow bundle
Use this skill to design and verify data quality expectations, table constraints, Lakehouse Monitoring, freshness detection, event-log interrogation, quality SLAs, and downstream quality signaling for Lakeflow pipelines. Reads pipeline source, table schema, expectations, monitor configuration, and event-log queries only; never executes pipelines and never assumes metric availability without verification.

0
installs
▌
Vue Composition API Architecture Review · vincentchuwaichow bundle
Statically review Vue 3 Composition API code — composable extraction quality, reactivity-boundary correctness (ref/reactive/computed usage, destructuring-loses-reactivity pitfalls), and script-setup component organization — against Vue's own documented composable conventions and reactivity fundamentals.

0
installs
▌
Kubecost Chargeback Allocation Review · vincentchuwaichow bundle
Use this skill when reviewing a Kubecost or OpenCost installation for enterprise chargeback readiness. Trigger when the user asks whether cost allocation is accurate, whether label taxonomy is complete enough for chargeback, whether idle cost is properly attributed, whether the cost API is secured, or whether savings recommendations are being actioned.

0
installs
▌
Netsuite Oneworld Multisubsidiary Skill · vincentchuwaichow bundle
Flashlight skill for reviewing NetSuite OneWorld multi-entity configurations: subsidiary hierarchies, intercompany account boundaries, cross-subsidiary visibility restrictions, multi-currency settings, and tax-jurisdiction nexus alignment. T0 static review — no live account connection required. TRIGGER when: user asks to review subsidiary structure, audit intercompany accounts, check cross-subsidiary role scoping, validate tax nexus coverage, assess consolidation configuration, or diagnose OneWorld hierarchy issues. Trigger phrases: subsidiary hierarchy, intercompany elimination, cross-subsidiary access, multi-currency consolidation, tax nexus, due-to due-from, legal entity registration, OneWorld configuration. DO NOT TRIGGER when: the user needs authentication or OAuth/TBA token review (use netsuite-sso-oauth-tba-skill), role/permission assignment analysis beyond subsidiary scoping (use netsuite-identity-access-role-permission-skill), SOX audit evidence generation (use netsuite-audit-controls-sox-skill), or

0
installs
▌
Netsuite Web Services Integration Skill · vincentchuwaichow bundle
Static-review flashlight for NetSuite SuiteTalk REST/SOAP API design, integration record configuration, and OAuth 2.0 authentication posture. Reviews REST record endpoints, RESTlet definitions, integration record settings, and authentication method selection against Oracle's documented posture. TRIGGER when: user asks to design or review a NetSuite REST integration, review a RESTlet, configure an integration record, choose between OAuth 2.0 and TBA for a new integration, review SOAP API usage, assess migration risk for an existing SOAP integration, or configure SuiteAnalytics Connect authentication. Trigger phrases: SuiteTalk REST, SuiteTalk SOAP, integration record, RESTlet, OAuth 2.0 NetSuite, REST API design NetSuite, SOAP migration risk. DO NOT TRIGGER when: the question is about the SOAP-to-REST migration program end-to-end (use netsuite-integration-migration-agent), OAuth 2.0 / TBA / SSO / SAML deep auth mechanics (use netsuite-sso-oauth-tba-agent), SuiteScript code authorship or SDF deployment (use net

0
installs
▌
Ovhcloud Live Kms Key Destruction Guard · vincentchuwaichow bundle
OVHcloud Live KMS Key Destruction Guard

0
installs
▌
Salesforce Apex Lwc Code Review Skill · vincentchuwaichow bundle
Salesforce Apex and LWC Code Review Skill

0
installs
▌
Salesforce Deployment Validator Skill · vincentchuwaichow bundle
Runs `sf project deploy validate` against a SANDBOX or non-production org to surface deployment issues, test failures, and metadata dependency problems WITHOUT committing changes. T2 sandbox-mutating but reversible (dry-run only — no commit occurs). Production org targets are REFUSED — production deploys require human approval via salesforce-live-guard-agent. Feeds salesforce-change-impact-analyst-agent. TRIGGER when: user wants to validate a deployment package, dry-run a manifest, check pre-deploy test coverage, verify metadata dependencies, preview change impact in a sandbox. Trigger phrases: "validate this deploy", "dry-run the deployment", "check deployment manifest", "validate package.xml", "test deploy to sandbox", "deployment preflight". DO NOT TRIGGER when: user wants to commit to production (T3 PROHIBITED — route to salesforce-live-guard-agent for HITL); when only static review is needed (use salesforce-metadata-review-skill); when bulk data ops are needed (use salesforce-bulk-data-ops-skill).

0
installs
▌
Salesforce Infrastructure Audit Skill · vincentchuwaichow bundle
Salesforce Infrastructure Audit Skill

0
installs
▌
Snowflake Network Private Connectivity · vincentchuwaichow bundle
Use this skill to review Snowflake reachability in both directions: network rules and policies at account and user scope, inbound and outbound private connectivity, internal stage access paths, external access integrations and egress destinations, endpoint pinning, and lockout prevention. Trigger on any question about where Snowflake can be reached from or what it can reach. Static review only: it never activates or alters a network policy, and it refuses any tightening that cannot demonstrate a surviving administrative path.

0
installs
▌
Typescript Async Contract Reliability · vincentchuwaichow bundle
Use this skill to statically review server-side TypeScript async reliability: floating and ignored promises, async functions passed where `void` is expected, `AbortSignal` cancellation plumbing, unhandled-rejection posture (Node defaults `--unhandled-rejections` to `throw`, and it is not safe to resume after `uncaughtException`), stream/async-iterable backpressure, concurrency bounds, guaranteed cleanup, and typed error channels. Reads source and Node/lint configuration only; it never runs the process.

0
installs
▌
Typescript Module Resolution And Emit · vincentchuwaichow bundle
Use this skill to statically review whether a TypeScript package resolves, imports, and emits correctly for every consumer mode it claims to support: the `module`/`moduleResolution` matrix, `exports`/`imports` condition ordering, `.mts`/`.cts` handling, and the dual-package hazard. Reads `package.json`, every `tsconfig.json`, and emitted output only; it never tunes bundler performance and never runs a build.

0
installs
▌
Alibaba Certificate Manager Issuer Review · vincentchuwaichow bundle
Review Alibaba Cloud SSL Certificate Service — DV/OV/EV certificate lifecycle, auto-renewal configuration, certificate deployment to SLB/ALB/CDN/OSS, domain validation status, CAA record compliance, and expiry monitoring.

0
installs
▌
AWS Dynamodb Data Modeling Performance Review · vincentchuwaichow bundle
Review Amazon DynamoDB data modeling and performance across access patterns, partition keys, sort keys, secondary indexes, GSI/LSI design, hot partitions, query versus scan behavior, capacity mode, adaptive capacity, global tables, TTL, DAX, item size, transactions, and cost. Use when DynamoDB correctness, latency, scaling, or cost depends on table design.

0
installs
▌
Identity To Data Access Protocol · vincentchuwaichow bundle
Use this skill when an identity lifecycle event (joiner, mover, leaver) or an access request must be evaluated end-to-end across Microsoft Entra identity, Conditional Access policy, and data access governance under a Zero Trust posture. Orchestrates m365-identity-zero-trust-agent as primary and m365-copilot-readiness-governance-agent for data-layer governance. Gates include access review sign-off and least-privilege validation before any access grant is recommended. Does not approve access; all recommendations require human owner confirmation. Never requests credentials, tenant IDs, or customer data.

0
installs
▌
Incident To Remediation Protocol · vincentchuwaichow bundle
Use this skill when a security incident must be triaged, contained, remediated, and reviewed in a Zero Trust assume-breach posture across Microsoft 365 and Dynamics 365 environments. Defines the end-to-end flow from detection through severity triage, containment approval, investigation, remediation, and post-incident review. Applies Zero Trust principles — verify explicitly, use least privilege, assume breach — throughout. Does not serve as an authorization to isolate devices, block users, or make configuration changes; all containment and remediation actions require human approval from the security owner or incident commander. Does not replace a qualified SecOps team or Microsoft Defender XDR specialist.

0
installs
▌
Legacy Jquery To Modern Framework Review · vincentchuwaichow bundle
Inventory the hidden behaviors in a legacy jQuery/Backbone-era codebase — implicit global event delegation, direct DOM mutation outside any render cycle, plugin side effects, ad-hoc accessibility shims, and unsanitized HTML string building — that a mechanical framework port would silently drop or need to explicitly reproduce.

0
installs
▌
Product Analytics Experimentation Review · vincentchuwaichow bundle
Review frontend analytics instrumentation and A/B or multivariate experiment configurations for event-schema correctness, sample-ratio-mismatch risk, statistically valid stopping rules, and consent-gated privacy compliance before shipping a tracking or experiment change.

0
installs
▌
Sveltekit Progressive Enhancement Review · vincentchuwaichow bundle
Statically review SvelteKit forms and form actions for functional resilience without JavaScript (native method="POST" fallback) and for use:enhance customization correctness (ActionResult branch handling, cancel() feedback, redirect/invalidation behavior), flagging silent-failure and conversion-risk defects.

0
installs
▌
Kubernetes Network Architecture Review · vincentchuwaichow bundle
Use this skill for Kubernetes cluster network architecture review across the dataplane (CNI choice, kube-proxy mode, IPAM, MTU, encapsulation, dual-stack), service routing surface (Service types, EndpointSlices, internalTrafficPolicy/externalTrafficPolicy, topology-aware routing, Ingress, Gateway API), in-cluster DNS (CoreDNS, NodeLocal DNSCache, ndots), multi-cluster topology (ClusterMesh, Submariner, MCS-API design choices), and connectivity observability and troubleshooting. Trigger when the user asks how to choose or change a CNI, why pod-to-pod or pod-to-service traffic fails, whether to migrate from Ingress to Gateway API, why DNS latency is high, how to size Pod or Service CIDRs, or how to design multi-cluster networking. Does NOT review NetworkPolicy content (delegate to cilium-network-policy-review) or perform live mutations (delegate to kubernetes-live-network-policy-guard / kubernetes-live-mesh-policy-guard).

0
installs
▌
Influencer Disclosure Compliance Review · vincentchuwaichow bundle
Use this skill when reviewing an influencer campaign audit pack — campaign brief, creator agreement excerpt, platform post descriptions or screenshot descriptions, and the disclosure format and placement specification — against FTC Endorsement Guides to identify undisclosed material connections, inadequate disclosure placement, and brand liability exposure. Trigger when a user provides a structured influencer campaign audit pack and asks whether disclosures meet FTC requirements, whether the brief contains problematic instructions, or whether the brand faces liability for creator conduct under 16 CFR Part 255.

0
installs
▌
M365 Live Sensitivity Label Apply Guard · vincentchuwaichow bundle
Mutating-runtime live-guard for applying ONE Microsoft Purview sensitivity label to ONE specified item (file/driveItem) via the Microsoft Graph assignSensitivityLabel action. Strictly scoped — one item, one label application. Requires explicit written human approval token referencing the exact item, proposed label, and blast-radius. PREFLIGHT reads the item's current label before any write. Fully reversible — prior label captured; re-apply prior label is the rollback. Gate-only; never auto-dispatched. Phase B mutating-runtime.

0
installs
▌
Prometheus Alerting Cardinality Review · vincentchuwaichow bundle
Use this skill when reviewing Prometheus or AlertManager configuration for cardinality, alerting correctness, scrape security, remote_write safety, or retention adequacy. Trigger when a user provides prometheus.yml, alertmanager.yml, recording rules YAML, alerting rules YAML, or asks whether their Prometheus setup is production-ready.

0
installs
▌
Sap Integration Platform Businessops Protocol · vincentchuwaichow bundle
Cross-functional coordination protocol governing handoff contracts between SAP Integration, Platform Engineering, and Business Operations. Activates on failed integration flows, API throttling, event delivery failures, broken partner integrations, data replication failures, middleware instability, and business-process outage. Advisory and audit only — no live mutation.

0
installs
▌
Sap Release Cutover Finance Controls Protocol · vincentchuwaichow bundle
Cross-functional coordination protocol governing handoffs between SAP Release Management, Business Process Owners, and Finance Controls for transport imports, production freeze enforcement, cutover readiness, financial-period close, O2C/P2P business process continuity, inventory valuation, revenue recognition impact, and hypercare. Defines go/no-go decision rights, irreversible-action gates, rollback requirements, and audit packaging. Never mutates live systems and never bypasses any guarded-mutating gate.

0
installs
▌
Sap S4hana Transformation Architecture Review · vincentchuwaichow bundle
Review an SAP S/4HANA transformation approach for architectural soundness. Assesses brownfield conversion, greenfield reimplementation, and selective data transition (SDT) strategies against SAP Activate methodology, deployment model options (Cloud Public Edition, Cloud Private Edition, RISE with SAP), SAP Readiness Check findings, simplification item impact, and fit-to-standard alignment. Advisory only — does not access or modify live systems.

0
installs
▌
Snowflake Live Failover Promotion Guard · vincentchuwaichow bundle
Approval-gated live guard for exactly one Snowflake failover group promotion. Requires a declared incident or drill, a named accountable owner, a data-loss window computed from replication refresh history, dependency readiness confirmed item by item by each owning team, a client redirection plan covering hardcoded clients, and a stated failback strategy — all before the statement is composed. Refuses on urgency alone. Runs as a custom role in the target account able to promote only the named group; never ACCOUNTADMIN.

0
installs
▌
Frontend Error Boundary Resilience Review · vincentchuwaichow bundle
Reviews error-boundary placement, fallback UX, and failure-isolation strategy to prevent a single component's runtime error from crashing the whole page, ensuring granular, accessible degradation instead of an app-root-only safety net or a silent, unlogged failure.

0
installs
▌
Huawei Ticket Triage Escalation Coordinator · vincentchuwaichow bundle
Triage Huawei Cloud operational alerts, incidents, and support tickets — P0/P1/P2/P3 classification, Huawei Cloud Premium Support SLA enforcement, Account Manager escalation, AOM alert routing, war room coordination, evidence collection from CES and LTS, and safe escalation paths.

0
installs
▌
AI Advertising Targeting Fairness Review · vincentchuwaichow bundle
Use this skill when reviewing ad-platform audience targeting configurations and declared AI feature usage for protected-class discrimination risk. Trigger when a user provides a Meta Ads Manager audience definition, Google Ads targeting layer export, DSP deal config, or any ad platform audience spec annotated with AI features enabled (Advantage+ Audience, broad match, automated bidding, lookalike seeds). Use when a campaign is in housing, credit, employment, or insurance verticals, or when automated bidding or AI audience expansion is active on any campaign reaching the US or EU and the user needs to assess Fair Housing Act, ECOA, or EU AI Act Article 5 exposure.

0
installs
▌
Marketing Consent Data Collection Review · vincentchuwaichow bundle
Use this skill when reviewing a marketing site's consent and data-collection posture — cookie/consent banner (CMP) configuration, tag-manager container exports, Google Consent Mode wiring, or a cookie policy. Trigger when a user provides a CMP configuration, a tag manager container JSON, a consent-banner screenshot description, or asks whether their marketing tracking is GDPR/CCPA/ePrivacy compliant, whether tags fire before consent, or whether their opt-out path is valid.

0
installs
▌
Salesforce Agentforce Risk Review Skill · vincentchuwaichow bundle
Salesforce Agentforce Risk Review Skill

0
installs
▌
Salesforce Flow Automation Review Skill · vincentchuwaichow bundle
Salesforce Flow Automation Review Skill

0
installs
▌
Salesforce Validation Rule Writer Skill · vincentchuwaichow bundle
Converts business rules described in plain English into deployable Salesforce validation rule formula syntax, including error message copy, profile bypass logic, null handling, and formula compilation safety. TRIGGER when: user says write a validation rule, create validation rule formula, block user from saving if, require field when, prevent save when, enforce that field must be filled. Trigger phrases: validation rule for, formula to block, required field logic, save condition. DO NOT TRIGGER when: reviewing existing validation rules for quality (use salesforce-platform-admin-review-agent), deploying validation rules (use salesforce-deployment-validator-skill), bulk updating multiple rules across objects (use salesforce-bulk-data-ops-skill).

0
installs
▌
Sap Procurement License Finops Vendor Protocol · vincentchuwaichow bundle
Cross-functional coordination protocol governing handoff contracts between SAP Procurement/License, FinOps, and Vendor Management. Activates on BTP consumption spikes, entitlement changes, license compliance events, RISE/SLA issues, vendor lock-in exposure, contractual risk, underused subscriptions, and over-provisioned services. Advisory and audit only — no live mutation.

0
installs
▌
Snowflake Live Auth Network Policy Guard · vincentchuwaichow bundle
Approval-gated live guard for exactly one Snowflake network-policy or authentication-policy change. Refuses any tightening for which a surviving administrative path has not been demonstrated from login history — a named principal, a proven location, and the privilege to revert. Refuses combined add-and-remove changes, integration lifecycle operations, MFA weakening, and unconstrained break-glass paths. Runs as a custom role owning only the target policy object; never ACCOUNTADMIN.

0
installs
▌
Snowflake Live Rbac Grant Guard At Azure · vincentchuwaichow bundle
Mutating-runtime live guard for Snowflake RBAC privilege management on Azure. Executes exactly ONE GRANT or REVOKE of a single privilege on a single securable to a single custom role — with explicit written human approval, dry-run preflight (SHOW GRANTS prior state), and a named rollback owner. Phase B strictly-scoped controlled mutation; never ACCOUNTADMIN/SECURITYADMIN/SYSADMIN/PUBLIC, never OWNERSHIP, never MANAGE GRANTS, never future grants at database or account scope.

0
installs
▌
Snowflake Native App Marketplace Product · vincentchuwaichow bundle
Use this skill to review a Snowflake Native App or Marketplace listing as a product: application package and application-role design, requested privileges and the provider/consumer trust boundary, security-review readiness, listing and publication requirements, pricing and monetization architecture, version and patch lifecycle including withdrawal, telemetry and shareback consent, and supportability economics. Trigger when building, publishing, or reviewing an application or listing. Static review only: it never installs, publishes, or upgrades anything.

0
installs
▌
Typescript Node Execution Compatibility · vincentchuwaichow bundle
Use this skill to statically review whether TypeScript code runs on the stated target Node version and is type-checked somewhere before production: type-stripping limits, runtime-unsupported syntax, proof of a separate `tsc --noEmit` gate, `paths`-alias and import-extension requirements, and Node version/API gating. Reads source, the run command, CI configuration, and every `tsconfig.json` only; it never executes code and never assumes a Node version.

0
installs
▌
Change Request To Go Live Protocol · vincentchuwaichow bundle
Use this skill when a Dynamics 365 change request must be structured and progressed through impact assessment, fit-gap analysis, UAT sign-off, go/no-go decision, go-live execution, and hypercare using the Success by Design framework. Defines the full change-to-go-live flow — change request intake, solution blueprint alignment, testing gates, cutover plan verification, go/no-go decision, deployment, and hypercare. Does not authorize go-live, cutover execution, or production deployments; all production-impacting actions require human approval from the project sponsor, release manager, and Microsoft FastTrack for Dynamics 365 team (where engaged). Does not replace a qualified Dynamics 365 architect or implementation partner.

0
installs
▌
Databricks Lakeflow Pipeline Engineering · vincentchuwaichow bundle
Use this skill to design Lakeflow Spark Declarative Pipelines: medallion layering, Lakeflow Jobs orchestration and task dependencies, Delta table layout (liquid clustering, deletion vectors, Predictive Optimization), Auto Loader ingestion, schema evolution and `_rescued_data`, materialized views versus streaming tables, and backfill strategy. Reads pipeline source, table metadata, and job definitions only; never executes pipelines and never assumes feature availability without checking the documentation.

0
installs
▌
Angular Template Sanitizer Security Review · vincentchuwaichow bundle
Statically review Angular templates and components for injection via DomSanitizer bypass calls (bypassSecurityTrustHtml, bypassSecurityTrustUrl, bypassSecurityTrustResourceUrl), unsanitized [innerHTML] bindings, and dynamically bound iframe security attributes such as [attr.sandbox], grounded in Angular's own sanitizer and NG0910 documentation.

0
installs
▌
Frontend Observability Rum Instrumentation · vincentchuwaichow bundle
Design or review browser-side Real User Monitoring instrumentation for Core Web Vitals (LCP, INP, CLS) using the web-vitals attribution build and distributed tracing via OpenTelemetry Web, enforcing lab-vs-field evidence labeling, sampling/cardinality sizing, and PII-in-telemetry controls, with library-specific wiring references loaded only when instrumentation code is actually being written or reviewed.

0
installs
▌
Huawei Daily Operations Briefing Coordinator · vincentchuwaichow bundle
Coordinate the daily Huawei Cloud operations standup — CBC cost delta by Enterprise Project, AOM anomaly alert review, CCE pod failure triage, CES quota utilization warnings, LTS log error spike detection, SecMaster security finding triage, and action item assignment.

0
installs
▌
Kubernetes Pod Security Admission Review · vincentchuwaichow bundle
Use this skill for Kubernetes Pod Security Admission (PSA) review covering namespace labels for the three profiles (privileged, baseline, restricted), enforce/audit/warn modes, version pinning, and the migration path from deprecated PodSecurityPolicy. Trigger when the user asks whether a namespace label flip is safe, whether a workload meets a stricter profile, whether the audit/warn modes should be promoted to enforce, or whether an exemption is justified.

0
installs
▌
Opentelemetry Collector Config Review · vincentchuwaichow bundle
Use this skill for OpenTelemetry Operator review covering OpenTelemetryCollector deployment modes (Deployment, StatefulSet, DaemonSet, Sidecar), Instrumentation CR auto-instrumentation across Java/Node/Python/.NET/Go, Target Allocator for distributed Prometheus scraping, and pipeline correctness across receivers, processors, and exporters. Trigger when the user asks whether a collector configuration will lose telemetry, whether the right deployment mode is used, whether memory_limiter and batch are present, whether tail_sampling is safe to change, or whether auto-instrumentation will cover a workload after restart.

0
installs
▌
Salesforce Permission Model Review Skill · vincentchuwaichow bundle
Salesforce Permission Model Review Skill

0
installs
▌
Snowflake Analytics Semantic Data Product · vincentchuwaichow bundle
Use this skill to review analytical correctness and business semantics in Snowflake: join grain and fan-out, window and null semantics, semantic views and their declared relationships, metric and KPI contracts, BI workload design, the Cortex Analyst semantic boundary, and conflicting business definitions. Trigger when a number is disputed, a metric is being defined, or a semantic model is being built. Static review only: it never executes a query, and it never settles a business-definition conflict in SQL.

0
installs
▌
Snowflake Rbac Access Governance At Azure · vincentchuwaichow bundle
Review Snowflake RBAC role hierarchies, privilege grants, managed-access schemas, network policies, MFA enforcement, and Entra ID External OAuth/SAML/SCIM integration for least-privilege and separation-of-duties compliance on Azure-hosted Snowflake accounts.

0
installs
▌
Snowflake Streaming Ingestion Reliability · vincentchuwaichow bundle
Use this skill to review Snowflake continuous ingestion for silent failure: Snowpipe, Snowpipe Streaming high-performance versus classic architecture and its migration, channel and offset semantics, delivery guarantees hop by hop, backpressure and retry correctness, schema validation and rejected records, the Kafka connector and its version-specific behaviour, Openflow connectors, and the observability that detects a partial stop. Trigger on any continuous ingestion question. Static review only: it never resets a channel, never replays a pipe, and never recommends an architecture without re-verifying its lifecycle status.

0
installs
▌
Typescript Estate Modernization Governor · vincentchuwaichow bundle
Use this skill to statically review TypeScript estate-migration sequencing and reversibility: staged strictness adoption, compiler-major upgrades including the TS 6.0→7.0 tooling split, module-system migration, `skipLibCheck`/suppression debt burn-down, and exposure to removed compiler values. Owns sequencing and portfolio prioritization, not per-file fixes, framework migrations, steady-state policy, or the financial case. Reads configuration and version evidence only.

0
installs
▌
Typescript Package Publication Integrity · vincentchuwaichow bundle
Use this skill to statically review npm package publication integrity: whether publish authority relies on OIDC-based trusted publishing rather than a long-lived token, whether the published artifact carries provenance a consumer can verify, whether the release-automation trust path resists compromise, whether the packed tarball and its declarations/source maps expose only what is intended, whether publish-time lifecycle scripts are justified, and whether registry/scope configuration resists dependency confusion. Reads the publish workflow and sanitized configuration only; it never runs a publish or signs anything.

0
installs
▌
Alibaba Ticket Triage Escalation Coordinator · vincentchuwaichow bundle
Triage Alibaba Cloud operational alerts, incidents, and support tickets — P0/P1/P2/P3 classification, Alibaba Cloud Support SLA enforcement, account manager escalation, DingTalk war room coordination, evidence collection from CloudMonitor and SLS, and safe escalation paths.

0
installs
▌
Data Classification To Dlp Protocol · vincentchuwaichow bundle
Use this skill when sensitive data must be discovered, classified with Microsoft Purview sensitivity labels, protected by Data Loss Prevention policies, and monitored for label adoption and DLP policy effectiveness across Microsoft 365 and Power Platform environments. Defines the end-to-end flow from data discovery through classification taxonomy design, sensitivity label deployment, DLP policy coverage, and adoption monitoring. Does not authorize the creation or modification of sensitivity labels, DLP policies, or auto-labeling policies; all production-impacting policy changes require human approval from the Purview compliance administrator and the data owner. Does not replace qualified information protection or compliance counsel.

0
installs
▌
Databricks Genai Evaluation Observability · vincentchuwaichow bundle
Use this skill to review generative-AI evaluation, tracing, and observability design on Databricks: MLflow Tracing instrumentation and span design, trace storage and governance, `mlflow.genai.evaluate()` harness design, the judge-versus-scorer distinction, built-in judge selection (ten single-turn and seven multi-turn), custom scorers, evaluation datasets, regression detection, human feedback loops, and cost/latency observability. Treats every LLM judge as an instrument with error.

0
installs
▌
Databricks Lakehouse Engineering At Azure · vincentchuwaichow bundle
Databricks Lakehouse Engineering at Azure

0
installs
▌
Programmatic Supply Chain Integrity Review · vincentchuwaichow bundle
Use this skill when reviewing ads.txt, app-ads.txt, and sellers.json files for a publisher or advertiser's programmatic supply chain to detect unauthorized resellers, domain-spoofing exposure, and SupplyChain Object gaps. Trigger when a user provides an ads.txt file, an app-ads.txt file, a sellers.json endpoint response, or asks whether their programmatic supply chain has unauthorized intermediaries, IVT exposure, domain-spoofing risk, or whether their supply chain declaration satisfies IAB Tech Lab, MRC, or DSP procurement requirements.

0
installs
▌
Salesforce Agentforce Stdm Observer Skill · vincentchuwaichow bundle
Queries Salesforce Telemetry & Data Management (STDM) and Data Cloud for live Agentforce session traces, faithfulness scores, answer relevance scores, action invocation telemetry, and quality metrics under T1 least-privilege scope (api + refresh_token + cdp_query_api). Answers the production observability question: "is my Agentforce agent working correctly right now?" Operational counterpart to the static-review salesforce-agentforce-risk-review-skill. TRIGGER when: user asks for Agentforce session metrics, faithfulness scores, answer relevance, AI Evaluation results, action telemetry, STDM queries, agent performance KPIs, hallucination rates. Trigger phrases: "how is my agent performing", "show STDM data", "agent observability", "agent telemetry", "AiAgentTagAssociation", "AiEvaluationDefinition results", "agentforce production metrics". DO NOT TRIGGER when: user wants static configuration review (use salesforce-agentforce-risk-review-skill); when modifying agent configurations (T3 — escalate to salesforce-l

0
installs
▌
Salesforce Marketing Consent Review Skill · vincentchuwaichow bundle
Salesforce Marketing Consent Review Skill

0
installs
▌
Sap AI Governance Security Architecture Protocol · vincentchuwaichow bundle
Cross-functional coordination protocol governing handoff contracts between SAP AI Governance, Security, and Architecture. Activates on AI Core workloads, Generative AI Hub deployments, Joule governance events, RAG design reviews, prompt-injection risk, data-leakage risk, model-access control gaps, and auditability of AI-generated outputs. Advisory and audit only — no live mutation.

0
installs
▌
Snowflake Live Warehouse Cost Change Guard · vincentchuwaichow bundle
Approval-gated live guard for exactly one Snowflake warehouse or cost-governance change: a size, auto-suspend, auto-resume, scaling or concurrency setting, a resource-monitor assignment or threshold, or a supported budget operation. Requires a quantified cost effect, a quantified performance effect with a falsification criterion, an affected-workload enumeration, and an agreed rollback trigger before execution. Treats a suspend-capable monitor as an availability control. Runs as a custom role scoped to the single target; never ACCOUNTADMIN.

0
installs
▌
Alibaba Daily Operations Briefing Coordinator · vincentchuwaichow bundle
Coordinate the daily Alibaba Cloud operations standup — cost delta from Cost Manager, ActionTrail anomaly review, ACK pod failure triage, quota utilization warnings, Security Center finding review, and action item assignment.

0
installs
▌
Lookalike Audience Upload Compliance Review · vincentchuwaichow bundle
Use this skill when reviewing custom-audience and lookalike-audience upload specifications for hashing adequacy, PII field scope, consent-basis validity, and platform data-sharing restrictions before the upload is submitted to Meta, Google, LinkedIn, or TikTok. Trigger when a user provides an audience upload field-mapping specification (CSV schema or platform upload template), declared hashing method, consent-basis documentation, or originating list segment metadata — or when they ask whether their customer list upload or lookalike seed list is compliant with GDPR, CCPA/CPRA, or platform terms before uploading.

0
installs
▌
Microsoft Business Impact Value Realization · vincentchuwaichow bundle
Review Microsoft 365 and Copilot value realization — license-to-value, adoption measurement, and ROI. Covers Copilot Control System measurement and reporting, Copilot Analytics and the Copilot Dashboard, Adoption Score and AI adoption score, the Microsoft 365 Copilot readiness/usage reports, license assignment optimization, and FastTrack adoption guidance. Use to turn license spend into measurable productivity and business outcomes. Advisory only; never makes licensing purchase commitments.

0
installs
▌
Python Business Critical Automation Governance · vincentchuwaichow bundle
Use this skill to statically review business-critical Python automation governance: unowned scripts, notebooks, bots, and schedulers whose failure creates financial, regulatory, or operational exposure. Reads automation source, configuration, and process description only; it never runs the automation and makes no accounting, legal, or regulatory conclusion — those route to the finance/accounting and legal boards.

0
installs
▌
Snowflake Cortex AI Agent Security Governor · vincentchuwaichow bundle
Use this skill to review the security and governance boundary of Snowflake AI: Cortex Agents and their identity and effective data reach, CORTEX_USER versus CORTEX_AGENT_USER and AI-function privileges including grants to PUBLIC, Cortex Search corpora as an untrusted-content surface, Cortex Analyst semantic exposure, tools and MCP connectors as privilege grants, prompt and indirect prompt injection, exfiltration paths, guardrails, adversarial evaluation, observability, and cost per successful task. Trigger before any Cortex or agentic capability is exposed to users. Static review only: it never creates or invokes an agent, and it never approves an AI system from its prompt.

0
installs
▌
Snowflake Live Data Protection Policy Guard · vincentchuwaichow bundle
Approval-gated live guard for exactly one Snowflake data-protection policy attachment, detachment, or replacement on one object or column. Requires a per-role-class visibility prediction that has been tested before execution, an enumeration of the consumption paths the protection will and will not follow, and — for any detachment — a written justification, a named data owner, and a committed re-attachment time. Never displays sensitive values, including during verification. Runs as a custom role scoped to the single target and policy; never ACCOUNTADMIN.

0
installs
▌
Fabric Power Bi Business Insights Governance · vincentchuwaichow bundle
Review Microsoft Fabric and Power BI business-insights governance — semantic model trust (shared/endorsed/certified models, Build permission), row-level and object-level security, workspace roles, OneLake catalog discoverability and lineage, sensitivity labels and Microsoft Purview DLP for Power BI, certified-dataset reuse, and capacity oversight. Use to fix metric mistrust, semantic-model sprawl, and inconsistent executive dashboards. Static review only; production workspace-role, RLS, and capacity changes are escalated.

0
installs
▌
Power Platform Governance Dataverse Security · vincentchuwaichow bundle
Review and advise on Power Platform environment strategy, Data Loss Prevention (DLP) policy design, Dataverse security model, business unit hierarchy, security roles and teams, table/row/column-level permissions, connector governance, and Center of Excellence (CoE) alignment. Flags environment sprawl, weak DLP, unmanaged connectors, over-privileged Dataverse roles, insecure ad-hoc sharing, and misaligned business unit design. Static review only — no live tenant mutations. Escalates production DLP changes through the live-guard gate.

0
installs
▌
Netsuite Suitescript Secure Code Review Skill · vincentchuwaichow bundle
Flashlight skill for static security review of SuiteScript 2.x code against OWASP Top 10 (2021) pitfall patterns (OSCP-001 through OSCP-048), extended with Vanguard severity taxonomy mapping and CI pipeline gate recommendations. Adapted from Oracle netsuite-owasp-secure-coding (UPL-1.0). T0 static review — no live account connection required. TRIGGER when: user submits SuiteScript 2.x code for security review, asks about SuiteQL injection prevention, output encoding in Suitelets or RESTlets, CSRF in SuiteScript, file upload security, RESTlet hardening, DOM XSS in client scripts, postMessage origin validation, or AI prompt-injection in SuiteScript. Trigger phrases: SuiteScript security review, OWASP SuiteScript, SuiteQL injection, XSS in Suitelet, RESTlet hardening, CSRF token SuiteScript, file upload SuiteScript, OSCP vulnerability, secure coding SuiteScript. DO NOT TRIGGER when: request is for SuiteScript 1.0 (recommend migration first), SuiteFlow workflow logic review (use netsuite-suiteflow-automation-agen

0
installs
▌
Snowflake Business Value Adoption Strategist · vincentchuwaichow bundle
Use this skill to test whether a Snowflake initiative removes a business constraint anyone owns: value hypothesis, pre-work baseline, benefit modelling by credibility category, unit economics, causal attribution, adoption, time to value, decision latency, alternatives including do-nothing, benefit realization, and translation into executive KPIs. Trigger when an initiative is proposed, prioritized, or being justified — and especially when the justification is that Snowflake supports the capability. Static review only, and it may return NO-GO on a technically sound proposal.

0
installs
▌
Snowflake Data Platform Engineering At Azure · vincentchuwaichow bundle
Design and review Snowflake data platform engineering on Azure, covering warehouse sizing and cost governance, Azure Private Link requirements, storage integration with ADLS Gen2 and Azure Blob, Snowpipe automation, object tagging, dynamic data masking, row access policies, and ACCESS_HISTORY lineage for GDPR and CCPA compliance.

0
installs
▌
Databricks Unity Catalog Governance At Azure · vincentchuwaichow bundle
Databricks Unity Catalog Governance at Azure

0
installs
▌
Marketing Conversion Flow Dark Pattern Review · vincentchuwaichow bundle
Use this skill when reviewing marketing conversion flow specifications — subscription sign-up, upsell interstitial, free-trial enrollment, and cancellation path — for dark-pattern practices that invalidate consent or constitute unfair or deceptive acts under FTC Section 5 and state privacy laws. Trigger when a user provides a UX flow specification including step-by-step page descriptions, annotated wireframes, CTA labels, pre-checked options, visual weight of accept vs decline paths, countdown timer specs, or cancellation flow step counts. Scope is limited to marketing conversion flows; consent banner review is handled by a separate skill.

0
installs
▌
Netsuite Identity Access Role Permission Skill · vincentchuwaichow bundle
Static review flashlight for NetSuite role configurations, permission assignments, and Segregation-of-Duties design. Validates custom roles against standard baselines, resolves permission codes from the 684-code SDF catalog, and flags SoD conflicts and over-permissioned roles. TRIGGER when: user asks to review a NetSuite role, check permissions on a role, audit segregation of duties, validate a custom role, analyze SDF customrole XML, check who has Administrator access, review run-as configuration for a script or integration, map permissions to least privilege, or assess 2FA role designations. Trigger phrases: review netsuite role, check role permissions, segregation of duties netsuite, custom role from standard, sdf customrole xml, least privilege role, who has administrator, run-as role, 2fa role designation. DO NOT TRIGGER when: the question is about OAuth 2.0, TBA, SSO, or SAML configuration (use netsuite-sso-oauth-tba-skill); when SDF project structure or deployment pipeline is the subject (use netsuite-

0
installs
▌
Netsuite Sandbox Nonproduction Governance Skill · vincentchuwaichow bundle
Static-review flashlight for NetSuite sandbox, Release Preview, and non-production environment governance. Enforces the confirmed isolation facts: OAuth 2.0 authorized apps and client credentials flow setup in production are NOT copied to sandbox or Release Preview (and are cleared on each sandbox refresh); TBA tokens created in production are NOT copied to sandbox or Release Preview. Enforces that sandbox success does not equal production readiness without explicit re-authorization. TRIGGER when: user asks about sandbox governance, OAuth app re-authorization after sandbox refresh, TBA token management across environments, Release Preview usage policies, environment isolation between production and sandbox, sandbox-to-production promotion readiness, or sandbox refresh impact on integration testing. Trigger phrases: sandbox refresh, OAuth re-authorize sandbox, Release Preview isolation, sandbox governance, non-production environment, sandbox success production readiness, TBA token sandbox. DO NOT TRIGGER when:

0
installs
▌
Snowflake Live Pipeline Streaming Change Guard · vincentchuwaichow bundle
Approval-gated live guard for exactly one Snowflake pipeline or ingestion change — one task, stream, dynamic table, or pipe operation, or one bounded backfill. Requires a freshness and count baseline, the last successful processing state, the offset or checkpoint position, a downstream consumer enumeration, and an explicit duplication-or-loss analysis before execution, plus a passing reconciliation afterwards. Refuses unbounded replays and replays into targets with no deduplication path. Runs as a custom role scoped to the single object; never ACCOUNTADMIN.

0
installs
▌
Salesforce Live Change Approval Protocol · vincentchuwaichow bundle
Salesforce Live Change Approval Protocol

0
installs
▌
M365 Exchange Sharepoint Information Governance · vincentchuwaichow bundle
Review and advise on Exchange Online and SharePoint Online plus OneDrive information governance covering mailbox and site lifecycle, external and anonymous sharing controls, SharePoint Advanced Management (Restricted Content Discovery, site access reviews, data access governance reports), retention and records management via Microsoft Purview, oversharing remediation feeding Microsoft 365 Copilot readiness, and information architecture. Cert anchor MS-102. Static review and advisory only; tenant sharing-policy changes and retention or hold changes are live-guard gated. Refuses to weaken sharing controls or remove holds for convenience.

0
installs
▌
Revenue Critical Journey Integrity Review · vincentchuwaichow bundle
Use this skill to review the cross-tier seams of revenue-critical journeys — checkout, payment submission, account creation, and login — for idempotency of money-moving and account-creating requests, server-side re-validation of client-enforced rules, webhook duplicate/out-of-order handling, retry-storm safeguards, and PCI DSS SAQ-scope judgment. Use when a request crosses client-to-server, system-to-processor, or webhook-back-into-system and a failure at that seam would double-charge, double-fulfill, bypass a required step, drop revenue, or misjudge PCI scope. Static review only; it does not execute payment flows and its PCI SAQ output is an advisory scoping opinion, never a compliance attestation.

0
installs
▌
Environment To Production Release Protocol · vincentchuwaichow bundle
Use this skill when a Power Platform or Dynamics 365 solution must progress through a structured dev-to-test-to-production release pipeline using managed solutions and Power Platform pipelines, when rollback readiness must be verified before go-live, or when a deployment approval gate must be enforced. Defines the full ALM release flow — solution packaging, pipeline stage progression, pre-deployment validation, approval, deployment, rollback verification, and post-deployment confirmation. Does not authorize production deployments directly; all production-impacting actions require human approval from the environment owner or release manager. Does not replace a qualified Power Platform admin or ALM specialist.

0
installs
▌
Typescript Public API And Declaration Governance · vincentchuwaichow bundle
Use this skill to statically review a published TypeScript type surface: `.d.ts` correctness and emit strategy (`declaration`, `isolatedDeclarations`, rollups, API reports), public-versus-accidental exports, breaking-change classification and the semver decision, the consumer compilation matrix, and compile-time type-contract tests (`expectTypeOf`/`assertType` under `--typecheck`, `@ts-expect-error`). Reads declarations and configuration only; it never compiles, publishes, or runs the package.

0
installs
▌
Salesforce Data Exposure Escalation Protocol · vincentchuwaichow bundle
Salesforce Data Exposure Escalation Protocol

0
installs
▌
Databricks Live Unity Catalog Grant Guard At Azure · vincentchuwaichow bundle
Mutating-runtime live guard for Unity Catalog privilege management on Azure Databricks. Executes exactly ONE GRANT or REVOKE of a single privilege on a single Unity Catalog securable (schema, table, or volume) to a single principal — with explicit written human approval, dry-run preflight, prior-state capture, and a named rollback owner. Phase B strictly-scoped controlled mutation; never bulk, never wildcard, never ALL PRIVILEGES, never metastore/account admin grants.

0
installs
▌
Typescript Business Critical Automation Governance · vincentchuwaichow bundle
Use this skill to statically review whether a privileged TypeScript automation (backfill, migration, reconciliation script) may run and under what controls: dry-run coverage of the write path, technical and business idempotency, blast-radius bounds, approval separation, checkpoint/resume, rollback and reconciliation evidence, audit trail, and a named inverse operation — with particular attention to type-stripped, never-type-checked execution holding production credentials combined with floating-promise partial commits. Never executes anything; reads script source and named credential scope only.

0
installs
▌
Kubernetes Live Network Architecture Mutation Guard · vincentchuwaichow bundle
Guard live kubectl apply, patch, or create operations on Kubernetes networking *architecture* surface — Service spec (`internalTrafficPolicy`, `externalTrafficPolicy`, `topology-mode`, `trafficDistribution`), CoreDNS Corefile, NodeLocal DNSCache install, Gateway API resources (Gateway / HTTPRoute / GRPCRoute / TLSRoute / ReferenceGrant), and ClusterMesh peer Secrets. HARD REFUSE one-way doors (CNI replacement, kube-proxy mode swap, MTU change, Pod / Service CIDR resize, namespace deletion). Pre-flight `kubectl auth can-i` matrix against a least-privilege ServiceAccount before any write. Use only when an intentional architecture-level networking mutation is requested against a confirmed cluster target with a documented rollback path.

0
installs
▌
Vanguard Frontier Agentic Install · vincentchuwaichow
Install all Vanguard Frontier Agentic Codex agents and companion skills into the current user's ~/.codex home after adding or installing the plugin marketplace.

0
installs
▌
AWS Maestro · vincentchuwaichow bundle
Route AWS tasks to the narrowest specialist or team of specialists from the 42-agent catalog. Use when you do not already know the specialist. Not for direct AWS answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live deployment or production-change specialist.

0
installs
▌
GCP Maestro · vincentchuwaichow bundle
GCP Maestro routing skill. Classify the user's GCP task, select the narrowest specialist agent or the right team of specialists from the catalog, and dispatch them — single specialist for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatch live-guard agents. Understands GCP's global VPC model, resource hierarchy (org→folder→project), and IAM inheritance before routing any networking or identity task.

0
installs
▌
Oci Maestro · vincentchuwaichow bundle
OCI Maestro Routing Skill

0
installs
▌
PHP Maestro · vincentchuwaichow bundle
Route PHP-board governance tasks to the narrowest specialist or a genuinely multi-domain parallel team from the PHP catalog. Use when you do not already know which PHP specialist handles the task. Not for direct PHP answers or specialist review; Maestro classifies, dispatches, and hands off to php-board-chair-agent (or the named owning human until one exists) only. Detects and refuses live-mutation or destructive requests (deploy, database migration in prod, force-push), requiring explicit human confirmation before any such action. Treats security, supply-chain, and runtime-EOL findings as blocking hard gates that are never averaged into an approval.

0
installs
▌
Sap Maestro · vincentchuwaichow bundle
Route SAP AI workflow requests to the correct domain skill using taxonomy classification, a routing table, and dispatch mode selection. Use when an incoming request spans multiple SAP domains (BTP, S/4HANA, SuccessFactors, Ariba, etc.) and the correct downstream skill or agent must be identified before any action is taken. Does not touch live systems.

0
installs

760 published skills · page 2 of 8