From b3be11e88e022f5c0c084549c8860660dd7a59b3 Mon Sep 17 00:00:00 2001 From: Toby <45889209+BagelHole@users.noreply.github.com> Date: Sat, 21 Feb 2026 09:54:14 -0500 Subject: [PATCH] Add OpenClaw local and Mac mini setup skill --- README.md | 41 ++++++++++ devops/ai/agent-evals/SKILL.md | 39 ++++++++++ devops/ai/agent-observability/SKILL.md | 38 ++++++++++ .../cloudflare/cloudflare-pages/SKILL.md | 39 ++++++++++ .../cloudflare/cloudflare-r2/SKILL.md | 42 +++++++++++ .../cloudflare/cloudflare-workers/SKILL.md | 46 ++++++++++++ .../cloudflare/cloudflare-zero-trust/SKILL.md | 39 ++++++++++ infrastructure/databases/planetscale/SKILL.md | 31 ++++++++ .../it/startup-it-troubleshooting/SKILL.md | 39 ++++++++++ .../local-ai/mac-mini-llm-lab/SKILL.md | 37 ++++++++++ infrastructure/local-ai/ollama-stack/SKILL.md | 38 ++++++++++ .../local-ai/openclaw-local-mac-mini/SKILL.md | 74 +++++++++++++++++++ .../platforms/convex-backend/SKILL.md | 32 ++++++++ .../platforms/firebase-app-platform/SKILL.md | 33 +++++++++ .../platforms/vercel-deployments/SKILL.md | 34 +++++++++ security/ai/ai-agent-security/SKILL.md | 38 ++++++++++ security/ai/llm-app-security/SKILL.md | 32 ++++++++ 17 files changed, 672 insertions(+) create mode 100644 devops/ai/agent-evals/SKILL.md create mode 100644 devops/ai/agent-observability/SKILL.md create mode 100644 infrastructure/cloudflare/cloudflare-pages/SKILL.md create mode 100644 infrastructure/cloudflare/cloudflare-r2/SKILL.md create mode 100644 infrastructure/cloudflare/cloudflare-workers/SKILL.md create mode 100644 infrastructure/cloudflare/cloudflare-zero-trust/SKILL.md create mode 100644 infrastructure/databases/planetscale/SKILL.md create mode 100644 infrastructure/it/startup-it-troubleshooting/SKILL.md create mode 100644 infrastructure/local-ai/mac-mini-llm-lab/SKILL.md create mode 100644 infrastructure/local-ai/ollama-stack/SKILL.md create mode 100644 infrastructure/local-ai/openclaw-local-mac-mini/SKILL.md create mode 100644 infrastructure/platforms/convex-backend/SKILL.md create mode 100644 infrastructure/platforms/firebase-app-platform/SKILL.md create mode 100644 infrastructure/platforms/vercel-deployments/SKILL.md create mode 100644 security/ai/ai-agent-security/SKILL.md create mode 100644 security/ai/llm-app-security/SKILL.md diff --git a/README.md b/README.md index 11a8714..eb0727f 100644 --- a/README.md +++ b/README.md @@ -53,6 +53,7 @@ This repo is a **comprehensive knowledge base** designed to be loaded into AI ag | 🔧 **DevOps** | CI/CD, containers, K8s, observability, release management | | 🔒 **Security** | Scanning, secrets, hardening, network security, incident response | | ☁️ **Infrastructure** | AWS, Azure, GCP, servers, networking, databases, storage | +| 🤖 **AI & Platforms** | Agent infrastructure, local LLM ops, and modern app platforms | | 📋 **Compliance** | SOC2, HIPAA, GDPR, PCI-DSS, governance, auditing | --- @@ -205,6 +206,12 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [new-relic](devops/observability/new-relic/) | New Relic observability | | [alerting-oncall](devops/observability/alerting-oncall/) | Alert rules and on-call rotations | +### AI Engineering +| Skill | Description | +|-------|-------------| +| [agent-observability](devops/ai/agent-observability/) | Tracing, latency, token, and cost telemetry for agents | +| [agent-evals](devops/ai/agent-evals/) | Automated regression and safety eval suites for agents | + ### Release Management | Skill | Description | |-------|-------------| @@ -262,6 +269,12 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [penetration-testing](security/operations/penetration-testing/) | Basic pentesting | | [security-automation](security/operations/security-automation/) | Security workflow automation | +### AI Security +| Skill | Description | +|-------|-------------| +| [ai-agent-security](security/ai/ai-agent-security/) | Defend agents against injection, tool abuse, and exfiltration | +| [llm-app-security](security/ai/llm-app-security/) | Harden LLM app inputs, outputs, and tenant isolation | +
@@ -280,6 +293,14 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [aws-vpc](infrastructure/cloud-aws/aws-vpc/) | Networking | | [aws-iam](infrastructure/cloud-aws/aws-iam/) | Identity and access | +### Cloudflare +| Skill | Description | +|-------|-------------| +| [cloudflare-workers](infrastructure/cloudflare/cloudflare-workers/) | Edge functions and APIs with Wrangler | +| [cloudflare-pages](infrastructure/cloudflare/cloudflare-pages/) | Static/full-stack deployments with previews | +| [cloudflare-r2](infrastructure/cloudflare/cloudflare-r2/) | S3-compatible object storage without egress fees | +| [cloudflare-zero-trust](infrastructure/cloudflare/cloudflare-zero-trust/) | Access policies and private app protection | + ### Azure | Skill | Description | |-------|-------------| @@ -325,6 +346,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's |-------|-------------| | [postgresql](infrastructure/databases/postgresql/) | PostgreSQL admin | | [mysql](infrastructure/databases/mysql/) | MySQL/MariaDB | +| [planetscale](infrastructure/databases/planetscale/) | Branch-based MySQL schema deployments | | [mongodb](infrastructure/databases/mongodb/) | MongoDB clusters | | [redis](infrastructure/databases/redis/) | Redis caching | | [database-backups](infrastructure/databases/database-backups/) | Backup strategies | @@ -337,6 +359,25 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [nfs-storage](infrastructure/storage/nfs-storage/) | NFS servers | | [backup-recovery](infrastructure/storage/backup-recovery/) | Backup with restic | +### Platforms +| Skill | Description | +|-------|-------------| +| [vercel-deployments](infrastructure/platforms/vercel-deployments/) | Preview and production web app deployments | +| [convex-backend](infrastructure/platforms/convex-backend/) | Realtime managed backend with typed functions | +| [firebase-app-platform](infrastructure/platforms/firebase-app-platform/) | Firebase auth, data, functions, and hosting | + +### Local AI Infrastructure +| Skill | Description | +|-------|-------------| +| [ollama-stack](infrastructure/local-ai/ollama-stack/) | Private local inference stack with Ollama | +| [mac-mini-llm-lab](infrastructure/local-ai/mac-mini-llm-lab/) | Mac mini setup for always-on local LLM serving | +| [openclaw-local-mac-mini](infrastructure/local-ai/openclaw-local-mac-mini/) | OpenClaw setup for local development and Mac mini hosting | + +### IT Operations +| Skill | Description | +|-------|-------------| +| [startup-it-troubleshooting](infrastructure/it/startup-it-troubleshooting/) | Practical IT troubleshooting for small teams | +
diff --git a/devops/ai/agent-evals/SKILL.md b/devops/ai/agent-evals/SKILL.md new file mode 100644 index 0000000..3a445b8 --- /dev/null +++ b/devops/ai/agent-evals/SKILL.md @@ -0,0 +1,39 @@ +--- +name: agent-evals +description: Build automated evaluation suites for AI agents using golden datasets, rubrics, and regression gates. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Agent Evals + +Create repeatable checks so agent behavior improves safely over time. + +## Evaluation Layers + +- Unit evals: prompt-level correctness +- Tool evals: API/tool call decision quality +- End-to-end evals: realistic multi-step tasks +- Safety evals: prompt injection and data leak resistance + +## CI/CD Integration + +```bash +# Example eval pipeline steps +make evals-smoke +make evals-regression +make evals-safety +``` + +## Best Practices + +- Version datasets with expected outputs. +- Track pass rates and score drift over time. +- Block deploys on critical safety regressions. + +## Related Skills + +- [github-actions](../../ci-cd/github-actions/) - Eval automation in CI +- [ai-agent-security](../../../security/ai/ai-agent-security/) - Security-focused eval cases diff --git a/devops/ai/agent-observability/SKILL.md b/devops/ai/agent-observability/SKILL.md new file mode 100644 index 0000000..a9827b0 --- /dev/null +++ b/devops/ai/agent-observability/SKILL.md @@ -0,0 +1,38 @@ +--- +name: agent-observability +description: Instrument AI agents with tracing, token metrics, latency, and cost visibility. Use for reliability and debugging. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Agent Observability + +Monitor AI agent behavior with logs, traces, metrics, and cost telemetry. + +## Track Core Signals + +- Request latency (p50/p95/p99) +- Token usage (prompt/completion/cached) +- Tool call success and failure rates +- Cost per task and per customer +- Hallucination and retry frequency + +## Implementation Pattern + +1. Add trace IDs to every user request. +2. Capture each LLM call and tool call as child spans. +3. Emit structured logs with model, temperature, and response status. +4. Create SLOs for success rate and median response time. + +## Best Practices + +- Redact PII before exporting traces. +- Keep a replayable request envelope for incident review. +- Alert on abnormal token spikes and tool error bursts. + +## Related Skills + +- [alerting-oncall](../../observability/alerting-oncall/) - Alert workflows +- [agent-evals](../agent-evals/) - Quality verification diff --git a/infrastructure/cloudflare/cloudflare-pages/SKILL.md b/infrastructure/cloudflare/cloudflare-pages/SKILL.md new file mode 100644 index 0000000..892ea98 --- /dev/null +++ b/infrastructure/cloudflare/cloudflare-pages/SKILL.md @@ -0,0 +1,39 @@ +--- +name: cloudflare-pages +description: Deploy static sites and full-stack apps on Cloudflare Pages with previews, functions, and custom domains. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Cloudflare Pages + +Deploy frontend projects with preview builds and edge functions. + +## Connect Project + +1. Create a Pages project in Cloudflare dashboard. +2. Link your GitHub repository. +3. Set build command and output directory. +4. Configure environment variables per environment. + +## Wrangler-Based Deploy + +```bash +npm install -D wrangler +npx wrangler pages project create my-site +npx wrangler pages deploy dist --project-name=my-site +``` + +## Best Practices + +- Require previews for pull requests. +- Separate production and preview secrets. +- Enable Web Analytics for performance visibility. +- Add Cloudflare WAF rules for abuse protection. + +## Related Skills + +- [cloudflare-workers](../cloudflare-workers/) - Edge backend logic +- [vercel-deployments](../../platforms/vercel-deployments/) - Alternative frontend hosting diff --git a/infrastructure/cloudflare/cloudflare-r2/SKILL.md b/infrastructure/cloudflare/cloudflare-r2/SKILL.md new file mode 100644 index 0000000..fb62d92 --- /dev/null +++ b/infrastructure/cloudflare/cloudflare-r2/SKILL.md @@ -0,0 +1,42 @@ +--- +name: cloudflare-r2 +description: Manage Cloudflare R2 buckets, lifecycle, and signed URLs. Use for low-egress object storage and media delivery. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Cloudflare R2 + +Use S3-compatible object storage without egress fees. + +## Setup + +```bash +# Create bucket +npx wrangler r2 bucket create app-assets + +# List buckets +npx wrangler r2 bucket list + +# Upload object +npx wrangler r2 object put app-assets/logo.png --file ./logo.png +``` + +## S3-Compatible Access + +- Generate R2 API tokens with least privilege. +- Use endpoint format: `https://.r2.cloudflarestorage.com`. +- Configure lifecycle rules for archive/delete. + +## Best Practices + +- Use short-lived signed URLs for private content. +- Store user uploads in tenant-specific prefixes. +- Enable object versioning for recovery-critical buckets. + +## Related Skills + +- [cloudflare-workers](../cloudflare-workers/) - Signed URL generation +- [object-storage](../../storage/object-storage/) - Storage patterns diff --git a/infrastructure/cloudflare/cloudflare-workers/SKILL.md b/infrastructure/cloudflare/cloudflare-workers/SKILL.md new file mode 100644 index 0000000..182f8e3 --- /dev/null +++ b/infrastructure/cloudflare/cloudflare-workers/SKILL.md @@ -0,0 +1,46 @@ +--- +name: cloudflare-workers +description: Build and deploy edge functions with Cloudflare Workers and Wrangler. Use for APIs, cron jobs, and edge middleware. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Cloudflare Workers + +Deploy JavaScript/TypeScript functions globally at the edge. + +## Quick Start + +```bash +npm create cloudflare@latest my-worker +cd my-worker +npx wrangler login +npx wrangler deploy +``` + +## Common Commands + +```bash +# Local dev +npx wrangler dev + +# Set secret +npx wrangler secret put API_TOKEN + +# Tail logs +npx wrangler tail +``` + +## Best Practices + +- Keep workers stateless and fast. +- Use KV, D1, or R2 for persistence. +- Add rate limits for public APIs. +- Version Wrangler config in git. + +## Related Skills + +- [cloudflare-pages](../cloudflare-pages/) - Frontend deployments +- [cloudflare-r2](../cloudflare-r2/) - Object storage at the edge diff --git a/infrastructure/cloudflare/cloudflare-zero-trust/SKILL.md b/infrastructure/cloudflare/cloudflare-zero-trust/SKILL.md new file mode 100644 index 0000000..07d9b67 --- /dev/null +++ b/infrastructure/cloudflare/cloudflare-zero-trust/SKILL.md @@ -0,0 +1,39 @@ +--- +name: cloudflare-zero-trust +description: Protect internal apps with Cloudflare Access, device posture, and Zero Trust policies. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Cloudflare Zero Trust + +Secure access to internal services without exposing public VPN endpoints. + +## Core Workflow + +1. Register application in Cloudflare Access. +2. Integrate identity provider (Google Workspace, Okta, Entra ID). +3. Define access policies by group, email domain, and device posture. +4. Add logging and alerts for blocked requests. + +## Tunnel Setup + +```bash +cloudflared tunnel login +cloudflared tunnel create internal-app +cloudflared tunnel route dns internal-app app.example.com +cloudflared tunnel run internal-app +``` + +## Best Practices + +- Enforce MFA and managed-device posture checks. +- Use service tokens for CI/CD automation. +- Review app policies quarterly. + +## Related Skills + +- [zero-trust](../../../security/network/zero-trust/) - Zero trust architecture fundamentals +- [dns-management](../../networking/dns-management/) - DNS routing concepts diff --git a/infrastructure/databases/planetscale/SKILL.md b/infrastructure/databases/planetscale/SKILL.md new file mode 100644 index 0000000..189023b --- /dev/null +++ b/infrastructure/databases/planetscale/SKILL.md @@ -0,0 +1,31 @@ +--- +name: planetscale +description: Operate MySQL-compatible databases on PlanetScale with branching workflows, safe migrations, and production rollouts. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# PlanetScale + +Use PlanetScale for serverless MySQL with non-blocking schema change workflows. + +## Branching Workflow + +1. Create a database branch for schema work. +2. Apply migrations to the branch. +3. Open a deploy request and run checks. +4. Merge to production during low-risk windows. + +## Operational Best Practices + +- Keep schema changes backward compatible first. +- Use connection pooling for serverless apps. +- Monitor query insights for slow statements. +- Define rollback strategy for every deploy request. + +## Related Skills + +- [mysql](../mysql/) - MySQL tuning fundamentals +- [database-backups](../database-backups/) - Recovery planning diff --git a/infrastructure/it/startup-it-troubleshooting/SKILL.md b/infrastructure/it/startup-it-troubleshooting/SKILL.md new file mode 100644 index 0000000..552bea1 --- /dev/null +++ b/infrastructure/it/startup-it-troubleshooting/SKILL.md @@ -0,0 +1,39 @@ +--- +name: startup-it-troubleshooting +description: Practical IT troubleshooting playbooks for small teams without dedicated IT staff. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Startup IT Troubleshooting + +Run lightweight IT operations for startups and small teams. + +## Priority Triage Order + +1. Company-wide outages (internet, SSO, email) +2. Executive or customer-facing blockers +3. Team-wide performance degradations +4. Individual workstation issues + +## Common Fix Playbooks + +- Identity and access lockouts +- VPN and Wi-Fi reliability issues +- Laptop disk and memory pressure +- Endpoint patching and update failures +- Printer and conferencing room failures + +## Process Best Practices + +- Keep an internal runbook and known-issues log. +- Standardize onboarding/offboarding checklists. +- Track asset ownership and warranty windows. +- Escalate recurring incidents into root-cause fixes. + +## Related Skills + +- [incident-management](../../../compliance/continuity/incident-management/) - Structured incident handling +- [runbook-creation](../../../compliance/continuity/runbook-creation/) - Documentation standards diff --git a/infrastructure/local-ai/mac-mini-llm-lab/SKILL.md b/infrastructure/local-ai/mac-mini-llm-lab/SKILL.md new file mode 100644 index 0000000..a49d0e4 --- /dev/null +++ b/infrastructure/local-ai/mac-mini-llm-lab/SKILL.md @@ -0,0 +1,37 @@ +--- +name: mac-mini-llm-lab +description: Configure a Mac mini as a reliable local LLM server with remote access, observability, and power-safe operation. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Mac mini LLM Lab + +Turn a Mac mini into a low-noise, always-on local AI appliance. + +## System Setup + +1. Update macOS and Xcode command line tools. +2. Install Homebrew and core packages (`tmux`, `htop`, `ollama`). +3. Enable automatic login and restart-after-power-failure. +4. Configure Tailscale or WireGuard for remote access. + +## Reliability Checklist + +- Keep device on wired Ethernet. +- Use UPS for power protection. +- Schedule weekly reboot window. +- Add launchd service for Ollama auto-start. + +## Security Checklist + +- Disable unnecessary sharing services. +- Enforce FileVault and strong local admin password. +- Restrict SSH to key-based auth only. + +## Related Skills + +- [ollama-stack](../ollama-stack/) - Local inference software stack +- [ssh-configuration](../../servers/ssh-configuration/) - Secure remote shell access diff --git a/infrastructure/local-ai/ollama-stack/SKILL.md b/infrastructure/local-ai/ollama-stack/SKILL.md new file mode 100644 index 0000000..d916dbe --- /dev/null +++ b/infrastructure/local-ai/ollama-stack/SKILL.md @@ -0,0 +1,38 @@ +--- +name: ollama-stack +description: Run local LLM workloads with Ollama, Open WebUI, and GPU-aware tuning for private development environments. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Ollama Stack + +Deploy a local LLM stack for offline and privacy-first workflows. + +## Minimal Setup + +```bash +curl -fsSL https://ollama.com/install.sh | sh +ollama serve +ollama pull llama3.1:8b +ollama run llama3.1:8b +``` + +## Docker Compose Pattern + +- Ollama container with persistent model volume +- Open WebUI for chat interface +- Optional LiteLLM proxy for unified API routing + +## Best Practices + +- Pin model versions for reproducibility. +- Monitor VRAM, RAM, and swap utilization. +- Restrict network exposure to trusted subnets. + +## Related Skills + +- [mac-mini-llm-lab](../mac-mini-llm-lab/) - Apple Silicon optimization +- [docker-compose](../../../devops/containers/docker-compose/) - Service orchestration diff --git a/infrastructure/local-ai/openclaw-local-mac-mini/SKILL.md b/infrastructure/local-ai/openclaw-local-mac-mini/SKILL.md new file mode 100644 index 0000000..dea6f8b --- /dev/null +++ b/infrastructure/local-ai/openclaw-local-mac-mini/SKILL.md @@ -0,0 +1,74 @@ +--- +name: openclaw-local-mac-mini +description: Set up OpenClaw locally and run it reliably on a Mac mini for private, always-on local agent workflows. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# OpenClaw Local + Mac mini Setup + +Use this skill when you want to run [OpenClaw](https://github.com/openclaw/openclaw) on a developer laptop or promote it to a stable Mac mini host. + +## Local Setup (any modern dev machine) + +1. Clone and enter repository. +2. Follow upstream prerequisites from OpenClaw README (runtime, package manager, model/provider requirements). +3. Create a local environment file from the example and configure keys/endpoints. +4. Install dependencies and run the development command. +5. Validate startup by loading the local UI/API health endpoint. + +```bash +git clone https://github.com/openclaw/openclaw.git +cd openclaw +# Follow upstream bootstrap steps in repo docs +# cp .env.example .env +# +# +``` + +## Mac mini Production-ish Setup + +### Host baseline + +- Keep macOS updated and enable automatic security updates. +- Use wired Ethernet and a UPS for stability. +- Enable FileVault and lock down local admin access. +- Configure Tailscale or WireGuard for secure remote admin. + +### Service operation + +- Run OpenClaw in a dedicated user account. +- Store secrets in macOS Keychain or a managed secret store (avoid plain-text files in shared folders). +- Use `tmux` for manual operation or `launchd` for auto-start on reboot. +- Keep logs rotated and monitor disk usage. + +### launchd pattern (example) + +Create `/Library/LaunchDaemons/com.openclaw.service.plist` to run startup command from the OpenClaw directory, then: + +```bash +sudo launchctl load -w /Library/LaunchDaemons/com.openclaw.service.plist +sudo launchctl list | rg openclaw +``` + +## Validation Checklist + +- App starts after reboot without manual intervention. +- Health check succeeds from local network. +- Secrets are not committed and not world-readable. +- Access to admin interfaces is restricted to trusted users/devices. + +## Troubleshooting Quick Hits + +- Slow responses: verify model backend availability and local RAM/CPU pressure. +- Boot failures: inspect launchd logs and working directory paths. +- Auth errors: re-check provider keys, scopes, and endpoint URLs. +- Random crashes: pin dependency versions and restart with clean environment. + +## Related Skills + +- [ollama-stack](../ollama-stack/) - Local model serving patterns +- [mac-mini-llm-lab](../mac-mini-llm-lab/) - Mac mini reliability and security baseline +- [startup-it-troubleshooting](../../it/startup-it-troubleshooting/) - Small-team operational triage diff --git a/infrastructure/platforms/convex-backend/SKILL.md b/infrastructure/platforms/convex-backend/SKILL.md new file mode 100644 index 0000000..98fb817 --- /dev/null +++ b/infrastructure/platforms/convex-backend/SKILL.md @@ -0,0 +1,32 @@ +--- +name: convex-backend +description: Build reactive backends with Convex functions, schema validation, auth integration, and deployment workflows. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Convex Backend + +Use Convex to build type-safe backend logic with realtime data sync. + +## Quick Start + +```bash +npm install convex +npx convex dev +npx convex deploy +``` + +## Implementation Tips + +- Define schema and validation before writing functions. +- Keep mutations idempotent where possible. +- Use auth identity checks in every privileged query/mutation. +- Add indexing early for high-read collections. + +## Related Skills + +- [firebase-app-platform](../firebase-app-platform/) - Alternative managed backend +- [agent-observability](../../../devops/ai/agent-observability/) - Instrument AI-driven backend flows diff --git a/infrastructure/platforms/firebase-app-platform/SKILL.md b/infrastructure/platforms/firebase-app-platform/SKILL.md new file mode 100644 index 0000000..ab06148 --- /dev/null +++ b/infrastructure/platforms/firebase-app-platform/SKILL.md @@ -0,0 +1,33 @@ +--- +name: firebase-app-platform +description: Build and operate apps on Firebase using Auth, Firestore, Cloud Functions, and Hosting. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Firebase App Platform + +Ship mobile and web backends with Firebase managed services. + +## Core Setup + +```bash +npm install -g firebase-tools +firebase login +firebase init +firebase deploy +``` + +## Security and Scale + +- Write strict Firestore security rules first. +- Separate environments by Firebase project. +- Enable budget alerts and quota monitoring. +- Move privileged logic into Cloud Functions. + +## Related Skills + +- [gcp-cloud-functions](../../cloud-gcp/gcp-cloud-functions/) - Function runtime patterns +- [vercel-deployments](../vercel-deployments/) - Frontend deployment option diff --git a/infrastructure/platforms/vercel-deployments/SKILL.md b/infrastructure/platforms/vercel-deployments/SKILL.md new file mode 100644 index 0000000..2d92c66 --- /dev/null +++ b/infrastructure/platforms/vercel-deployments/SKILL.md @@ -0,0 +1,34 @@ +--- +name: vercel-deployments +description: Deploy frontend and full-stack apps on Vercel with previews, edge functions, and environment promotion. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# Vercel Deployments + +Ship web apps quickly with preview environments and managed edge infrastructure. + +## Core Workflow + +```bash +npm i -g vercel +vercel login +vercel link +vercel +vercel --prod +``` + +## Production Guardrails + +- Require preview checks before merge. +- Separate preview and production environment variables. +- Use branch protection with required deployment status. +- Monitor function duration and cold start behavior. + +## Related Skills + +- [github-actions](../../../devops/ci-cd/github-actions/) - Automated deployment gates +- [cloudflare-pages](../../cloudflare/cloudflare-pages/) - Alternative edge hosting diff --git a/security/ai/ai-agent-security/SKILL.md b/security/ai/ai-agent-security/SKILL.md new file mode 100644 index 0000000..780da71 --- /dev/null +++ b/security/ai/ai-agent-security/SKILL.md @@ -0,0 +1,38 @@ +--- +name: ai-agent-security +description: Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# AI Agent Security + +Protect agentic systems from adversarial input and unsafe tool execution. + +## Threats to Model + +- Prompt injection through untrusted content +- Excessive permissions on tools and APIs +- Data exfiltration via model responses +- Cross-tenant context leakage + +## Security Controls + +1. Isolate tool execution with strict allowlists. +2. Add policy checks before sensitive actions. +3. Limit token scope and credential lifetimes. +4. Apply output filtering for sensitive data. +5. Log every privileged tool invocation. + +## Incident Readiness + +- Keep immutable audit trails for prompts and tool calls. +- Build kill switches for high-risk tools. +- Run regular red-team scenarios. + +## Related Skills + +- [llm-app-security](../llm-app-security/) - Application-layer LLM defenses +- [threat-modeling](../operations/threat-modeling/) - Structured risk analysis diff --git a/security/ai/llm-app-security/SKILL.md b/security/ai/llm-app-security/SKILL.md new file mode 100644 index 0000000..888c5b8 --- /dev/null +++ b/security/ai/llm-app-security/SKILL.md @@ -0,0 +1,32 @@ +--- +name: llm-app-security +description: Secure LLM-powered applications with input validation, output controls, tenant isolation, and abuse prevention. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# LLM Application Security + +Harden chatbots and AI features embedded in web and mobile products. + +## Baseline Security Checklist + +- Validate and classify all user-provided context. +- Separate system prompts from user content strictly. +- Add moderation for toxic, harmful, and policy-violating outputs. +- Enforce tenant boundaries in retrieval and memory layers. +- Rate-limit high-cost endpoints. + +## Secure RAG Pattern + +1. Ingest content with malware and secret scanning. +2. Tag documents by tenant and access policy. +3. Filter retrieval candidates by user authorization. +4. Add provenance metadata in final responses. + +## Related Skills + +- [ai-agent-security](../ai-agent-security/) - Agent-specific controls +- [sast-scanning](../scanning/sast-scanning/) - Secure coding checks