/platform-skills

name: platform-skills
description: "Use when troubleshooting, implementing, reviewing, or auditing platform infrastructure as a system — where Kubernetes, GitOps, CI/CD, and security concerns intersect. Provides structured diagnosis with blast radius, validation steps, and rollback plan for: Kubernetes, Flux CD, Argo CD, Terraform, GitHub Actions (composite actions, OIDC, SHA pinning), AWS, Azure, GKE, Linkerd, KEDA, Karpenter, supply chain security (Cosign, SBOM, SLSA), Kubernetes posture with Kubescape (NSA, MITRE, CIS, SOC2, PR gates, operator runtime detection), Falco, Chaos Engineering, DORA metrics, Datadog/Dynatrace/LLM observability, SOC 2, and PR review."

Platform Skills

Use this skill for hands-on help with Kubernetes, GitOps, cloud infrastructure, CI/CD, secrets management, service mesh, Linux administration, networking, and platform product thinking — whether you are a solo developer or part of a large platform team.

Organisation context

Set once when the plugin is enabled (`/config` to change). Use these as defaults for examples and commands; anything the user says in the conversation wins.

| Setting | Value | |---|---| | GitOps engine | `${user_config.gitops_engine}` | | Primary cloud | `${user_config.primary_cloud}` | | AWS CLI profile naming | `${user_config.aws_profile_convention}` | | Required tag keys | `${user_config.required_tag_keys}` | | GitHub organisation | `${user_config.github_org}` |

A value that is empty, or still reads as an unsubstituted placeholder, is not configured (outside Claude Code, or never set): ask the user rather than assume.

Pick the right tool for the job

| Layer | When to use | |---|---| | `Terraform` | Cloud primitives, cluster bootstrap, IAM, networking, secrets backends | | `Kubernetes` | Workload, RBAC, network policy, platform baseline across distributions — `/platform-skills:kubernetes` | | `OpenShift` | Kubernetes patterns adapted to OpenShift SCC, Routes, GitOps, and cluster upgrades — `/platform-skills:openshift` | | `Flux` / `Argo CD` | In-cluster reconciliation, Helm releases, workload promotion | | `GitHub Actions` | Validate, package, gate, and promote — OIDC, SHA pinning, reusable workflows, debug — `/platform-skills:github-actions` | | `AWS` / `Azure` / `GKE` | Provider-specific account, identity, and governance patterns — Azure: `/platform-skills:azure` | | `Linkerd` | Automatic mTLS, golden-signal observability, traffic management | | `Linux & Networking` | DNS, load balancer routing, VPC/VNet, kernel tuning, connectivity | | `Secrets` | ESO, Sealed Secrets, rotation runbooks, Kubernetes-side audit — `/platform-skills:secrets` | | `Compliance` | SOC 2 controls in Terraform — IAM, encryption, audit logging, Checkov | | `Helm (Helmcheck)` | Chart scaffolding, lint/validate pipeline, values design, security hardening | | `MCP` | Build/debug MCP servers — tools, resources, transports, auth | | `AWS MCP Profiles` | Discover/switch AWS profiles across VS Code + Claude Code MCP configs — multi-account, SSO, Granted, credential_process | | `Observability` | Prometheus, OpenTelemetry, Grafana, alerting, k6 load tests, capacity | | `Documentation` | Docstrings (Google/NumPy/JSDoc), OpenAPI 3.1, MkDocs, guides | | `Datadog` | Agent on Kubernetes, APM, monitors, dashboards, SLOs, LLMObs | | `Dynatrace` | OneAgent Operator, auto-instrumentation, anomaly detection, SLOs | | `Conventional Commits` | Generate WHY-driven commit messages, atomic staging, validate | | `OPA / Conftest` | Rego policies, unit tests, fmt/regal/verify pipeline, debug | | `Kyverno` | CEL-based ValidatingPolicy, MutatingPolicy, ImageValidatingPolicy | | `PR Review` | Cost, drift, ownership, SOC 2, deprecated APIs, rollback feasibility | | `PR Triage` | 7-way comment classification, isolated-worktree fix, reply, eligibility-gated resolve | | `KEDA` | ScaledObject/ScaledJob, all scalers, TriggerAuthentication, scale-to-zero | | `Gateway API` | Ingress via Gateway API (Envoy Gateway default), migration off retired ingress-nginx, cert-manager listener TLS — `/platform-skills:gateway-api` | | `Karpenter` | NodePool/EC2NodeClass design, Spot diversity, disruption strategy, capacity planning, audit, CA migration, v0→v1 upgrade | | `Cluster Upgrade` | Minor-version upgrades: removed-API scan, add-on order, drain blockers, node rotation, EKS version rollback — `/platform-skills:cluster-upgrade` | | `Progressive Delivery` | Flagger canaries on Gateway API (Envoy Gateway, Linkerd), metric-gated promotion, automatic and emergency rollback — `/platform-skills:progressive-delivery` | | `Backup / DR` | Velero on EKS with IRSA, schedules and retention, restore drills with measured recovery time, cross-cluster DR — `/platform-skills:backup-dr` | | `FinOps` | Infracost PR cost diff, cost-allocation tags enforced in four layers, OpenCost allocation — `/platform-skills:finops` | | `Kubescape` | Posture against NSA, MITRE, CIS and SOC2 for manifests, Helm charts and clusters; PR gate on new findings; exceptions that suppress; CEL admission library — `/platform-skills:kubescape` | | `Kubescape Operator` | Continuous in-cluster posture, relevancy-ranked CVEs, eBPF runtime detection, NetworkPolicies from observed traffic, SecurityException with expiry — `/platform-skills:kubescape-operator` | | `Agent Self-Improvement` | `.learnings/` workspace, LRN/ERR lifecycle, WAL, VFM, ADL | | `Supply Chain Security` | Cosign signing, Syft SBOM, Trivy/Grype CVE gates, SLSA Level 2 | | `Runtime Security` | Falco eBPF, custom rules, Falcosidekick routing, Kyverno enforcement | | `Awesome Docs` | Animated SVG Markdown — README, runbook, RFC, architecture, post-mortem | | `Composite Actions` | Full action repo scaffold, SHA pinning, secrets-as-inputs, actionlint | | `Zizmor` | Workflow and action security audit — template injection, credential persistence, unpinned `uses:`, over-broad permissions | | `GitOps debug` | 5-workflow structured debug → 5-section report with root cause | | `