DevOps Claude Skills
4 344 DevOps skills from 392 authors. They ship releases, run infrastructure and keep watch over what is deployed. Half of them fit into 2 095 tokens or less — that is what one costs your context window when the agent loads it. 513 ship runnable scripts rather than instructions alone. 28 of them cannot work without an MCP server, most often rube. We also found 633 copies of these same skills sitting in other people's repositories — counted once here, not 633 times.
4 344 unique 392 authors 2 063 updated this month 579 from vendors
为服务或平台设计可审查的可靠性治理方案，覆盖用户旅程 SLI/SLO、错误预算政策、容量模型、依赖与故障域、韧性和恢复、事故准备、变更风险分级及验证门。用于新服务上线前可靠性评审、重大架构或迁移设计、SLO/错误预算建立与复核、容量和灾备规划、事故准备度检查；不用于直接排障、部署、修改监控或操作生产系统。
Send short status descriptions in chat for long-running tasks. Use when you need to provide periodic updates during multi-step operations, confirm task completion, or notify of failures. Includes automated periodic monitoring that sends updates every 5 seconds, status message templates, and a helper function for consistent status reporting.
Master AI-powered test automation with modern frameworks, self-healing tests, and comprehensive quality engineering. Build scalable testing strategies with advanced CI/CD integration. Use PROACTIVELY for testing automation or quality assurance.
蒸馏Kelsey Hightower的Kubernetes布道、云原生哲学、实用主义的实用框架
Automatic trigger monitoring for leads
Track large cryptocurrency transactions and whale wallet movements across multiple blockchains. Monitor exchange inflows/outflows, manage watchlists, Track large cryptocurrency transactions and whale wallet movements in real-time. Use when tracking large holder movements, exchange flows, or wallet activity. Trigger with phrases like "track whales", "monitor large transfers", "check whale activity", "exchange inflows", or "watch wallet".
Build custom OpenTelemetry Collector distributions with OCB (OpenTelemetry Collector Builder). Use when authoring or debugging a builder manifest (builder.yaml), choosing component and provider versions, building a collector that bundles a custom or out-of-distribution component, setting up CI or Docker builds of a distribution, or troubleshooting OCB build failures. Triggers on "ocb", "collector builder", "custom collector distribution", "builder manifest", "builder-config", and version-mismatch errors from OCB builds.
Expert guidance for configuring and deploying the OpenTelemetry Collector. Use when setting up a Collector pipeline, configuring receivers, exporters, or processors, deploying a Collector to Kubernetes or Docker, or forwarding telemetry to Dash0. Triggers on requests involving collector, pipeline, OTLP receiver, exporter, or Dash0 collector setup.
Configures trace spans, defines custom metrics, sets up log exporters, and optimizes sampling strategies for OpenTelemetry instrumentation. Use when instrumenting applications with traces, metrics, or logs. Triggers on requests for observability, telemetry, tracing, metrics collection, logging integration, or OTel setup.
> Receive and verify AWS SNS (Amazon Simple Notification Service) webhooks over HTTP/HTTPS. Use when setting up an SNS HTTP subscription endpoint, confirming a subscription (SubscriptionConfirmation / SubscribeURL), verifying SNS message signatures (SigningCertURL, SignatureVersion 1 SHA1 / 2 SHA256), or handling Notification and UnsubscribeConfirmation messages.
> Hookdeck Event Gateway — webhook infrastructure that replaces your queue. Use when receiving webhooks and need guaranteed delivery, automatic retries, replay, rate limiting, filtering, or observability. Eliminates the need for your own message queue for webhook processing.
> Hookdeck Outpost — open-source infrastructure for sending webhooks and events to user-preferred destinations (HTTP, SQS, RabbitMQ, Pub/Sub, EventBridge, Kafka). Use when building a SaaS platform that needs to deliver events to customers.
> Receive and verify Vercel webhooks. Use when setting up Vercel webhook handlers, debugging signature verification, or handling deployment events like deployment.created, deployment.succeeded, or project.created.
Testany pipeline 编排与 CRUD - 基于 automation design 或现有 case keys 创建执行与编排单元
Write Runbook, 撰写运维手册。Use when: LLD 完成后需要编写部署、回滚、监控、故障处理等运维文档。
>- Add container image scanning steps to existing Harness pipelines using Harness STO scanners. Supports Harness SCA (default), Aqua Trivy, Grype, Snyk, Prisma Cloud, Anchore, Black Duck, and Wiz. Supports Docker Hub, ECR, GCR, and other Third-Party registries as well as Harness and Local registries. Can insert the scan step into an existing CI stage or create a dedicated SecurityTests stage. Use when asked to add container scanning, configure image scanning, set up SCA for Docker images, scan container images for vulnerabilities, or add container security checks to a pipeline. for container, scan container before deploy, add Trivy scan, add Grype scan, add Snyk container scan.
Generate Harness Infrastructure Definition YAML for deployment targets and create via MCP. Use when user says "create infrastructure", "infrastructure definition", "k8s cluster config", "deployment target", or wants to configure where workloads run.
Generate Harness Connector YAML for integrations and create/test via MCP. Use when user says "create connector", "git connector", "aws connector", "docker connector", "cloud connector", or wants to connect Harness to external services.
>- Generate Harness Environment YAML for deployment targets and create via MCP. Supports PreProduction and Production types with environment variables, manifest overrides, and multi-environment setup (dev, staging, prod). Use when asked to create an environment, set up staging, configure production, define environment, setup dev, setup staging, setup production, environment variables, environment overrides.
>- Generate Harness v1 simplified Pipeline YAML using the new concise syntax with flat structure, ${{ }} expressions, script field, and action steps. Supports CI stages (run, run-test, background), CD stages (service/environment with action steps for K8s, Helm, ECS), approval (stage-level and inline), parallel execution, matrix/for/while strategies, caching, volumes, and templates. Use when asked for a v1 pipeline, simplified pipeline, new pipeline format, or when user specifically requests v1 syntax. Do NOT use for pipeline format, create v1, modern pipeline syntax.
>- Generate Harness v0 Pipeline YAML for CI/CD workflows and create them via MCP. Supports CI stages (build, test, Docker push), CD stages (Kubernetes, Helm, ECS, serverless), approval gates, parallel execution, matrix strategies, and failure rollback. Use when asked to create a pipeline, build pipeline, deployment pipeline, CI/CD workflow, or set up Harness pipelines. Do NOT use for v1 simplified pipelines Harness pipeline, Kubernetes deploy pipeline.
>- Generate Harness Secret definitions and manage secrets via MCP v2 tools. Supports SecretText, SecretFile, SSHKey, and WinRmCredentials types with configurable secret managers (Harness built-in, HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager). Use when asked to create a secret, store credentials, manage API keys, set up SSH keys, configure WinRM credentials, secret file, SSH key, API key, password, credentials, secret manager, store secret.
>- Create OPA governance policies for Harness via MCP. Define policies that enforce compliance rules on pipelines, services, environments, feature flags, artifacts, code repositories, templates, SBOM, security tests, Terraform, GitOps, connectors, secrets, and more. Use when asked to create, write, fix, or explain an OPA policy, Rego rule, deny rule, governance policy, compliance rule, or compliance rule, rego policy, deny rule, enforce policy, security policy, supply chain governance.
>- Assess deployment readiness via Harness MCP. Run pre-deployment readiness checks with go/no-go recommendations, analyze environment drift between source and target environments, and provide data-driven canary rollout decisions. Use when asked to check if a service is ready to deploy, compare environments before deployment, or decide whether to promote a canary. Do NOT use for running pipelines (use run-pipeline instead) or debugging failures (use debug-pipeline instead). canary decision, promote canary, rollback canary, go no-go, deployment checklist, production readiness, canary analysis.
>- Generate Harness Service YAML for deployable workloads and create via MCP. Supports Kubernetes, Helm, ECS, Serverless, SSH, and WinRm deployment types with artifact sources from Docker Hub, ECR, GCR, ACR, Nexus, and S3. Use when asked to create a service, define a Kubernetes service, set up a Helm chart service definition, Kubernetes service, Helm service, ECS service, deployment service, artifact source.
>- Diagnose Harness pipeline executions via MCP. Analyzes any execution (failed or successful) to produce structured reports with stage/step breakdown, timing, bottlenecks, failure details, chained pipeline drill-down, and execution logs. Use when asked to debug a pipeline, investigate a failure, find out why a build failed, analyze pipeline errors, check execution logs, review execution performance, or failure, pipeline error, execution logs, fix pipeline, execution bottleneck, slow pipeline.
>- Add an SLSA Verification (SlsaVerification) step to an existing Harness pipeline to verify SLSA provenance attestations and optionally enforce OPA policy sets on provenance data. Supports CI and CD (Deployment) including CI-only pipelines — append a Deploy stage via Phase 3b when verifying before deploy. Supports Docker, ECR, GCR, GAR, ACR, HAR, and Local artifacts. Only works with existing pipelines. Use when asked to verify SLSA, enforce SLSA policies, add SLSA verification step, validate SLSA attestation, or gate deploy on SLSA provenance. SlsaVerification, verify SLSA attestation, add SLSA verify step.
>- Add an SBOM Policy Enforcement (SscaEnforcement / CdSscaEnforcement) step to an existing Harness pipeline to verify SBOM attestations and apply OPA SBOM policy sets. Supports CI, Security, and CD (Deployment) including CI-only pipelines — if no Deploy stage exists, add one via Phase 3b (service, environment, infra, containerized step group) then place CdSscaEnforcement before deploy. Supports container images and repositories from Artifact Registry, Third-Party registries (docker, ECR, GCR, GAR, ACR), and Git. Matches Pipeline Studio SBOM Policy Enforcement UI. Only works with existing pipelines (may append a Deploy stage). Use when asked to enforce SBOM policies, add SBOM policy enforcement, verify SBOM attestation in pipeline, or block non-compliant components. SscaEnforcement, add policy enforcement after SBOM.
>- provenance and optionally attest with Cosign (keyless, key-based, or Vault). Supports container images (Docker, ECR, GCR, GAR, ACR, HAR) and Harness Local Stage artifacts. Place after image build/push; run sequentially after SBOM steps, not in parallel. Only works with existing pipelines. Use when asked to generate SLSA, add SLSA provenance, SLSA Generation step, attest SLSA, or configure SLSA Level 3 provenance in a pipeline. SlsaGeneration, provenance step, SLSA attestation, add provenance step.
>- Manage Harness Artifact Registry (AR) via MCP. Configure private registries for Docker, Helm, Maven, npm, and PyPI artifacts, set up upstream proxies for caching public images, configure RBAC and cross-region replication, and define security scanning policies with CVE thresholds and license compliance checks. Use when asked to set up an artifact registry, configure Docker or Helm repositories, manage artifact security scanning, or set up replication. Do NOT use artifact registry, docker registry, helm repository, artifact security, image scanning, private registry, artifact replication, CVE threshold, license compliance, SBOM.
>- Incident response and analysis via Harness MCP. Correlate incidents with recent deployments, assess blast radius and downstream service impact, and generate comprehensive postmortem documents. Use when asked to investigate an incident, determine if a deployment caused an issue, assess blast radius, or create a postmortem. Do NOT use for pipeline debugging incident, deployment correlation, blast radius, postmortem, root cause, service impact, outage analysis, rollback decision, incident timeline, deployment caused, which deploy.
Monitor GitOps application health, sync status, and manage ArgoCD deployments via Harness MCP. Use when user says "gitops status", "argocd status", "application sync", "gitops health", "is my app in sync", or asks about GitOps applications.
>- Manage Harness deployment freeze windows via MCP. Create, list, get, update, and delete project-level freeze windows; toggle them Enabled/Disabled; and get or enable/disable the project-level global freeze. Use when asked about freeze windows, deployment freezes, change freezes, release blackouts, deployment freeze, change freeze, release blackout, maintenance window, holiday freeze, pause deployments, block pipeline execution, global freeze.
>- Manage Harness Infrastructure as Code Management (IaCM) via MCP. Configure Terraform workspaces with remote state and RBAC, set up continuous drift detection with auto-remediation, design multi-tier change approval workflows, and estimate infrastructure costs before deployment. Use when asked to manage Terraform workspaces, detect infrastructure drift, set up approval workflows for infrastructure changes, or estimate Terraform costs. Do NOT use for creating Harness infrastructure definitions (use create-infrastructure instead) or OPA policies infrastructure cost, IaCM, state management, change approval, terraform plan, infracost, infrastructure governance.
>- Assist with Harness Service Reliability Management (SRM) tasks that the MCP server currently reports from deployment/execution history, and drafting operational runbooks. Use when asked about SLOs, error budgets, burn-rate alerts, on-call handover, runbooks, or incident triage. Do NOT use for DORA metrics (use dora-metrics instead) or chaos experiments (use runbook, service reliability, incident response, on-call shift.
>- Migrate Harness pipelines from v0 to v1 simplified format via MCP tools. Converts expressions from angle-bracket to ${{ }} syntax, lowercases type names, simplifies structure, and preserves variables, failure strategies, and conditional logic. Use when asked to migrate a pipeline, convert v0 to v1, pipeline, convert to v1, upgrade pipeline, v0 to v1, modernize pipeline, simplified format.
>- Execute and monitor Harness pipeline runs via MCP tools. Find pipelines, provide runtime inputs, trigger executions, monitor progress, handle approvals, retry failures, and abort running or stuck executions. Use when asked to run a pipeline, execute a deployment, trigger a build, start a pipeline, deploy a run pipeline, execute pipeline, deploy, start build, trigger pipeline, check execution, approve deployment, retry failed pipeline, abort execution, stop pipeline, interrupt execution, kill stuck pipeline.
>- Optimize Harness CI/CD pipeline performance via MCP. Configure parallel test execution with Test Intelligence, design multi-layer caching strategies, analyze pipeline bottlenecks with stage-level timing breakdowns, optimize cache hit rates, and design monorepo CI pipelines with selective builds. Use when asked to speed up pipelines, improve cache hit rates, set up parallel testing, optimize build times, or configure monorepo builds. Do NOT use for creating new pipelines (use create-pipeline instead) or debugging failures (use debug-pipeline instead). build optimization, caching strategy, monorepo pipeline, pipeline bottleneck, build speed.
>- Add an Artifact Signing (SscaArtifactSigning) step to an existing Harness pipeline to Cosign-sign container or local-stage artifacts with keyless, key-based, or Vault signing. Supports Third-Party registries (Docker, ECR, GCR, GAR, ACR), Harness Artifact Registry (HAR), and Harness Local Stage artifacts. Place after image build/push; optionally upload .sig to the registry. Only works with existing pipelines. Use when asked to sign artifacts, add artifact signing, Cosign sign image, attach signature to registry, or configure SscaArtifactSigning. SscaArtifactSigning, attach signature, sign container image, HAR signing.
>- Add an Artifact Verification (SscaArtifactVerification) step to an existing Harness pipeline to verify Cosign signatures on container or local-stage artifacts. Supports CI, Security, and CD Deploy (containerized step group). Supports Third-Party registries (Docker, ECR, GCR, GAR, ACR), Harness Artifact Registry (HAR), and Harness Local Stage artifacts. Only works with existing pipelines. Use when asked to verify signed artifacts, verify artifact signature, verify-sign, validate Cosign signature, or configure SscaArtifactVerification. SscaArtifactVerification, verify signed image, verify Cosign, HAR verification.
>- Rigorous multi-agent deep-dive analysis for complex investigative tasks — auditing codebases, evaluating strategies or systems, validating designs, doing open-ended research. Deploys 4–6 specialist agents in parallel across distinct lanes, then synthesis, then adversarial red-team review, then optional patching — producing structured markdown research files plus a plain-English executive briefing with honest 1–10 confidence ratings. ALWAYS invoke when the user says any of "deep dive", "thorough audit", "rigorous analysis", "comprehensive review", "audit this codebase", "analyze the strategy", "evaluate this design", "review this thoroughly", or "research deep dive". Also invoke proactively for any open-ended investigative task involving a codebase, strategy, system design, or research question that warrants 30+ minutes of structured analysis — even when the user doesn't use these exact phrases.
Use when the user wants to prepare a local project for GitHub or public release. Runs a release-readiness sweep over README structure, bilingual docs, commit hygiene, sensitive-data exposure, broken links, markdown rendering, project layout, tests, CI, Docker, and final cleanup. Fixes issues only inside the target repo and treats secrets/history rewriting as explicit high-risk gates. NOT for publishing without user approval or for private operational runbooks that should not be open-sourced.
>- Coordinate agents via the AMQ CLI for file-based inter-agent messaging. Use this skill whenever you need to send messages to another agent (codex, claude, or any named handle), check your inbox, drain queued messages, set up co-op mode between agents, join a swarm team, route messages across projects, or diagnose delivery issues. Also use it when you receive a message and need to know how to reply, inspect receipts, or handle priority. Covers any multi-agent coordination task where agents need to talk to each other — review requests, questions, status updates, decision threads, wake notifications, and orchestrator integration (Symphony, Kanban). For collaborative spec/design workflows specifically, prefer the /amq-spec skill which provides structured phase-by-phase guidance. Not intended for distributed systems design (RabbitMQ, Kafka), CI/CD pipelines, or single-agent tasks with no partner.
Use when you need to create output directory structures and copy files into them for web app deployment.
Back up / restore openInvest's local state — memory/ (holdings, strategy, user profile, committee records, dream logs) + db/ (trade ledger, job run history, market-data cache) + .env (SMTP/API credentials) + user_profile.json. All of this data is .gitignore'd with no historical versions in git, so a single accidental overwrite (e.g. slipping and running some one-off migration/init script) means real data loss — no git revert available. **Proactive trigger scenarios** — "backup invest data / 备份一下 openInvest 的数据", "my holdings/strategy look wiped / 我的持仓/策略好像被清空了", "invest data is lost / invest 数据丢了", "restore invest backup / 恢复一下 invest 的备份", before any reinstall/migration of the openInvest deployment on this machine, or right before running an unfamiliar migration/init script (back up first, then act).
Extract and analyze iOS IPA, .app bundles, Mach-O binaries, .dylib, and .framework files using ipsw, otool, strings, radare2/rizin, and Ghidra headless. Reverse engineer iOS apps, extract HTTP API endpoints (URLSession, Alamofire, Moya, AFNetworking, GraphQL, WebSocket), trace call flows from ViewControllers to network layer, analyze security patterns (ATS, cert pinning, keychain, jailbreak detection), audit static iOS vulnerabilities (insecure local storage, WebView/JS-bridge, deeplink/URL-scheme hijack, weak crypto/RNG, biometric-bypass patterns, sensitive-data logging, ATS detail, privacy/tracking, entitlements risk, debug artifacts), deep-scan for cloud & SaaS credentials (Firebase, AWS, GCP, Azure, Stripe, GitHub, GitLab, Twilio, SendGrid, Slack, Telegram, web3) with false-positive minimization (placeholder allowlist, format/entropy validation, client-safe tagging), perform LLM-assisted binary reversing analysis with Ghidra scripts, fingerprint embedded third-party SDKs with CVE checking, and detect anti-tampering protections (obfuscation, anti-debug, dylib injection prevention, integrity checks). Use when the user wants to extract, analyze, or reverse engineer iOS packages, find API endpoints, follow call flows, audit app security or vulnerabilities, scan for leaked secrets, identify third-party SDKs, detect app protections, or perform deep binary analysis.
