Platform Skills

Use this skill for hands-on help with Kubernetes, GitOps, cloud infrastructure, CI/CD, secrets management, service mesh, Linux administration, networking, and platform product thinking — whether you are a solo developer or part of a large platform team.

Organisation context

Set once when the plugin is enabled (/config to change). Use these as defaults for examples and commands; anything the user says in the conversation wins.

Setting	Value
GitOps engine	${user_config.gitops_engine}
Primary cloud	${user_config.primary_cloud}
AWS CLI profile naming	${user_config.aws_profile_convention}
Required tag keys	${user_config.required_tag_keys}
GitHub organisation	${user_config.github_org}

A value that is empty, or still reads as an unsubstituted placeholder, is not configured (outside Claude Code, or never set): ask the user rather than assume.

Pick the right tool for the job

Layer	When to use
Terraform	Cloud primitives, cluster bootstrap, IAM, networking, secrets backends
Kubernetes	Workload, RBAC, network policy, platform baseline across distributions — /platform-skills:kubernetes
OpenShift	Kubernetes patterns adapted to OpenShift SCC, Routes, GitOps, and cluster upgrades — /platform-skills:openshift
Flux / Argo CD	In-cluster reconciliation, Helm releases, workload promotion
GitHub Actions	Validate, package, gate, and promote — OIDC, SHA pinning, reusable workflows, debug — /platform-skills:github-actions
AWS / Azure / GKE	Provider-specific account, identity, and governance patterns — Azure: /platform-skills:azure
Linkerd	Automatic mTLS, golden-signal observability, traffic management
Linux & Networking	DNS, load balancer routing, VPC/VNet, kernel tuning, connectivity
Secrets	ESO, Sealed Secrets, rotation runbooks, Kubernetes-side audit — /platform-skills:secrets
Compliance	SOC 2 controls in Terraform — IAM, encryption, audit logging, Checkov
Helm (Helmcheck)	Chart scaffolding, lint/validate pipeline, values design, security hardening
MCP	Build/debug MCP servers — tools, resources, transports, auth
AWS MCP Profiles	Discover/switch AWS profiles across VS Code + Claude Code MCP configs — multi-account, SSO, Granted, credential_process
Observability	Prometheus, OpenTelemetry, Grafana, alerting, k6 load tests, capacity
Documentation	Docstrings (Google/NumPy/JSDoc), OpenAPI 3.1, MkDocs, guides
Datadog	Agent on Kubernetes, APM, monitors, dashboards, SLOs, LLMObs
Dynatrace	OneAgent Operator, auto-instrumentation, anomaly detection, SLOs
Conventional Commits	Generate WHY-driven commit messages, atomic staging, validate
OPA / Conftest	Rego policies, unit tests, fmt/regal/verify pipeline, debug
Kyverno	CEL-based ValidatingPolicy, MutatingPolicy, ImageValidatingPolicy
PR Review	Cost, drift, ownership, SOC 2, deprecated APIs, rollback feasibility
PR Triage	7-way comment classification, isolated-worktree fix, reply, eligibility-gated resolve
KEDA	ScaledObject/ScaledJob, all scalers, TriggerAuthentication, scale-to-zero
Gateway API	Ingress via Gateway API (Envoy Gateway default), migration off retired ingress-nginx, cert-manager listener TLS — /platform-skills:gateway-api
Karpenter	NodePool/EC2NodeClass design, Spot diversity, disruption strategy, capacity planning, audit, CA migration, v0→v1 upgrade
Cluster Upgrade	Minor-version upgrades: removed-API scan, add-on order, drain blockers, node rotation, EKS version rollback — /platform-skills:cluster-upgrade
Progressive Delivery	Flagger canaries on Gateway API (Envoy Gateway, Linkerd), metric-gated promotion, automatic and emergency rollback — /platform-skills:progressive-delivery
Backup / DR	Velero on EKS with IRSA, schedules and retention, restore drills with measured recovery time, cross-cluster DR — /platform-skills:backup-dr
FinOps	Infracost PR cost diff, cost-allocation tags enforced in four layers, OpenCost allocation — /platform-skills:finops
Kubescape	Posture against NSA, MITRE, CIS and SOC2 for manifests, Helm charts and clusters; PR gate on new findings; exceptions that suppress; CEL admission library — /platform-skills:kubescape
Kubescape Operator	Continuous in-cluster posture, relevancy-ranked CVEs, eBPF runtime detection, NetworkPolicies from observed traffic, SecurityException with expiry — /platform-skills:kubescape-operator
Agent Self-Improvement	.learnings/ workspace, LRN/ERR lifecycle, WAL, VFM, ADL
Supply Chain Security	Cosign signing, Syft SBOM, Trivy/Grype CVE gates, SLSA Level 2
Runtime Security	Falco eBPF, custom rules, Falcosidekick routing, Kyverno enforcement
Awesome Docs	Animated SVG Markdown — README, runbook, RFC, architecture, post-mortem
Composite Actions	Full action repo scaffold, SHA pinning, secrets-as-inputs, actionlint
Zizmor	Workflow and action security audit — template injection, credential persistence, unpinned uses:, over-broad permissions
GitOps debug	5-workflow structured debug → 5-section report with root cause
GitOps audit	6-phase repo audit → prioritized Critical/Warning/Info report
Platform Mindset	DevEx, friction audits, RFC/ADR, incident communication, post-mortems
Renovate	Dependency update automation — generate renovate.json from repo scan, emit GHA validation workflow
Setup Agents	Scaffold multi-agent AI configs for any repo — interview-driven, specific to this codebase
Token Optimizer	Route broad discovery to a cheap worker model via native subagents — /platform-skills:token-optimizer

If a task spans multiple areas, decide which layer owns the source of truth and keep the other layers consumers of that state.

Apply These Platform Rules

• Separate reusable platform building blocks from live environment configuration.
• Prefer GitOps pull-based reconciliation for cluster state and CI push-based automation for validation and packaging.
• Choose either Flux or Argo CD for a given ownership boundary unless the task is explicitly about migration between them.
• Keep Terraform responsible for bootstrapping clusters, cloud resources, secrets backends, and access primitives. Do not let Flux or Argo CD recreate those foundations unless there is a deliberate controller-based design.
• Use Flux or Argo CD for in-cluster add-ons, workloads, Helm releases, and app-level environment promotion after bootstrap.
• Use GitHub Actions for checks, plans, policy gates, artifact publishing, and promotion orchestration. Do not store long-lived environment truth in workflow YAML.
• Prefer OIDC or workload identity over static cloud credentials.
• Model environments explicitly. Promotion should be visible in Git history and reversible by commit rollback.
• For Linux and networking changes, validate at each layer before escalating: confirm the process is listening (ss -tulnp), then L3 reachability (ping), L4 connectivity (nc -zv), L7 response (curl -v), and security group / NACL rules last. Do not skip layers.
• For every Terraform change, enforce in order: terraform fmt -check -recursive, terraform validate, conftest test (OPA/Rego policy gates — runs after validate, before plan as a blocking gate), tflint --recursive, security scan (tfsec or checkov), then plan. Do not let format, lint, or policy failures reach the plan step.
• For every Helm chart change, enforce in order: helm lint --strict, helm template --debug, kubeconform -strict -summary on rendered output, checkov on rendered manifests, then helm test in-cluster. Fail CI on any helm lint --strict warning.
• Enforce a tag baseline on all cloud resources. The specific keys are an organizational decision. Use AWS default_tags (provider level) or Azure merge(local.common_tags, {...}) (module local) so the baseline is applied once, not repeated per resource. Back it with AWS Tag Policies or Azure Policy so resources created outside Terraform are also covered.

Structure the Response

For design or implementation work, provide output in this order:

1. Target architecture and ownership boundaries
2. Repository or directory layout
3. Identity, secrets, and promotion model
4. Validation and deployment workflow
5. Risks, tradeoffs, and migration path

When asked to generate code, start from the thinnest useful slice that proves the pattern and note which layer remains intentionally out of scope.

Pick the Right Reference Files

Load only the files needed for the current request.

File	Scope
references/platform-operating-model.md	Repo topology, ownership boundaries, promotion flow
references/terraform.md	Module patterns, environments, state, testing
references/checkov.md	Checkov bootstrap, scan modes, provider detection, private module auth, output formats, fix mode, custom checks
references/kubernetes.md	Cluster baseline, workload, RBAC, policy
references/openshift.md	OpenShift routing, SCC, OLM, tenancy
references/fluxcd.md	Bootstrap, reconciliation, FluxInstance, ResourceSet, image automation
references/fluxcd-sources.md	GitRepository, OCIRepository, HelmRepository, Bucket, ArtifactGenerator
references/fluxcd-resourcesets.md	ResourceSet templating, input strategies, gitless fleet patterns
references/fluxcd-notifications.md	Provider, Alert, Receiver, Slack/Datadog/GitHub commit status
references/fluxcd-operator.md	FluxInstance sizing, multi-tenancy, kustomize patches, FluxReport
references/fluxcd-kustomization.md	CEL readyExpr, postBuild substitution, SOPS, SSA annotations
references/fluxcd-helmrelease.md	chartRef vs chart.spec, drift detection, post-renderers, CRD lifecycle
references/fluxcd-terraform.md	Flux Operator bootstrap via Terraform
references/fluxcd-mcp.md	AI-assisted FluxCD debugging via Flux MCP server
references/fluxcd-migration.md	v2.7/v2.8 API removals, CLI and Operator upgrade paths
references/fluxcd-security.md	Secrets, source auth, OCI supply chain, RBAC, image automation security
references/fluxcd-troubleshooting.md	Incident cheat-sheet — symptom → cause → fix per controller
references/argocd.md	App delivery, ApplicationSet, sync policies
references/aws.md	Landing zones, IAM, EKS patterns
references/aws-mcp-profiles.md	AWS MCP profile management — multi-account SSO, Granted, credential_process, context budget, starter kits
references/azure.md	Management groups, identity, AKS patterns
references/aws-cloudfront.md	CloudFront distributions, OAC, Lambda@Edge, security headers
references/aws-waf.md	Web ACLs, managed rules, rate limiting, Firewall Manager
references/github-actions.md	Reusable workflows, OIDC, delivery controls
references/composite-actions.md	Composite action scaffold, SHA pinning, secrets-as-inputs, actionlint
references/zizmor.md	Zizmor audit catalogue, personas, zizmor.yml policy, exit-code gating, auto-fix, SARIF, pre-commit
references/kingfisher.md	Kingfisher bootstrap, scan/validate/revoke, baseline, kingfisher.yaml, platform targets, CI gate, pre-commit
references/ai-governance.md	Policy schema, verified Copilot/Claude hook protocol, trusted-verifier self-disable design, denied_commands scoping
references/secrets.md	External Secrets Operator, Sealed Secrets, secrets strategy
references/linkerd.md	mTLS, observability, traffic management, multi-cluster
references/linux-networking.md	DNS, load balancing, VPC/VNet, kernel tuning, connectivity
references/platform-mindset.md	DevEx, friction audits, RFC/ADR, incident communication, post-mortems
references/compliance.md	SOC 2 controls, IAM, encryption, audit logging, Checkov evidence
references/helm.md	Chart scaffolding, lint pipeline, values design, GitOps integration
references/mcp.md	MCP protocol, SDKs, transports, schema validation, auth, testing
references/observability.md	Prometheus, OpenTelemetry, Grafana, alerting, k6, capacity
references/documentation.md	Docstrings, OpenAPI 3.1, MkDocs, developer guides
references/datadog.md	Agent, APM, monitors, dashboards, SLOs, LLMObs, FluxCD monitoring
references/llm-observability.md	LLMObs instrumentation, eval bootstrap, trace RCA
references/dynatrace.md	OneAgent, auto-instrumentation, anomaly detection, SLOs, Terraform
references/conventional-commits.md	Commit message structure, atomic staging, commitlint, semantic-release
references/opa.md	Rego v1 syntax, rule types, unit tests, fmt/regal/verify pipeline
references/kyverno.md	ValidatingPolicy, MutatingPolicy, ImageValidatingPolicy, CEL, kyverno-cli
references/pr-review.md	Cost, drift, ownership, compliance, deprecated APIs, rollback scoring
references/keda.md	ScaledObject, ScaledJob, scalers, TriggerAuthentication, scale-to-zero
references/gateway-api.md	ingress-nginx retirement, implementation choice, ownership model, CRD channel and keep policy, ingress2gateway annotation coverage, cert-manager, Flux layering, cutover, rollback
references/karpenter.md	NodePool, EC2NodeClass, NodeClaim, IAM, Spot, disruption, private cluster, CA migration
references/cluster-upgrade.md	Removed-API scan (pluto, EKS upgrade insights), add-on compatibility, drain blockers, node rotation, EKS version rollback limits, blue/green
references/progressive-delivery.md	How a Flagger canary works, traffic providers (Gateway API, Linkerd), metrics, GitOps interplay, rollback, troubleshooting
references/backup-dr.md	What Velero backs up and what it does not, configuration decisions, restore drills, DR to another cluster, rollback
references/finops.md	Tag enforcement in four layers (Terraform, Conftest, AWS Config, Kyverno), Infracost on PRs, OpenCost allocation, rollback
references/kubescape.md	Verified CLI install, frameworks, gate exit codes, baseline PR gate, the two exception actions (disable suppresses, alertOnly does not), fix limits, VAP rollout, troubleshooting
references/kubescape-operator.md	Kernel and overlap preflight, capability matrix and install profiles, scanner image override, vulnerabilities and relevancy, runtime detection, generated NetworkPolicies, SecurityException, metrics, troubleshooting
references/agent-self-improve.md	.learnings/ workspace, entry metadata, lint and recall, WAL, VFM, ADL, status/migrate
references/supply-chain.md	Cosign, Syft SBOM, Trivy/Grype, SLSA Level 2, ImageValidatingPolicy
references/trivy.md	Trivy bootstrap, image/fs/repo/secrets/sbom/k8s modes, severity gating, Trivy Operator via Flux HelmRelease
references/runtime-security.md	Falco eBPF, custom rules, Falcosidekick, Kyverno enforcement
references/chaos.md	Litmus Chaos, Chaos Mesh, steady-state hypothesis, GameDay
references/dora.md	Deployment Frequency, Lead Time, CFR, MTTR, Prometheus instrumentation
references/awesome-docs.md	Animated SVG Markdown — architecture flow, lifecycle, carousel, timeline
references/setup-agents.md	Mode routing table, signal→roster decisions, manifest format
references/setup-agents-build.md	Generate/upgrade step-by-step build guide (language scan, interview, render, verify)
references/setup-agents-add.md	Add a new agent or tool target to an existing setup
references/setup-agents-review.md	Audit existing agent files for staleness, misalignment, missing sections
references/setup-agents-schemas.md	Per-tool frontmatter schemas, managed-file markers, MCP wiring
references/setup-agents-template.md	AGENTS.md template pointer and render.sh invocation
references/token-optimizer.md	Config schema, verified client capability matrix, size classification, fail-open rationale, measurement

Slash Commands

For explicit, repeatable workflows use these commands:

• /platform-skills:debug — structured troubleshooting for any platform symptom
• /platform-skills:preflight — production-readiness preflight for a folder, repo, or single file
• /platform-skills:terraform — full fmt/validate/tflint/security pipeline + blast radius review
• /platform-skills:checkov — Checkov bootstrap, static and plan-level Terraform scanning for AWS/Azure/GCP/EKS, private GitHub module auth via gh CLI, pre-commit generation, multi-format output, baseline, and AI-generated fix mode
• /platform-skills:trivy — scan container images, filesystems, git repos, and existing SBOMs for CVEs, secrets, and license violations; three-layer wizard routes intent → goal → tuned scan; continuous cluster monitoring via Trivy Operator (Flux HelmRelease); hard handoffs to Checkov (IaC), Kyverno (admission), and supply-chain (SBOM generation/signing)
• /platform-skills:fluxcd — FluxCD entry point: routes to debug (live cluster issue), audit (repo health check), or helm (chart review) based on your input
• /platform-skills:gitops debug — Flux CD and Argo CD live cluster troubleshooting (5-workflow structured debug)
• /platform-skills:gitops audit — Flux CD GitOps repository 6-phase audit (discovery, validation, API compliance, best practices, security, report)
• /platform-skills:linkerd — Linkerd mTLS, injection, policy, and multi-cluster diagnostics
• /platform-skills:linux — Linux administration, DNS, load balancing, VPC/VNet, and connectivity troubleshooting
• /platform-skills:product — product thinking, friction audits, DevEx, RFC/ADR, incident updates, post-mortems
• /platform-skills:compliance — SOC 2 gap analysis, control implementation, evidence collection, and Checkov remediation for Terraform
• /platform-skills:helmchart — Helm chart scaffolding, structural review, and security audit with full lint/validation pipeline
• /platform-skills:mcp — MCP server/client scaffolding, protocol review, and integration debugging
• /platform-skills:aws-profile — discover, switch, and validate AWS profiles for MCP servers across VS Code and Claude Code
• /platform-skills:observability — instrument services, build dashboards, write alerts, run load tests, plan capacity
• /platform-skills:document — generate docstrings, OpenAPI specs, documentation sites, and getting started guides
• /platform-skills:datadog — Datadog Agent setup, APM instrumentation, monitors, dashboards, SLOs, pup CLI operations, LLM Observability instrumentation, evaluators, and debugging
• /platform-skills:dynatrace — OneAgent deployment, instrumentation, anomaly detection, SLOs, and debugging
• /platform-skills:commit — analyze diff, generate conventional commit message, stage files atomically, validate message
• /platform-skills:opa — generate Rego policies, write unit tests, run fmt/regal/verify pipeline, explain or debug policies
• /platform-skills:kyverno — generate, test, audit, debug, or migrate Kyverno CEL-based admission policies
• /platform-skills:pr-review — comprehensive PR review: cost, drift, ownership, compliance, upgrade, rollback
• /platform-skills:triage — triage a PR comment (bot or human): classify as ACTIONABLE_FIX / ALREADY_FIXED / INFORMATIONAL / NOT_APPLICABLE / NEEDS_CLARIFICATION / OUT_OF_SCOPE / DUPLICATE, produce the exact fix if needed, write the thread reply, and resolve the thread only when that finding is eligible for closure
• /platform-skills:keda — design, generate, debug, or review KEDA ScaledObject/ScaledJob autoscaling
• /platform-skills:gateway-api — migrate off the retired ingress-nginx controller to Gateway API: assess annotations, convert with ingress2gateway, scaffold a shared Gateway with cert-manager TLS and Flux layering, plan a parallel-run DNS cutover, debug route attachment, or roll back
• /platform-skills:karpenter — install, generate NodePool/EC2NodeClass, debug provisioning, plan capacity before rollout, audit scale history, migrate from Cluster Autoscaler, or upgrade (including v0→v1 CRD migration)
• /platform-skills:cluster-upgrade — plan, scan, run and roll back a Kubernetes minor-version upgrade: removed APIs in Git, rendered Helm and the live cluster, add-on order, drain blockers, node rotation per pool, and EKS one-step version rollback within 7 days or blue/green
• /platform-skills:progressive-delivery — install Flagger with signed OCI charts, generate a Canary and MetricTemplates on Gateway API or Linkerd, debug a stuck or rolled-back canary, and roll back a release in an emergency
• /platform-skills:backup-dr — install Velero with IRSA, design schedules and retention, run a timed restore drill into an isolated namespace, restore a deleted namespace, plan DR to another cluster, and debug a failed backup or restore
• /platform-skills:finops — estimate a Terraform PR's monthly cost with Infracost, allocate in-cluster cost by namespace and label with OpenCost, enforce required cost tags in four layers, and audit tag coverage
• /platform-skills:kubescape — score manifests, Helm charts, Kustomize or a live cluster against NSA, MITRE, CIS (EKS, AKS, GKE, vanilla) or SOC2, add a CI gate that fails PRs only on new findings, write exceptions that actually suppress, preview automatic fixes, and enforce controls with Kubescape's CEL admission policy library
• /platform-skills:kubescape-operator — install the Kubescape operator with Flux after a kernel and overlap preflight, rank CVEs by whether they load, alert on runtime behaviour against learned container profiles, turn generated NetworkPolicies into reviewed Git changes, accept risks with expiring SecurityExceptions, export metrics, and debug node-agent and scan failures
• /platform-skills:self-improve — bootstrap global or project-local .learnings/ workspace (init global/init local), log/recall/review/promote/revoke learnings and errors with provenance, scope and expiry, status overview, and migrate between scopes
• /platform-skills:supply-chain — sign images, generate and attest SBOMs, run CVE severity gates, enforce image signatures in Kubernetes, and generate SLSA Level 2 provenance
• /platform-skills:runtime-security — deploy Falco with eBPF, write custom rules, route alerts, debug why a rule is not firing, and bridge Falco signals to Kyverno admission enforcement
• /platform-skills:chaos — install Litmus Chaos or Chaos Mesh, generate fault experiments, schedule recurring chaos, run structured GameDay, debug stuck experiments, report results
• /platform-skills:dora — instrument DORA metrics in GitHub Actions, generate Grafana dashboards, benchmark against performance bands, debug missing metric data
• /platform-skills:awesome-docs — generate any animated Markdown document (README, architecture guide, runbook, tutorial, RFC, post-mortem, or custom), convert existing Markdown to animated, update diagrams, diff for staleness, audit quality, preview locally, or export to Confluence/Notion HTML
• /platform-skills:aws — CloudFront distributions, WAF web ACLs, Lambda@Edge, CloudFront Functions, Firewall Manager multi-account enforcement, and Terraform module generation with best practices
• /platform-skills:composite-actions — generate a full composite action repo scaffold, review an existing action.yml, harden with SHA pinning and env isolation, or generate a test workflow
• /platform-skills:github-actions — design reusable workflows and job graphs, review for OIDC/SHA pinning/token scoping, or debug failing CI workflows
• /platform-skills:zizmor — audit workflows, composite actions, Dependabot and pre-commit configs with zizmor: interactive three-layer wizard routes intent → scope → trade-offs (including an explicit hash-pin vs ref-pin decision, SHA recommended), then scan, deep-audit, auto-fix, triage findings, generate .github/zizmor.yml policy, emit a SARIF or hard-fail CI gate, or add the pre-commit hook; complements actionlint (/platform-skills:github-actions) rather than replacing it
• /platform-skills:kingfisher — find, live-validate, map the blast radius of, and revoke leaked secrets with Kingfisher across a repo, Git history, a GitHub/GitLab/Bitbucket org, S3/GCS, Docker images, Slack, Jira, Confluence, Teams, or Postman; scan, deep-audit, direct validate/revoke, baseline management, triage, kingfisher.yaml policy, CI gate, or pre-commit hook; complements the pattern-only secret scan in /platform-skills:trivy
• /platform-skills:kubernetes — generate cluster baseline scaffolds, diagnose 401/403 RBAC errors, harden Deployment specs, or debug crashloop/OOMKill/pending pods
• /platform-skills:azure — Workload Identity and OIDC federation, resource tagging with Azure Policy, AKS provisioning, RBAC scoping, and production-readiness review
• /platform-skills:openshift — SCC diagnosis and minimum grants, Route TLS modes and 503 debug, OpenShift GitOps app delivery, and cluster upgrade validation
• /platform-skills:secrets — design ESO vs Sealed Secrets strategy, scaffold SecretStore/ExternalSecret, seal and rotate secrets, run rotation runbooks, and audit Kubernetes-side secrets hygiene
• /platform-skills:renovate — generate renovate.json for any repo, or emit a GHA workflow to validate it on PR
• /platform-skills:setup-agents — scaffold multi-agent AI configs for any repo: ranked scan, interview-driven, generate/upgrade/add/review
• /platform-skills:ai-governance — generate real-time session hooks (Copilot, Claude Code) and a merge-time backstop that gate AI-agent edits to protected paths and dangerous commands; check dry-runs policy changes, audit reports fleet-wide adoption via gh api, explain translates an existing policy to plain English
• /platform-skills:token-optimizer — route broad repository discovery to a cheaper worker model using each client's native subagents; inspect detects clients and conflicts, setup writes a reviewable diff, doctor reports delegation, resolved model, redirection, and read limit as four separate states, explain dry-runs a classification, benchmark and report record and aggregate what the client exposes (reconciliation is against the provider's billing)
• Working Flux CD examples: examples/fluxcd/