Agent Skills Catalog¶

This directory houses the domain-specific capabilities, operational workflows, and safety guardrails utilized by Open Cloud Agents.

Skills empower autonomous agents with deep procedural knowledge, tool configurations, real-world incident exploration runbooks, and automated verification scripts across Cloud Service Providers (CSPs), Programming Languages, DevOps, Security, Data Science, and Continual Learning.

Skills Taxonomy & Catalog Overview¶

skills/
├── csp/                        # Cloud Service Providers (The Remix Standard)
│   ├── aws/                    # AWS Well-Architected, Core & Specialized Skills, MCP Plugins
│   ├── azure/                  # Microsoft Azure (193 curated service skills)
│   └── gcp/                    # Google Cloud Platform & GCP Well-Architected Suite
├── programming/                # Language-specific idiomatic patterns & testing
│   ├── dart/                   # Dart 3 & Flutter (FFI native assets, CLI apps, test suites)
│   ├── python/                 # Python 3.11+ (FastAPI REST patterns, pytest async suites)
│   ├── javascript/             # TypeScript & Node.js (Strict discriminated unions, branded types)
│   ├── go/                     # Golang (Structured concurrency, errgroup worker pools)
│   └── java/                   # Java 21+ & Spring Boot (Clean architecture, HikariCP resilience)
├── devops/                     # Infrastructure, Delivery & SRE
│   ├── iac/                    # Terraform / OpenTofu modules & state destruction protection
│   ├── kubernetes/             # Pod triage (CoreDNS throttling outage) & Helm chart scaffold
│   ├── docker/                 # Container hardening & multi-stage minimal runtime builds
│   ├── ci-cd/                  # GitHub Actions OIDC federation & ArgoCD GitOps promotion
│   └── observability/          # OpenTelemetry tracing & PromQL Golden Signals alerting
├── security/                   # Enterprise Governance & Hardening
│   ├── compliance/             # CIS Foundation benchmarks & SOC 2 evidence collection
│   ├── iam-least-privilege/    # IAM policy synthesizer & Workload Identity federation
│   └── secret-management/      # Git secret leak emergency runbook & KMS envelope encryption
├── data-science/               # Data & Machine Learning Operations
│   ├── mlops/                  # Low-latency model serving with ONNX Runtime & Triton
│   └── data-analysis/          # Analytical SQL & cloud data warehouse optimization
└── continual-learning/         # Self-Knowledge Enhancement Engine
    ├── knowledge-enhancement-loop/       # Live transcript mining & skill auto-patching
    └── incident-postmortem-to-guardrail/ # Converts SRE findings to DevSecOps pre-merge rules

Anatomy of an Enterprise Skill¶

Every skill in Open Cloud Agents is a self-contained package adhering to a 3-tier architecture:

<skill-name>/
├── SKILL.md                 # 1. Autonomous instructions, real-life incidents, guardrails
├── references/              # 2. Architecture specs, decision trees, cheat sheets
└── scripts/                 # 3. Executable verification, linting, and recovery tools

Layer	File / Directory	Purpose
Instructions	`SKILL.md`	YAML frontmatter (`name`, `description`) + real-life incident postmortems, live exploration commands, and non-destructive guardrails.
References	`references/`	Deep documentation: dangerous attribute matrices, OIDC trust specs, PromQL cheat sheets, and RFC envelopes.
Automation	`scripts/`	Executable Python and Bash scripts (`chmod +x`) with strict exit codes for automated CI/CD verification and incident remediation.

Core Skills Index¶

1. DevOps & Infrastructure (`devops/`)¶

Skill	Highlights	References	Automation Scripts
`iac-state-protection`	Prevents `forces replacement` on stateful cloud resources (RDS, Storage, Cosmos DB).	`dangerous-attributes-matrix.md`	`verify_state_safety.py`
`terraform-opentofu-modules`	Enterprise reusable HCL module layouts and variable validation.	`hcl-style-guide.md`	`lint_modules.sh`
`k8s-pod-troubleshooting`	Diagnoses CrashLoopBackOff, OOMKilled, and CoreDNS throttling outages.	`k8s-pod-diagnostic-decision-tree.md`	`pod_diagnose.sh`
`helm-chart-scaffold`	Scaffolds hardened charts with securityContext, schemas, and linting.	`chart-best-practices.md`	`validate_chart.sh`
`dockerfile-hardening`	Multi-stage builds, non-root users, distroless runtimes, and Trivy CVE scans.	`container-security-cheat-sheet.md`	`audit_dockerfile.py`
`github-actions-hardening`	OIDC cloud identity federation, least-privilege tokens, and SHA pinning.	`oidc-trust-policy-specs.md`	`audit_workflows.py`
`gitops-argocd-promotion`	Progressive multi-environment promotion (`dev` ➔ `uat` ➔ `prod`) and sync waves.	`argocd-sync-waves.md`	`promote_environment.sh`
`promql-golden-signals`	Queries for Latency, Traffic, Errors, Saturation, and multi-window burn rates.	`golden-signals-reference.md`	`evaluate_slo_burn.py`
`opentelemetry-instrumentation`	W3C distributed trace propagation and OTLP exporter setup.	`semantic-conventions-cheatsheet.md`	`verify_otel_endpoint.py`

2. Security & Governance (`security/`)¶

Skill	Highlights	References	Automation Scripts
`cis-benchmark-audit`	Audits cloud environments against CIS Foundation benchmarks.	`cis-control-mappings.md`	`audit_cis_foundations.sh`
`soc2-evidence-collector`	Automates gathering of technical evidence for CC6.1-CC8.1 audit criteria.	`soc2-type2-evidence-matrix.md`	`collect_soc2_evidence.py`
`iam-policy-synthesizer`	Transforms wildcard `:` permissions into scoped ARNs with HTTPS condition keys.	`iam-condition-keys-cheatsheet.md`	`synthesize_least_privilege.py`
`workload-identity-federation`	Eliminates static cloud keys via OIDC and Kubernetes IRSA tokens.	`federation-architecture-specs.md`	`validate_oidc_token.sh`
`git-secret-leak-remediation`	Emergency response runbook: revoke ➔ rotate ➔ scrub with `git-filter-repo`.	`secret-revocation-endpoints.md`	`emergency_secret_scrub.sh`
`kms-envelope-encryption`	High-performance client-side payload encryption with KMS CMKs and DEKs.	`envelope-encryption-spec.md`	`envelope_encrypt.py`

3. Programming Languages (`programming/`)¶

Language	Key Skills	References	Automation Scripts
Dart / Flutter	11 production skills (unit testing, FFI native assets, CLI apps, pattern matching)	Integrated in `dart/`	Built-in test runners & hot reload
Python	`fastapi-rest-patterns` & `pytest-test-suite`	`fastapi-production-spec.md`	`benchmark_api.py` & `run_coverage_gate.sh`
JavaScript / TS	`typescript-strict-patterns`	`ts-strict-cheatsheet.md`	`typecheck_project.sh`
Go	`go-concurrency-patterns`	`go-concurrency-cheatsheet.md`	`race_detector_runner.sh`
Java	`spring-boot-architecture`	`hikaricp-tuning-cheatsheet.md`	`analyze_thread_dump.py`

4. Continual Learning & Data Science¶

Domain	Skill	References	Automation Scripts
Continual Learning	`knowledge-enhancement-loop`	`knowledge-patch-schema.md`	`transcript_knowledge_miner.py`
Continual Learning	`incident-postmortem-to-guardrail`	`pir-to-policy-mapping.md`	`generate_rego_guardrail.py`
FinOps & Cost Optimization	`cloud-waste-reaper`	`waste-matrix.md`	`reap_cloud_waste.sh`
Data Science / MLOps	`model-serving-fastapi-triton`	`onnx-triton-deployment-spec.md`	`benchmark_inference.py`
Data Science / Analytics	`sql-warehouse-optimization`	`bigquery-snowflake-tuning-guide.md`	`profile_sql_query.py`

Cloud Service Providers (`csp/`)¶

The CSP skills represent our curated Remix Standard across: * skills/csp/aws/: Amazon Bedrock, IAM, CDK, CloudFormation, Aurora, and DevSecOps MCP plugins. * skills/csp/azure/: 193 production-ready skills for Azure App Service, AKS, Cosmos DB, Entra ID, and VNets. * skills/csp/gcp/: 34 production-ready skills for GKE, Cloud Run, BigQuery, AlloyDB, and the Google Cloud Well-Architected Framework.

Authoring New Skills¶

All community contributions must follow the 3-tier structure (SKILL.md, references/, scripts/).

Frontmatter Template¶

---
name: my-skill-name
description: A concise 1-2 sentence description explaining the purpose of the skill and when agents should trigger it.
---

# Title

## Purpose & Scope
When and why an autonomous agent should activate this skill.

## Real-Life Incident / Live Exploration Protocol
Battle-tested production scenarios and exact terminal exploration commands.

## Step-by-Step Procedural Workflow
Checklist and sequential instructions for the agent.

## Non-Destructive Guardrails & Safety
Explicit boundaries preventing unauthorized data destruction or security drift.

## Continuous Self-Knowledge Enhancement Loop
How the agent captures novel edge cases and updates repository knowledge.