Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.

Enforce Kubernetes network segmentation using Calico CNI network policies and global network policies to control pod-to-pod traffic, restrict egress, and implement zero-trust microsegmentation.

Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.

Detects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.

Deploy SailPoint IdentityNow or IdentityIQ for identity governance and administration. Covers identity lifecycle management, access request workflows, certification campaigns, role mining, SOD policy

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment

Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.

Integrate security scanning into CI/CD pipelines using tools like Semgrep, Trivy, and Gitleaks. Covers SAST, SCA, container scanning, and secret detection with structured JSON output for pipeline gates.

Discover and inventory all privileged accounts across enterprise infrastructure including domain admins, local admins, service accounts, database admins, cloud IAM roles, and application admin account

Implement security monitoring using Datadog's Cloud SIEM, log analysis, and threat detection capabilities to identify and respond to security events across cloud infrastructure.

Analyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources. USE FOR: create architecture diagram, visualize Azure resources, show resource relationships, generate Mermaid diagram, analyze resource group, diagram my resources, architecture visualization, resource topology, map Azure infrastructure DO NOT USE FOR: creating/modifying resources (use azure-deploy), security scanning (use azure-security), performance troubleshooting (use azure-diagnostics), code generation (use relevant service skill)

Deploy, evaluate, and manage Foundry agents end-to-end: Docker build, ACR push, hosted/prompt agent create, container start, batch eval, prompt optimization, agent.yaml, dataset curation from traces. USE FOR: deploy agent to Foundry, hosted agent, create agent, invoke agent, evaluate agent, run batch eval, optimize prompt, deploy model, Foundry project, RBAC, role assignment, permissions, quota, capacity, region, troubleshoot agent, deployment failure, create dataset from traces, dataset versioning, eval trending, create AI Services, Cognitive Services, create Foundry resource, provision resource, knowledge index, agent monitoring, customize deployment, onboard, availability, standard agent setup, capability host. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure-prepare).

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.

Automate application deployment to cloud platforms and servers. Use when setting up CI/CD pipelines, deploying to Docker/Kubernetes, or configuring cloud infrastructure. Handles GitHub Actions, Docker, Kubernetes, AWS, Vercel, and deployment best practices.

Expert guide for building CI/CD pipelines with GitHub Actions, Vercel, and other platforms. Use when automating builds, tests, deployments, or release workflows.

Expert guide for creating Docker Compose configurations, Dockerfiles, and container orchestration. Use when containerizing applications, setting up development environments, or configuring multi-container deployments.

Configure development and production environments for consistent and reproducible setups. Use when setting up new projects, Docker environments, or development tooling. Handles Docker Compose, .env configuration, dev containers, and infrastructure as code.

Comprehensive Azure compliance and security auditing capabilities including best practices assessment, Key Vault expiration monitoring, and resource configuration validation. WHEN: compliance scan, security audit, azqr, Azure best practices, Key Vault expiration check, compliance assessment, resource review, configuration validation, expired certificates, expiring secrets, orphaned resources, policy compliance, security posture evaluation.

Helps users find the right Azure RBAC role for an identity with least privilege access, then generate CLI commands and Bicep code to assign it. Also provides guidance on permissions required to grant roles. USE FOR: "what role should I assign", "least privilege role", "RBAC role for", "role to read blobs", "role for managed identity", "custom role definition", "assign role to identity", "what role do I need to grant access", "permissions to assign roles". DO NOT USE FOR: creating or configuring managed identities, or general Azure security hardening; those are out of scope for this role-selection skill.

Automate repetitive development tasks and workflows. Use when creating build scripts, automating deployments, or setting up development workflows. Handles npm scripts, Makefile, GitHub Actions workflows, and task automation.

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment.

Web A/B: feature flags LaunchDarkly/Unleash, cookie segmentation, Cloudflare Workers A/B, header routing

Deploy applications and websites to Vercel instantly. Use when asked to "Deploy my app", "Deploy this to production", "Create a preview deployment", or "Push this live". No authentication required - returns preview URL and claimable deployment link.

Android: Gradle variants, signing, Google Play Console, Firebase App Distribution, Fastlane, bundletool

Cloud: serverless Lambda/CF Workers, edge, CDN, multi-region, HA patterns, IaC Terraform

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.

Assess and migrate cross-cloud workloads to Azure. Generates assessment reports and converts code from AWS, GCP, or other providers to Azure services. WHEN: migrate Lambda to Azure Functions, migrate AWS to Azure, Lambda migration assessment, convert AWS serverless to Azure, migration readiness report, migrate from AWS, migrate from GCP, cross-cloud migration.

Handles CI/CD pipelines for automated building, testing, and deployment using tools like Jenkins and GitHub Actions in D

iOS: Xcode Archive, TestFlight, App Store Connect, certificates, provisioning, Fastlane, Xcode Cloud

Cloud IoT platforms: AWS IoT Core, GCP IoT Core, Azure IoT Hub, fleet management

Docker/Compose: Dockerfile, networking, volumes, container lifecycle, registry, security hardening

MLflow is an open-source platform for managing the machine learning lifecycle, including tracking, packaging, and deploy

Tool for defining, provisioning, and managing infrastructure as code using declarative HCL configuration files.

Helm is a package manager for Kubernetes that allows defining, installing, and upgrading applications via charts.

Expertise in orchestrating and managing containerized applications at scale using Kubernetes.

Develop and deploy secure smart contracts on blockchain platforms using Solidity and Web3 technologies.

CI/CD: GitHub Actions workflows, parallel sharding, flaky quarantine, junit XML/Allure, coverage gates

E2E: Playwright browser automation/visual regression, Cypress, Selenium. POM, trace viewer, CI

Deployment: Cloudflare Pages/Workers, Vercel, Netlify, Docker, GitHub Actions CI/CD

Manage CI/CD pipelines, repos, and DevOps workflows on Azure DevOps and GitHub Actions.

Deploy and manage stateless containers on Google's serverless platform for scalable web applications.

Manage virtual machines and compute resources on Google Cloud Platform's Compute Engine.

Deploy and manage serverless functions on Google Cloud Platform using Cloud Functions for event-driven applications.

Manage and deploy containerized applications on Google Kubernetes Engine for scalable cloud-native orchestration.

Manages identity and access control for Google Cloud resources using IAM policies and roles.

Interact with Google Cloud Pub/Sub for scalable messaging and event-driven architectures.

Interact with Google Cloud Storage to manage buckets, objects, and access controls for scalable data storage.

Automate and manage Google Cloud Platform resources using Terraform for infrastructure as code.

Platform for building, deploying, and scaling machine learning models on Google Cloud.

Framework for defining and provisioning AWS cloud infrastructure using programming languages like TypeScript and Python.

AWS CloudFormation is a service for modeling and provisioning AWS resources using YAML or JSON templates.

Manage and configure Amazon EC2 instances for scalable virtual servers and cloud computing resources.

Orchestrate and manage Docker containers on AWS using Amazon Elastic Container Service for scalable applications.

Manage AWS Identity and Access Management for controlling user access and permissions to secure cloud resources.

AWS Lambda is a serverless computing service that executes code in response to events without managing servers.

Managed service for setting up, operating, and scaling relational databases in the AWS cloud.

Interact with AWS S3 for object storage, managing buckets, objects, and access controls.

AWS SageMaker is a fully managed platform for building, training, and deploying machine learning models with integrated

Manage and configure Amazon Virtual Private Cloud for creating isolated, customizable network environments in AWS.

Integrate Azure AI Services, Azure OpenAI, and Cognitive Services.

Orchestrate containerized workloads on Azure Kubernetes Service.

Build and deploy serverless event-driven functions on Azure.

Manage identity, access, and permissions with Microsoft Entra ID and Azure RBAC.

Configure Azure VNet, NSG, Load Balancer, and network topology.

Azure cloud operations orchestration and Microsoft Agent Framework integration hub.

Manage Azure Blob Storage, Data Lake, and storage account operations.

Deploy and manage Azure Virtual Machines, scale sets, and compute resources.

Things 3: task management, projects, areas, deadlines, repeating tasks, Things Cloud, URL scheme

Discovers, tests, and manages remote SSH infrastructure hosts and Docker services across 5 hosts (infra.local, deus, homeassistant, pi4-motor, armitage). Use when checking infrastructure status, verifying service connectivity, managing Docker containers, troubleshooting remote services, or before using remote resources (MongoDB, Langfuse, OTLP, Neo4j). Triggers on "check infrastructure", "connect to infra/deus/ha", "test MongoDB on infra", "view Docker services", "verify connectivity", "troubleshoot remote service", "what services are running", or when remote connections fail.

Interactively adds a new subdomain to the network infrastructure by gathering service details, configuring domains.toml, and applying changes. Use when you need to add a new service, create a subdomain, expose a new application, or set up reverse proxy for a service. Triggers on "add subdomain", "new subdomain", "add service to network", "expose service", "create domain for", "set up reverse proxy", or "add [name] to infrastructure". Works with domains.toml, manage-domains.sh, and Cloudflare Tunnel.

Executes comprehensive health checks and generates status reports for network infrastructure services. Verifies Docker containers, validates Caddy reverse proxy, checks Pi-hole DNS, confirms Cloudflare Tunnel connectivity, and validates SSL certificates. Use when verifying infrastructure status, diagnosing connectivity issues, checking service health, or troubleshooting network problems. Triggers on "check health", "infrastructure status", "is everything running", "diagnose network", "service health", or "verify SSL".

Configures Pi-hole local DNS records to enable local network resolution of *.temet.ai domains. Use when you need to set up DNS, add local DNS entries, configure Pi-hole DNS, troubleshoot DNS resolution, or make services resolve locally. Triggers on "setup DNS", "configure Pi-hole DNS", "add DNS record", "DNS not resolving", "local DNS setup", or "why can't I access [service].temet.ai locally". Works with Pi-hole container, domains.toml, docker-compose.yml, and manage-domains.sh.

Implements Google Cloud Pub/Sub integration in Python by configuring topics, subscriptions, publishing/subscribing, dead letter queues, and local emulator setup. Use when building event-driven architectures, implementing message queuing, or managing high-throughput systems. Triggers on "setup Pub/Sub", "publish messages", "create subscription", "configure DLQ", or "test with emulator". Works with google-cloud-pubsub library and includes reliability, idempotency, and testing patterns.

Configures GitHub webhooks for auto-deployment by verifying secrets, checking endpoint accessibility, and guiding configuration. Use when you need to add a new repo for auto-deploy, configure GitHub webhooks, set up continuous deployment, or troubleshoot webhook issues. Triggers on "setup webhook", "add webhook for [repo]", "configure auto-deploy", "GitHub deployment", or "webhook not working". Works with config/hooks.json, .env (WEBHOOK_SECRET), and webhook.temet.ai endpoint.

Configures Cloudflare Access authentication with Google OAuth for protected services. Use when you need to set up authentication, configure Google OAuth, protect services with Cloudflare Access, enable remote access security, or troubleshoot Access issues. Triggers on "setup cloudflare access", "configure access authentication", "enable google oauth", "protect services", "fix access denied", "add users to access", or "why can't I login remotely". Works with cf-access-setup.sh, .env OAuth credentials, and Cloudflare Zero Trust dashboard.

Sets up a new Cloudflare Tunnel from scratch for secure remote access to home network services. Use when creating a new tunnel, replacing an expired tunnel token, or setting up remote access for a fresh installation. Triggers on "setup cloudflare tunnel", "create tunnel", "new tunnel token", "configure remote access", "cloudflare tunnel from scratch", or "tunnel not configured". Works with .env, docker-compose.yml, and Cloudflare Zero Trust.

Configures comprehensive logging, metrics, distributed tracing, and alerting for GKE applications. Use when setting up Cloud Logging, creating dashboards in Cloud Monitoring, instrumenting Spring Boot with metrics, configuring alerts for error rates or resource usage, or implementing distributed tracing with Cloud Trace. Includes Prometheus integration, structured logging patterns, and observability best practices for microservices.

Adds new users to Cloudflare Access authentication by updating ACCESS_ALLOWED_EMAIL in .env and syncing policies to all protected services. Use when you need to grant access to a new user, add someone to the network, share service access, or update allowed emails. Triggers on "add user to access", "grant access to [email]", "add [email] to cloudflare", "share access with", "allow [email] to authenticate", or "update access users". Works with .env, update-access-emails.sh, and Cloudflare Access policies for pihole, jaeger, langfuse, sprinkler, ha, and temet.ai services.

Creates automated backup procedures, executes restoration operations, and implements disaster recovery workflows for network infrastructure. Use when backing up infrastructure before changes, preparing for disaster recovery, migrating to new server, or restoring after failure. Triggers on "backup infrastructure", "restore from backup", "disaster recovery", "backup before upgrade", or "migrate infrastructure". Works with Docker volumes (caddy_data, pihole_data), configuration files (docker-compose.yml, domains.toml), and .env secrets using tar archives and docker compose commands.

Configures comprehensive testing in Gradle including JUnit 5, TestContainers, test separation (unit vs integration), and code coverage with JaCoCo. Use when asked to "set up JUnit 5", "configure TestContainers", "separate integration tests", or "add code coverage". Works with build.gradle.kts, test source sets, and CI/CD configurations.

Exports Micrometer metrics to GCP Cloud Monitoring (Stackdriver) for GKE deployments. Use when setting up metrics export in Kubernetes environments, configuring Workload Identity, managing metric prefixes and resource labels, or correlating metrics with GCP services. Critical for GKE-based microservices with centralized observability in Google Cloud.

Configures Gradle builds for CI/CD platforms including GitHub Actions, GitLab CI, Jenkins, and CircleCI. Use when setting up automated builds, configuring caching strategies, running tests in pipelines, or building Docker images in CI. Triggers on "setup Gradle CI", "configure GitHub Actions", "optimize build cache", or "CI pipeline for Gradle". Works with .github/workflows, .gitlab-ci.yml, Jenkinsfile, and includes performance optimization and artifact handling.

Configures Gradle with Spring Boot projects including plugin setup, bootable JAR creation, layered JARs for Docker optimization, and multi-module Spring Boot configurations. Use when asked to "set up Spring Boot with Gradle", "create executable JARs", "configure Docker layering", or "set up Spring Boot microservices".

Optimizes Gradle build performance through caching strategies, configuration cache, parallel execution, and memory tuning to achieve 50-80% faster builds for large projects. Use when builds are slow (>2 minutes), optimizing CI/CD pipelines, or configuring new Gradle projects. Triggers on "speed up Gradle", "slow builds", "optimize CI/CD", "reduce build time", or "configure Gradle performance". Works with gradle.properties, build.gradle.kts, GitHub Actions, and GitLab CI configurations using build cache, configuration cache, and parallel execution.

Enforce type safety in all tests: type annotations for test functions and fixtures, mock autospec patterns, mypy configuration for tests, type-safe assertions, generic type handling in mocks. Includes protocol-based typing and cast patterns for complex scenarios. Use when: Writing type-safe tests, configuring mypy for test files, using protocols for mocks, enforcing type checking in CI/CD, or debugging type-related test issues.

Diagnoses and fixes Cloudflare Access authentication issues including Google OAuth errors, access denied after login, login loops, CookieMismatch errors, and "can only be used within its organization" errors. Use when authentication fails, access denied after Google login, redirect failures, or Pi-hole blocking Google domains. Triggers on "access denied", "OAuth not working", "login loop", "CookieMismatch", "can only be used within organization", or "fix Cloudflare Access authentication". Works with Cloudflare Access, Google OAuth, Pi-hole whitelist, and ACCESS_ALLOWED_EMAIL configuration.

Configures automated infrastructure monitoring with mobile alerts (ntfy.sh and Home Assistant) and implements auto-recovery for common failures. Use when setting up monitoring, configuring mobile notifications, enabling auto-recovery, or troubleshooting alert delivery. Triggers on "setup monitoring", "configure alerts", "mobile notifications", "enable auto-recovery", "monitoring not working", or "not getting alerts". Works with ntfy.sh push notifications, Docker container health checks, Bash monitoring scripts, and optional Home Assistant automation integration.

Creates and manages Cloudflare Access service tokens for automated infrastructure verification and non-human access. Use when setting up automation, verification scripts, monitoring systems, or need to test services without Google OAuth. Triggers on "create service token", "setup automation access", "verify without OAuth", "automated monitoring", or "service token for testing". Works with Cloudflare Access Service Auth, .env credential storage, and cf-service-token.sh script for testing and management.

Manages SSL certificate operations including checking expiry, monitoring renewal, forcing manual renewal, and backing up certificates. Use when checking certificate validity, monitoring auto-renewal, certificates expiring soon, or need to backup certificate data. Triggers on "check certificate expiry", "certificate renewal", "SSL certificate status", "backup certificates", or "force certificate renewal". Works with Let's Encrypt certificates, Caddy auto-renewal, and caddy_data Docker volume.

Analyzes and optimizes Google Kubernetes Engine costs through right-sizing resources, comparing cluster modes, and implementing autoscaling strategies. Use when analyzing GKE spending, comparing Autopilot vs Standard billing models, configuring Spot VMs for batch workloads, right-sizing pod resources, setting up budget alerts, or tracking cost per service. Includes per-pod billing analysis and resource utilization optimization patterns.

Implements zero-downtime deployments on GKE using rolling updates, blue-green strategies, and health checks. Use when deploying new versions, rolling back failed deployments, configuring Spring Boot health probes (liveness/readiness), managing rollout status, or implementing progressive rollout patterns. Includes automated health verification and rollback procedures.

Runs dual type checking with pyright (fast, development) and mypy (thorough, CI/CD). Use when checking types, before commits, debugging type errors, or validating type annotations. Explains why both tools required, configuration differences, and when to use each. Works with Python .py files, pyproject.toml, strict mode enabled.

Diagnoses and fixes Cloudflare Tunnel connectivity issues including stuck tunnels, failed connections, Error 1033, and tunnel registration problems. Use when remote access not working, tunnel shows disconnected in dashboard, Error 1033 on tunnel connection, or cloudflared container restarting. Triggers on "tunnel not connecting", "tunnel down", "Error 1033", "remote access broken", "fix tunnel", or "cloudflared not working". Works with Cloudflare Tunnel (cloudflared), QUIC connection health, and tunnel registration verification.

Diagnoses and fixes IPv6 DNS issues causing clients to connect to Cloudflare OAuth instead of using local network access. Use when services show OAuth login prompt on local WiFi, slow initial connection followed by authentication, or Chrome shows "error with retry". Triggers on "connecting to Cloudflare instead of local", "OAuth prompt on WiFi", "IPv6 DNS issue", "clients prefer IPv6", "disable IPv6 DNS", or "fix local access". Works with Pi-hole FTLCONF_misc_dnsmasq_lines filter-AAAA configuration and client DNS cache management.