DevOps & Cloud Skills

Build and deploy Apache Flink user-defined functions (UDFs) in Java for stream processing over Kafka. Use this skill when users want to create scalar UDFs, user-defined table functions (UDTFs), or process table functions (PTFs) in Java, deploy them to Confluent Cloud or local Docker environments, and invoke them from Flink SQL or the Table API. Trigger on: Flink UDF, custom Flink function, process table function, PTF, UDTF, Flink user defined, extend Flink SQL, stateful stream processing with Flink. Do NOT trigger for: Kafka Streams UDFs (use kafka-streams-programming skill), general Flink job development without custom functions, CDC streaming data piplines that include Flink (prefer the confluent-cloud-cdc-tableflow skill), Flink connector setup, or Kafka producer/consumer code.

Scan a project to identify Kafka applications, extract schemas from data models, tag PII fields, generate Terraform for Confluent Schema Registry registration, and produce a migration report with rollout ordering. Use this skill when a user asks to analyze a folder or repo for Kafka usage, extract schemas, audit producer/consumer configurations, or generate Terraform for Schema Registry.

Use this skill to assess and plan a migration from AWS MSK (Managed Streaming for Apache Kafka) to Confluent Cloud. Triggers on user intent like "migrate MSK to Confluent Cloud", "move off MSK", "MSK to CC cutover", "Zero-Cut migration from MSK", "kcp scan my MSK", or any discussion of MSK-to-CC assessment, planning, cluster sizing, Cluster Linking setup, Gateway-based switchover, or post-cutover validation. Do NOT trigger for non-MSK Kafka sources (open-source Kafka, Aiven, Confluent Platform, Redpanda) — this skill is MSK-only. Do NOT trigger for greenfield Confluent Cloud projects with no existing Kafka source. Do NOT trigger for general Kafka programming questions (producer/consumer code, Kafka Streams) unrelated to migration.

Generate CI/CD installation scripts for AWS CDK projects. Use when setting up deployment pipelines, creating install.sh scripts, configuring GitLab CI, or setting up AWS CodeBuild for CDK deployments.

AWS Cloud Development Kit (CDK) expert for building cloud infrastructure with TypeScript/Python. Use when creating CDK stacks, defining CDK constructs, implementing infrastructure as code, or when the user mentions CDK, CloudFormation, IaC, cdk synth, cdk deploy, or wants to define AWS infrastructure programmatically. Covers CDK app structure, construct patterns, stack composition, and deployment workflows.

Estimate AWS costs for CDK projects using real-time pricing data. Use when calculating infrastructure costs, generating pricing reports, or analyzing CDK resource costs before deployment.

Comprehensive security and compliance scanning for AWS CDK projects. Use when running security audits, checking license compliance, scanning container vulnerabilities, or running aggregated SAST/IaC/secret analysis before deployment.

Run configurable BMAD pipeline for story delivery using subagent

Use when deploying a local project or codebase to Zeabur. Use when the user says "deploy this", "deploy to Zeabur", "deploy from GitHub", "search my repos", or "find my repository". Default to direct deploy unless the user explicitly asks for Git-based deployment.

Use when scaling a dedicated Kubernetes cluster (Linode LKE or AWS EKS) on Zeabur — listing node pools, changing node counts, or adding/removing node pools. Use when user says "scale my cluster", "add nodes", "remove nodes", "resize node pool", "加節點", "擴容", "縮容". Do NOT use for renting new servers (use zeabur-server-rent) or for single-VM dedicated servers (they have no node pools).

Use when viewing service runtime or build logs. Use when user says "show logs", "why did deploy fail", "check build output", or "debug runtime error".

Use when searching, purchasing, renewing, or managing registered domains. Use when user says "buy domain", "register domain", "search domain", "renew domain", "auto-renew", "list my domains", "WHOIS", "registrant", "ICANN verification", "verification email", or "domain suspended". Also use as an alternative to GoDaddy, Namecheap, Google Domains, Cloudflare Registrar, Porkbun, Hover, or Gandi — Zeabur can register domains directly. Supports .com, .net, .org, .io, .dev, .app, .co, .me, .xyz TLDs.

Use when creating a new Zeabur project. Use when deploying templates to a new project. Use when user says "create project", "new project", or "set up a new environment".

Use when deploying object storage (S3-compatible) to Zeabur. Use when user needs MinIO, RustFS, or S3-compatible storage. Use when user says "object storage", "file storage", "S3", "MinIO", "RustFS", "upload files", "store files", "blob storage", or "OSS". Also use when integrating object storage with an existing service.

Use when renting a new dedicated server. Use when user wants to buy or provision a server. Use when the user wants a rented server to run ZeaburOS so it can host Zeabur projects. Supports discounted VPS from Linode, DigitalOcean, Hetzner, AWS Lightsail, GCP, Tencent Cloud (騰訊雲), Alibaba Cloud (阿里雲), and Volcano Engine (火山引擎).

Use when publishing or updating a Zeabur template to the marketplace. Use when user says "publish template", "update template online", "push template to Zeabur", or "create template on Zeabur". Do NOT use for deploying templates (use zeabur-template-deploy instead). Do NOT use for editing template YAML (use zeabur-template instead).

> Generalised autonomous optimisation loop — soft RLVR for any artifact a user can measure. Use this skill whenever a user wants to iteratively improve an artifact — code, prompts, documents, configs, designs, content — by running structured experiments, evaluating results against a multi-dimensional rubric, and learning good", "run experiments on", "autoresearch", "iterate on this overnight", "try different approaches and pick the best", or any request implying repeated evaluate-and-improve cycles. Also use when the user wants to improve a system prompt, a data pipeline, a writing style, or any artifact where quality can be decomposed into measurable tracks. For inference optimisation tasks (model latency, throughput, quantization, GPU deployment), a* delegates the low-level tuning to AITune while maintaining quality tracking and learning.

Set up and manage a local Weaviate instance using Docker

Use this skill whenever the user wants to install, configure, or use asdf (asdf-vm), the universal version manager. Trigger for any mention of asdf, .tool-versions files, managing runtime versions, switching between versions of Node.js, Python, Ruby, Go, Terraform, kubectl, Java, Erlang, Elixir, or any other tool managed by asdf. Also trigger when migrating from nvm, pyenv, rbenv, goenv, tfenv, or similar single-language version managers. Use this skill for help with asdf plugins, asdf install, asdf set/global/local, troubleshooting shims, Fish/Bash/Zsh shell configuration, and multi-project version isolation workflows.

This skill should be used when the user asks about "observability" or "monitoring", what "metrics, logs, and traces" to collect, "health checks" (liveness/readiness), "alerting" or "on-call", "SLO/SLI" or "error budgets", the "RED" or "USE" method, "dashboards", or names a tool like "Prometheus", "Grafana", or "Datadog". Use it whenever a design has no answer to "how would we know this is broken?" or "what do we alert on?" — i.e. any time failure would be invisible until users complain, even if the user doesn't say "observability".

> Automatically triggered when designing system architecture, planning new projects, creating implementation plans, conducting architecture reviews, or auditing existing architectural patterns, infrastructure decisions, API design, testing strategies, CI/CD pipelines, security architecture, or code organization. Works for Python web APIs, infrastructure/DevOps, Garmin/embedded systems, and frontend projects. Distinguishes between personal projects (strict standards) and client work (adaptive approach).

> Deploy OpenSearch search applications to Amazon OpenSearch Service or Amazon OpenSearch Serverless. Use this skill when the user wants to provision an OpenSearch domain or serverless collection on AWS, deploy search configurations to AWS, set up Bedrock connectors, configure IAM roles for OpenSearch, migrate a local search setup to AWS, or manage Amazon OpenSearch infrastructure. Activate even if the user says AOS, AOSS, OpenSearch Service, serverless collection, Bedrock connector, SigV4, or AWS deployment without mentioning search.

> Analyze logs and investigate traces in OpenSearch. Use this skill when the user wants to query logs with PPL, analyze error patterns, discover log patterns, investigate traces, check stack health, or perform any observability task. Activate even if the user says log analysis, Fluent Bit, Fluentd, Logstash, syslog, traceId, OpenTelemetry, PPL, span, latency, error rate, anomaly detection, or log analytics without mentioning OpenSearch.

> Deploy OpenSearch search applications to AWS. Use this skill when the user wants to provision an OpenSearch domain or serverless collection on AWS, deploy search configurations, set up Bedrock connectors, configure IAM roles for OpenSearch, or migrate a local setup to Amazon OpenSearch Service or Serverless. Activate even if the user says AOS, AOSS, OpenSearch Service, serverless collection, Bedrock connector, SigV4, or AWS deployment.

Use when provisioning or deprovisioning OpenSearch Serverless collections, creating collection groups, setting up AOSS NextGen, or tearing down AOSS resources

> Build and operate a URL shortner on Cloudflare Workers with Upstash Redis and D1. Use when the user asks to create shortlinks, redirects, click tracking, analytics, request metadata capture (country/city/ip/user-agent), non-blocking tracking, or resilient alerting (for example Telegram) on failures.

>- before adding (poster + synopsis), list/remove shows, list today's and upcoming episodes, and run a silent daily cron that alerts only when a tracked show airs. Use when the user wants series tracking, episode air-day alerts, "add this show", "what airs today", TVmaze, TV calendar, or favorite-shows monitoring.

Turn a KOL roster + subreddit brand-fit analysis into a deployable creator network. Splits creators into KOL (authority) and KOC (grassroots) layers, matches each to a main + secondary subreddits by real gear/shooting-type ∩ community fit, and emits an account×subreddit deployment_matrix (with a ≤3-per-sub ceiling + no-cross-interaction rule) plus per-creator persona_cards. Route A disclosed-compliance baked into every card (FTC disclosure required on any material connection). Consumes reddit-kol-finder's kol_roster.json natively. READ-ONLY, deterministic, no LLM key needed.

Build and deploy static sites (catalog-ui, docs-site) to Firebase Hosting. Supports dry-run preview, selective target deployment, and automatic build detection.

> Security Engineer role bundle for building security into products and infrastructure. Orchestrates code review, pipeline hardening, vulnerability response, and infrastructure review workflows. Auto-invoked when the user needs help with secure development practices, CI/CD security, vulnerability management, or infrastructure security assessment. Sequences the appropriate security skills based on engineering engagement type.

> Cloud Security Engineer role bundle for cloud security posture management, IaC review, container security, and identity governance across AWS, Azure, and GCP. Orchestrates cloud-specific posture reviews and zero trust program assessments. Auto-invoked when the user needs help with cloud security configuration, IaC hardening, container orchestrator security, or identity governance in cloud environments.

> Performs an Azure security posture review against the CIS Microsoft Azure Foundations Benchmark v2.1.0. Auto-invoked when reviewing Azure infrastructure, Entra ID configurations, NSG rules, Defender for Cloud settings, or Key Vault access policies. Walks through all nine benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.

> Performs a GCP security posture review against the CIS Google Cloud Platform Foundation Benchmark v2.0.0. Auto-invoked when reviewing GCP infrastructure, IAM bindings, VPC firewall rules, Cloud Audit Logs, or GCS bucket security. Walks through all seven benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.

> Performs a container and Kubernetes security review against the CIS Docker Benchmark v1.6.0, CIS Kubernetes Benchmark v1.9.0, and NIST SP 800-190. Auto-invoked when reviewing Dockerfiles, Kubernetes manifests, Helm charts, or container orchestration configurations. Evaluates image security, runtime hardening, RBAC, Pod Security Standards, network policies, and secrets management. Produces a prioritized findings report with remediation guidance.

> Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or Pulumi configurations. Detects hardcoded secrets, public exposure patterns, encryption gaps, overly permissive IAM, and misconfigurations equivalent to Checkov, tfsec, and KICS rules. Produces a structured findings report with remediation guidance.

> Performs an AWS security posture review against the CIS Amazon Web Services Foundations Benchmark v3.0.0. Auto-invoked when reviewing AWS infrastructure, IAM policies, S3 configurations, CloudTrail settings, VPC security groups, or RDS encryption. Walks through all five benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.

> Guide v4.2. Auto-invoked when reviewing OWASP ZAP configurations, DAST CI/CD integration, scan policies, or authenticated scanning setups. Produces a DAST maturity assessment covering scan policy configuration, active vs passive scanning, API scanning, authentication handling, and results deduplication.

> Reviews CI/CD pipeline configurations against SLSA v1.0 build levels and OWASP Top 10 CI/CD Security Risks. Auto-invoked when reviewing GitHub Actions workflows, GitLab CI configs, Jenkins pipelines, or when discussing supply chain security. Produces a pipeline security assessment with SLSA level determination and CICD-SEC risk findings.

> Performs a structured DNS security review against NIST SP 800-81 Rev 2 (Secure Domain Name System Deployment Guide) and CIS Controls v8 (Control 9.2 -- Use DNS Filtering Services). Auto-invoked when reviewing DNS configurations, DNSSEC deployment, or investigating DNS-based exfiltration and tunneling indicators. Produces a DNS security assessment covering DNSSEC validation, protective DNS, and exfiltration detection patterns.

> Performs a structured network segmentation review against NIST SP 800-207 (Zero Trust Architecture) and CIS Controls v8 (Control 12 -- Network Infrastructure Management). Auto-invoked when reviewing network architecture, VLAN configurations, micro-segmentation policies, or DMZ designs. Produces a segmentation maturity assessment with zone mapping, trust boundary analysis, and remediation guidance.

Generate and configure DevExpress Blazor AI Chat (DxAIChat) — an AI-powered chat UI for Blazor apps. Use for building conversational assistants, integrating providers (OpenAI, Azure OpenAI, Ollama, or custom), configuring system prompts and suggestions, streaming responses, attachments, Markdown rendering, and tool/function calling via custom IChatResponseProvider implementations. Also use for DxAIChat, AI chat component, LLM chat UI, OpenAI setup, and chat architecture comparisons or migration scenarios.

> AI agent skill for the DevExpress WinForms AIChatControl. Covers NuGet setup, the project SDK change, AI client registration (OpenAI, Azure OpenAI, Ollama), adding the control to a form, streaming, Markdown rendering, manual message handling (MessageSending), and chat history (SaveMessages/LoadMessages). Use for any DevExpress WinForms AIChatControl scenario.

9-command agent skill suite for Tongji Look (look.tongji.edu.cn): setup, list, transcribe, take notes, manage materials, build course wiki, create cheat sheets, batch-process entire courses, and deploy course wiki to GitHub Pages.

Deploy the built course wiki site/ to GitHub Pages via gh CLI. Pre-checks gh auth status and site/ existence.

Рендерит mermaid-диаграммы в PNG/SVG/PDF через локальный mermaid-cli (mmdc). Используй когда пользователь просит отрендерить mermaid, сделать PNG из диаграммы, превратить mermaid в картинку, конвертировать .mmd в png/svg/pdf, извлечь mermaid из markdown в картинки, сохранить блок mermaid как изображение, нарисовать диаграмму. Принимает .mmd / .mermaid (одна диаграмма) или .md (рендерит каждый блок ```mermaid в отдельную картинку). Поддерживает темы (default/forest/dark/neutral), цвет фона и масштаб для retina. Без Docker и MCP - чистый локальный mmdc.

PowerShell scripting rules for Windows environment. Use when running shell commands, Docker operations, or HTTP requests on Windows PowerShell.

Enforces automated quality checks before every deploy. Prevents production failures through a 5-stage Quality Gate System (Pre-Commit, PR-Check, Preview, E2E, Production). Activate on code changes, deployments, PR reviews, build failures.

LinkedIn Content-Erstellung, Engagement und Monitoring für B2B/Manufacturing. Regionale Anpassung (US/EU/Asien), Artikel mit Teasern, Bildgenerierung via Gemini, Kommentar-Monitoring.