Use when writing and deploying Kubernetes manifests for container orchestration.

View CI/CD pipeline status for a merge request or project

View GitHub Actions workflow runs and status

Resume work on a pull request by loading its context, diff, CI status, and review comments

Configure TDD enforcement via pre-commit hooks and CI coverage gates. Use when setting up test-first workflows or adding coverage gates.

Detect candidate fuzz targets and emit CI recipes for libFuzzer/AFL/cargo-fuzz/atheris/fast-check harnesses, plus OSS-Fuzz integration patterns

Detect language/toolchain and emit CI job recipes that build with runtime sanitizers (ASan/UBSan/MSan/TSan, race detectors, faulthandler)

Orchestrate production deployment with strategy selection, validation, automated rollback, and regression gates

Integrate regression testing into CI/CD pipelines with baseline comparison and merge blocking on failure

Config-driven release orchestration — reads .aiwg/release.config and walks the project's declared gates (local build, CI green, doc-sync, changelog/announcement, README, release entry, post-release housekeeping)

Audit CI workflow files for supply-chain risk — unpinned actions, unpinned container images, pull_request-triggered jobs with secret access, curl-pipe-shell installers, and bare :latest tags. Produces a structured markdown report with file:line refs.

Forensic investigation of Docker, containerd/CRI-O, and Kubernetes — inventory, escape detection, eBPF runtime monitoring, RBAC and etcd audit. Use when investigating container compromise.

AUTO-INVOKE when user mentions SDLC, requirements, architecture, ADR, use case, user story, test plan, phase gate, inception, elaboration, construction, transition, intake, deploy. SDLC framework quick reference — phase model, capability domains, and curated discovery phrases for aiwg discover.

Crash-resilient external agent loop with state persistence and CI/CD integration

Identify flaky tests from CI history and test execution patterns. Use when debugging intermittent test failures, auditing test reliability, or improving CI stability.

CI-friendly complexity enforcement gate returning pass/fail results for pipeline integration

Split large documentation (10K+ pages) into focused sub-skills with intelligent routing. Use for massive doc sites like Godot, AWS, or MSDN.

AWS, Azure, and GCP forensic investigation covering audit logs, IAM review, storage access, network flows, and compute instance forensics

Crash-resilient external loop with state persistence and CI/CD integration

SBOM analysis, build pipeline forensics, and dependency verification covering package integrity, build reproducibility, and CI/CD pipeline tampering

Switch AIWG CLI to dev mode (local repo source), rebuild, deploy dev tools, and run a health check — all via the Steward agent

One-command TDD infrastructure setup with pre-commit hooks and CI coverage gates

Update AIWG to the latest stable version and re-deploy all installed frameworks from the registry

Generate deployment configurations (Docker, Kubernetes) for the current project

Deploy AIWG frameworks and addons to the current workspace across supported providers

Build the bipartite funder↔paper analytics — per-funder paper/A-grade/mean-grade rollup, mean CD-index + novelty bias, and co-funding clusters. Runs via `aiwg corpus funder-network`.

Compute corpus-local influence/centrality metrics — per-paper CD-index + PageRank, and per-PROF-P h-index / mean-CD / mean-PageRank / betweenness / eigenvector + influence grade. Runs via `aiwg corpus profile-metrics`.

Check build and CI configuration for warning-as-error, strict typechecking, and language-specific compiler/linter floors

Netlify development best practices for serverless functions, edge functions, Blobs storage, build configuration, and deployment workflows.

Cloudflare Workers, Pages, KV, D1, R2, and Durable Objects development best practices for edge computing applications.

CI/CD best practices for building automated pipelines, deployment strategies, testing, and DevOps workflows across platforms

Bitbucket best practices for pull requests, Pipelines CI/CD, Jira integration, and Atlassian ecosystem workflows

Google Cloud Platform (GCP) development best practices for Cloud Functions, Cloud Run, Firestore, BigQuery, and Infrastructure as Code.

AWS development best practices for Lambda, SAM, CDK, DynamoDB, IAM, and serverless architecture using Infrastructure as Code.

GitLab best practices for merge requests, CI/CD pipelines, issue tracking, and DevOps workflows

Expert guidance for Micronaut framework development with compile-time dependency injection, GraalVM native builds, and cloud-native microservices

Expert guidance for Salesforce DX development with modern tooling, source-driven development, and CI/CD best practices

Azure cloud development guidelines for ARM templates, Azure Pipelines, Kubernetes, and cloud-native services.

Comprehensive DevOps engineering practices for Kubernetes, CI/CD, Bash scripting, Ansible, and cloud infrastructure.

Docker containerization best practices for building, securing, and deploying containers.

Expert in Kubernetes and DevOps with infrastructure-as-code and cloud-native patterns

Expert in Terraform infrastructure-as-code with cloud deployment patterns

World-class continuous integration and deployment - GitHub Actions, GitLab CI, deployment strategies, and the battle scars from pipelines that broke productionUse when "ci/cd, cicd, pipeline, github actions, gitlab ci, circleci, jenkins, workflow, deployment, deploy, release, blue green, canary, rollback, build, test automation, continuous integration, continuous deployment, cicd, github-actions, gitlab-ci, deployment, automation, devops, pipelines, continuous-integration, continuous-deployment" mentioned.

Expert in integrating Claude Code with CI/CD pipelines. Covers headless mode for non-interactive execution, GitHub Actions and GitLab CI/CD integration, automated code review, issue triage, and PR workflows. Essential for teams wanting AI-powered automation in their development pipelines. Use when "claude code CI/CD, headless mode, GitHub Actions claude, GitLab CI claude, automated code review, PR automation, issue triage, claude-code, cicd, automation, github-actions, gitlab, headless, pipeline, devops" mentioned.

World-class Kubernetes operations - deployments, debugging, Helm charts, and the battle scars from managing clusters that serve millions of requestsUse when "kubernetes, k8s, kubectl, helm, pod, deployment, service, ingress, configmap, secret, statefulset, daemonset, hpa, pvc, crashloopbackoff, imagepullbackoff, oomkilled, liveness probe, readiness probe, kubernetes, k8s, containers, docker, helm, deployment, devops, cloud-native" mentioned.

World-class test automation - unit, integration, e2e testing strategies, and the battle scars from flaky tests that broke CI/CD pipelinesUse when "test, testing, unit test, integration test, e2e, end to end, jest, vitest, pytest, playwright, cypress, mock, stub, fixture, coverage, tdd, bdd, flaky, test automation, testing, unit-tests, integration-tests, e2e, tdd, bdd, jest, pytest, playwright, cypress, vitest" mentioned.

Specialized skill for building production-ready serverless applications on GCP. Covers Cloud Run services (containerized), Cloud Run Functions (event-driven), cold start optimization, and event-driven architecture with Pub/Sub. Use when ", gcp, cloud-run, serverless, containers, pubsub" mentioned.

Integrating local and cloud LLMs into Unity games for AI NPCs, dialogue, and intelligent behaviorsUse when "unity llm, llmunity, unity ai npc, unity local llm, unity sentis llm, unity chatgpt, unity gpt, c# llm integration, unity, llm, llmunity, sentis, game-ai, npc, csharp, local-llm" mentioned.

Upstash QStash expert for serverless message queues, scheduled jobs, and reliable HTTP-based task delivery without managing infrastructure. Use when "qstash, upstash queue, serverless cron, scheduled http, message queue serverless, vercel cron, delayed message, qstash, upstash, serverless, message-queue, scheduling, cron, webhooks, http-messaging" mentioned.

World-class DevOps engineering - cloud architecture, CI/CD pipelines, infrastructure as code, and the battle scars from keeping production running at 3amUse when "devops, infrastructure, deployment, ci/cd, docker, kubernetes, aws, gcp, azure, terraform, cloudflare, vercel, monitoring, alerting, pipeline, container, scaling, downtime, incident, sre, devops, infrastructure, cloud, ci-cd, monitoring, reliability, sre, containers" mentioned.

Infrastructure and platform specialist for Kubernetes, Terraform, GitOps, and cloud-native architectureUse when "kubernetes, k8s, terraform, infrastructure, deployment, helm, argocd, gitops, service mesh, istio, cloud platform, kubernetes, terraform, gitops, argocd, helm, istio, aws, gcp, azure, infrastructure, platform, devops, ml-memory" mentioned.

Expert knowledge for deploying to Vercel with Next.jsUse when "vercel, deploy, deployment, hosting, production, environment variables, edge function, serverless function, vercel, deployment, hosting, serverless, edge, ci-cd, environment" mentioned.

Expert in course platform selection and implementation - comparing Teachable, Kajabi, Thinkific, and custom solutions. Covers LMS selection criteria, platform migrations, tech stack decisions, and building vs buying. Use when "course platform, lms, teachable, kajabi, thinkific, course hosting, learning management system, which platform, " mentioned.

Production deployment patterns for MCP servers including Docker, cloud platforms, monitoring, and scalabilityUse when "mcp deployment, deploy mcp server, mcp docker, mcp production, mcp monitoring, mcp, deployment, docker, production, monitoring, scaling" mentioned.

Integrating local and cloud LLMs into Unreal Engine games for AI NPCs and intelligent behaviorsUse when "unreal llm, ue5 ai npc, unreal chatgpt, blueprint llm, unreal engine ai, ue5 dialogue, unreal, ue5, llm, blueprint, cpp, game-ai, npc" mentioned.

Comprehensive markdown linting guidance using markdownlint-cli2. Run, execute, check, and validate markdown files. Fix linting errors (MD0XX rules). Configure .markdownlint-cli2.jsonc (rules and ignores). Set up VS Code extension and GitHub Actions workflows. Supports markdown flavors including GitHub Flavored Markdown (GFM) and CommonMark. Use when working with markdown files, encountering validation errors, configuring markdownlint, setting up linting workflows, troubleshooting linting issues, establishing markdown quality standards, or configuring flavor-specific rules for tables, task lists, and strikethrough.

Central authority on git hook implementations, modern best practices, and tooling for .NET/C#, JavaScript/TypeScript, Python, and polyglot repositories. Covers framework selection (Husky.Net, lefthook, Husky, pre-commit), setup workflows, Conventional Commits, semantic versioning, secret scanning (gitleaks, TruffleHog), performance optimization, CI/CD integration, testing strategies, and team collaboration patterns. Adaptive to project scale from solo developers to enterprise teams. Use for setting up git hooks, configuring pre-commit/commit-msg/pre-push hooks, integrating dotnet format/dotnet test, ESLint/Prettier, Black/Ruff/mypy, commitlint, choosing between frameworks, optimizing hook performance, enforcing code quality, automating testing, and troubleshooting hook issues.

Central authority for Claude Desktop application - the native desktop app for running Claude Code sessions. Covers installation (macOS/Windows), Git worktrees for parallel sessions, .worktreeinclude file configuration, cloud session launch, environment configuration, MCP Desktop Extensions (.mcpb), and Desktop vs CLI comparison. Assists with Desktop setup, worktree configuration, cloud sessions, and troubleshooting. Delegates 100% to docs-management skill for official documentation.

Comprehensive guidance for secure secrets management including storage solutions (Vault, AWS Secrets Manager, Azure Key Vault), environment variables, secret rotation, scanning tools, and CI/CD pipeline security. Use when implementing secrets storage, configuring secret rotation, preventing secret leaks, or reviewing credentials handling.

DevSecOps methodology guidance covering shift-left security, SAST/DAST/IAST integration, security gates in CI/CD pipelines, vulnerability management workflows, and security champions programs.

Zero Trust architecture principles including ZTNA, micro-segmentation, identity-first security, continuous verification, and BeyondCorp patterns. Use when designing network security, implementing identity-based access, or building cloud-native applications with zero trust principles.

Use when designing infrastructure self-service portals, IaC templates, or automated provisioning systems. Covers Terraform modules, Pulumi, environment provisioning, and infrastructure guardrails.

Align with cloud architecture frameworks (Microsoft CAF, AWS Well-Architected). Check alignment with pillars, identify gaps.

Use when designing edge computing architectures, serverless at edge, or distributed compute strategies. Covers edge functions, compute placement decisions, Cloudflare Workers, Lambda@Edge, and edge-native patterns.

Central authority for Claude Code enterprise security. Covers enterprise managed policies (managed-settings.json), settings precedence hierarchy, policy file locations (macOS, Linux, Windows), unoverridable organizational policies, cloud execution security (isolated VMs, network access controls, credential protection), IDE security (VS Code, JetBrains), devcontainer security, and security best practices for teams. Assists with configuring enterprise policies, understanding precedence, and implementing organizational security standards. Delegates 100% to docs-management skill for official documentation.

Central authority for Gemini CLI sandboxing and isolation. Covers Docker, Podman, macOS Seatbelt profiles, and security boundaries. Use when enabling sandboxing, choosing sandbox methods, configuring Seatbelt profiles, or troubleshooting sandbox issues. Delegates 100% to gemini-cli-docs for official documentation.

Generate configuration for a team of specialized agents. Use when setting up multi-agent workflows.

Run autonomous AI-driven penetration tests on web applications using tools like Shannon, PentAGI, and similar frameworks. Use when tasks involve setting up automated penetration testing pipelines, combining AI agents with security tools (nmap, subfinder, nuclei, sqlmap), building autonomous exploit chains, generating pentest reports with proof-of-concept exploits, or integrating AI pentesting into CI/CD pipelines. Covers the full pentest lifecycle from reconnaissance to reporting using AI orchestration.

Run AI agent code safely in isolated sandboxes with resource limits, audit trails, and kill switches. Use when someone asks to "sandbox my agent", "run agent code safely", "add guardrails to AI agent", "isolate agent execution", "audit agent actions", "prevent agent from deleting files", "restrict agent permissions", or "add safety controls to AI coding agent". Covers Docker isolation, filesystem restrictions, network policies, resource locking, and comprehensive audit logging.

Manages cloud infrastructure using Terraform (and OpenTofu). Use when the user wants to write Terraform configurations, provision cloud resources, manage state, create modules, set up multi-environment deployments, import existing infrastructure, debug plan/apply errors, migrate between providers, or implement IaC best practices. Trigger words: terraform, opentofu, infrastructure as code, IaC, tf, hcl, terraform module, terraform state, terraform plan, terraform apply, terraform import, cloud provisioning, AWS terraform, GCP terraform, Azure terraform.

Configure and optimize load balancers and reverse proxies using Nginx, HAProxy, and cloud ALBs. Use when someone asks to "set up load balancing", "configure Nginx reverse proxy", "set up HAProxy", "add SSL termination", "configure health checks", "proxy WebSocket connections", "rate limit traffic", or "set up failover". Covers L4/L7 balancing, SSL, rate limiting, caching, WebSocket proxying, and health checks.

Build integrations and automations with Salesforce. Use when a user asks to work with Salesforce CRM, manage leads, contacts, opportunities, and accounts, build SOQL/SOSL queries, create Apex triggers and classes, configure Flows, integrate via REST/SOAP/Bulk APIs, build Lightning Web Components, set up Salesforce DX projects, manage deployments, work with Platform Events, build Connected Apps, or automate Salesforce workflows. Covers Sales Cloud, Service Cloud, APIs, Apex, LWC, and DevOps.

Deploy and manage OpenClaw, a self-hosted gateway bridging messaging platforms to AI coding agents. Use when a user asks to set up OpenClaw, connect WhatsApp or Telegram or Discord to an AI agent, configure multi-agent routing, schedule cron jobs in OpenClaw, set up webhooks, manage OpenClaw channels, pair a messaging account, configure heartbeats, spawn sub-agents, or troubleshoot OpenClaw gateway issues. Covers installation, channel setup, agent configuration, cron scheduling, webhooks, and sub-agents.

Detect, exploit, and prevent Server-Side Request Forgery (SSRF) vulnerabilities. Use when tasks involve testing for SSRF in web applications, accessing internal services through SSRF, bypassing SSRF filters, implementing SSRF prevention, or auditing applications that fetch external URLs. Covers blind and non-blind SSRF, cloud metadata exploitation, and defense strategies.

Run AI agent and LLM evaluations in CI/CD pipelines — automated quality gates that fail the build when AI output quality drops. Use when someone asks to "test my AI agent", "add evals to CI", "catch prompt regressions", "compare models", "evaluate LLM output quality", "set up AI quality gates", or "benchmark my agent before deploying". Covers eval frameworks (Cobalt, Promptfoo, Braintrust), LLM-as-judge scoring, threshold-based assertions, and GitHub Actions integration.

Apply the Google Cloud Well-Architected Framework's Reliability pillar — define user-centric SLOs, eliminate single points of failure with multi-zone/region redundancy, configure horizontal autoscaling, observability via Cloud Monitoring, graceful degradation patterns, DR testing, and blameless postmortems. Use for production readiness reviews and SRE practices.

Manage Railway deployments using the CLI. Use when a user asks to deploy to Railway, check deployment status, manage Railway services, set environment variables on Railway, view Railway logs, link a Railway project, add a database on Railway, scale Railway services, manage Railway environments, rollback a Railway deployment, or run commands with Railway env vars. Covers the full deploy lifecycle from project setup to production monitoring.

Route traffic and manage TLS with Traefik reverse proxy. Use when a user asks to set up a reverse proxy, route traffic to Docker containers, auto-provision SSL certificates with Let's Encrypt, set up load balancing, configure HTTPS for multiple services, use a modern alternative to nginx for Docker, set up path-based or host-based routing, add middleware (rate limiting, auth, headers), or manage ingress for containerized applications.

Google Cloud Vertex AI for enterprise Gemini deployments — production scaling, fine-tuning, and MLOps. Use when deploying Gemini in GCP-native environments, running fine-tuning jobs, needing enterprise IAM controls, VPC isolation, batch prediction at scale, or production ML pipelines on Google Cloud.

Deploy and configure Xray proxy servers. Use when a user asks to set up VLESS, VMess, Trojan, or Shadowsocks proxies, configure Reality or TLS transport, deploy Xray with XTLS, set up fallback routing, manage multi-user access, configure traffic routing rules, set up CDN-based tunneling, build subscription links for client apps, monitor Xray traffic, or bypass network restrictions. Covers all major Xray protocols, transports, and deployment patterns.

Deploy and configure 3proxy — a lightweight universal proxy server. Use when a user asks to set up HTTP, HTTPS, SOCKS4, SOCKS5, or transparent proxies, build proxy chains, configure authentication, set bandwidth limits, manage access control lists, set up proxy rotation, create multi-port proxy servers, configure logging and traffic accounting, or deploy a lightweight proxy without heavy VPN overhead. Covers all 3proxy features including proxy chaining, ACLs, traffic shaping, and multi-protocol support.

Expert guidance for DeepEval, the open-source framework for unit testing LLM applications. Helps developers write test cases, define custom metrics, and integrate LLM quality checks into CI/CD pipelines using a pytest-like interface.

Apply the Google Cloud Well-Architected Framework's Cost Optimization pillar to evaluate workloads and recommend FinOps practices — billing exports, budgets, rightsizing via Active Assist, Spot VMs, Committed Use Discounts, storage lifecycle policies, and serverless adoption. Use for cloud cost reviews, monthly billing analysis, and architecture cost decisions.

Manage Hetzner Cloud infrastructure from the terminal. Use when a user asks to create a Hetzner server, manage VPS instances, set up firewalls, configure networks, manage volumes, create snapshots, handle SSH keys, or provision infrastructure on Hetzner. Covers the hcloud CLI for all resource types. For deploying applications on top of Hetzner servers, see coolify.

Set up, configure, and manage PicoClaw — an ultra-lightweight personal AI assistant built in Go. Use when the user mentions "picoclaw," "pico claw," "lightweight AI assistant," or wants to deploy a personal AI agent on low-resource hardware (Raspberry Pi, RISC-V boards). Covers installation, LLM provider configuration, messaging gateway setup (Telegram, Discord, Slack, LINE, DingTalk), scheduled tasks, heartbeat, workspace layout, security sandbox, and Docker deployment.

Back up and restore data with Restic. Use when a user asks to set up backups, create encrypted backups, back up to S3 or cloud storage, implement a backup strategy, restore files from backup, deduplicate backup storage, schedule automated backups, back up databases or servers, or set up offsite backups. Covers repository initialization, backup/restore operations, snapshot management, pruning, encryption, and multiple storage backends (local, S3, SFTP, B2, Azure, GCS).

AWS Bedrock — fully managed foundation models on AWS infrastructure. Use when deploying AI in AWS-native environments, needing enterprise compliance (SOC2, HIPAA), running Claude, Llama, Titan, or Mistral on AWS, leveraging Knowledge Bases for RAG, or applying Guardrails for content safety.

Manage secrets and environment variables using the Doppler CLI. Use when the user wants to set up Doppler, inject secrets into processes, manage projects and configs, upload or download secrets, create service tokens, use secret templates, or integrate Doppler with Docker, Kubernetes, or CI/CD pipelines. Trigger words: doppler, secrets manager, env vars, secret injection, doppler run, doppler setup, service token, secret rotation.

Configure authentication and authorization for Google Cloud — Application Default Credentials (ADC), service account impersonation, Workload Identity Federation for GKE and external clouds, and OIDC ID tokens for service-to- service auth. Use when setting up local dev access, deploying to Cloud Run / Cloud Functions / GKE, or calling private Google Cloud APIs.

Build CI/CD pipelines with GitHub Actions — workflows, jobs, steps, triggers, caching, artifacts, matrix builds, secrets, environments, reusable workflows, and custom actions. Use when tasks involve automating tests, builds, deployments, code quality checks, or any GitHub-triggered automation.

Expert guidance for Kyverno, the Kubernetes-native policy engine that validates, mutates, and generates resources using YAML policies (no Rego required). Helps developers enforce security policies, automate resource defaults, and ensure compliance across Kubernetes clusters.

Deploy and manage OpenVPN servers and clients. Use when a user asks to set up a VPN server, create client certificates, configure site-to-site tunnels, set up split tunneling, manage PKI with EasyRSA, harden OpenVPN security, automate client provisioning, configure routing and NAT, set up MFA for VPN, monitor connected clients, or troubleshoot VPN connectivity. Covers server deployment, PKI management, client configuration, and production hardening.

Deploy and manage WireGuard VPN tunnels. Use when a user asks to set up a WireGuard server, create peer configurations, build mesh networks, configure split tunneling, set up site-to-site links, automate peer provisioning, integrate with DNS (Pi-hole/AdGuard), manage keys, monitor connections, or build WireGuard-based overlay networks. Covers server setup, peer management, routing, DNS integration, and production deployment patterns.

Serverless vector database at the edge with Cloudflare Vectorize. Use when: building semantic search on Cloudflare Workers, RAG pipelines at the edge, low-latency vector similarity search, or storing and querying embeddings without managing a separate vector database.

Expert guidance for Falco, the CNCF runtime security tool that detects anomalous behavior in containers and Kubernetes clusters using system call monitoring. Helps developers set up Falco for detecting shell spawns in containers, unexpected network connections, file access violations, and privilege escalation — all in real-time with zero application changes.

Provision and manage AlloyDB for PostgreSQL clusters and instances on Google Cloud — a managed, PostgreSQL-compatible database with disaggregated compute/storage, columnar engine, and AlloyDB AI for vector search and natural-language queries. Use for HA clusters, read pools, IAM database auth, and Terraform-managed AlloyDB deployments.