Add high-demand skills and fix broken skill links

README.md

@@ -200,6 +200,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's
 | Skill | Description |
 |-------|-------------|
 | [prometheus-grafana](devops/observability/prometheus-grafana/) | Metrics and dashboards |
+| [opentelemetry](devops/observability/opentelemetry/) | Vendor-neutral traces, metrics, and logs |
 | [elk-stack](devops/observability/elk-stack/) | Elasticsearch, Logstash, Kibana |
 | [loki-logging](devops/observability/loki-logging/) | Grafana Loki log aggregation |
 | [datadog](devops/observability/datadog/) | Datadog monitoring and APM |
@@ -233,6 +234,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's
 | [dast-scanning](security/scanning/dast-scanning/) | OWASP ZAP, Nuclei |
 | [dependency-scanning](security/scanning/dependency-scanning/) | Snyk, Dependabot |
 | [container-scanning](security/scanning/container-scanning/) | Image vulnerability scanning |
+| [sbom-supply-chain](security/scanning/sbom-supply-chain/) | SBOM generation, signing, and provenance verification |
 
 ### Secrets Management
 | Skill | Description |
@@ -292,6 +294,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's
 | [aws-s3](infrastructure/cloud-aws/aws-s3/) | Object storage |
 | [aws-vpc](infrastructure/cloud-aws/aws-vpc/) | Networking |
 | [aws-iam](infrastructure/cloud-aws/aws-iam/) | Identity and access |
+| [aws-cost-optimization](infrastructure/cloud-aws/aws-cost-optimization/) | FinOps cost reduction and spend governance |
 
 ### Cloudflare
 | Skill | Description |

devops/observability/alerting-oncall/SKILL.md

@@ -495,4 +495,4 @@ fatigue_reduction:
 
 - [prometheus-grafana](../prometheus-grafana/) - Monitoring setup
 - [incident-response](../../../security/operations/incident-response/) - Incident handling
-- [runbook-automation](../../../compliance/continuity/runbook-automation/) - Runbook creation
+- [runbook-creation](../../../compliance/continuity/runbook-creation/) - Runbook creation

devops/observability/opentelemetry/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: opentelemetry
+description: Instrument applications and infrastructure with OpenTelemetry for unified traces, metrics, and logs. Use when implementing distributed tracing, service-level troubleshooting, or vendor-neutral observability.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# OpenTelemetry
+
+Adopt vendor-neutral telemetry with consistent instrumentation across services.
+
+## When to Use This Skill
+
+Use this skill when:
+- Debugging latency across microservices
+- Standardizing observability data model and naming
+- Sending telemetry to Prometheus, Grafana, Datadog, or OTLP backends
+- Building SLO dashboards with trace-to-log correlation
+
+## Core Workflow
+
+1. Define semantic conventions for services, environments, and versions.
+2. Add SDK or auto-instrumentation in each service.
+3. Run an OpenTelemetry Collector to receive, transform, and export telemetry.
+4. Validate cardinality and sampling to control cost.
+5. Create golden signals dashboards and alerting from collected data.
+
+## Collector Starter Config
+
+```yaml
+# otel-collector.yaml
+receivers:
+  otlp:
+    protocols:
+      grpc:
+      http:
+
+processors:
+  batch:
+  memory_limiter:
+    check_interval: 1s
+    limit_mib: 512
+  attributes:
+    actions:
+      - key: deployment.environment
+        value: production
+        action: upsert
+
+exporters:
+  debug: {}
+  otlp:
+    endpoint: observability-backend:4317
+    tls:
+      insecure: true
+
+service:
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [memory_limiter, batch, attributes]
+      exporters: [otlp, debug]
+    metrics:
+      receivers: [otlp]
+      processors: [memory_limiter, batch, attributes]
+      exporters: [otlp]
+```
+
+## Best Practices
+
+- Use tail-based sampling for high-volume production traces.
+- Tag telemetry with `service.name`, `service.version`, and `deployment.environment`.
+- Drop noisy attributes early in the collector.
+- Keep metric label cardinality low for stable query performance.
+
+## Related Skills
+
+- [prometheus-grafana](../prometheus-grafana/) - Dashboarding and alerting
+- [datadog](../datadog/) - Managed observability backend
+- [alerting-oncall](../alerting-oncall/) - On-call routing and escalation

infrastructure/cloud-aws/aws-cost-optimization/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: aws-cost-optimization
+description: Reduce AWS spend with rightsizing, autoscaling, commitment planning, and storage lifecycle policies. Use when running FinOps reviews, lowering cloud bills, or improving cost-per-request metrics.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# AWS Cost Optimization
+
+Apply practical FinOps controls without sacrificing reliability.
+
+## When to Use This Skill
+
+Use this skill when:
+- Monthly AWS cost spikes unexpectedly
+- Preparing cost reviews with engineering and finance
+- Rightsizing EC2, RDS, and EKS workloads
+- Choosing Savings Plans or Reserved Instances
+
+## Cost Review Workflow
+
+1. Tag resources by team, service, and environment.
+2. Use Cost Explorer and CUR to identify top spend drivers.
+3. Rightsize underutilized compute and storage.
+4. Apply commitment discounts for stable baseline usage.
+5. Set budgets, anomaly alerts, and KPI reporting.
+
+## High-Impact Actions
+
+- Move bursty non-prod compute to Spot where safe.
+- Configure S3 lifecycle rules for infrequent access and archive tiers.
+- Reduce NAT Gateway and inter-AZ data transfer surprises.
+- Schedule dev/test shutdown windows outside business hours.
+- Tune log retention (CloudWatch, OpenSearch) to policy requirements.
+
+## Useful Commands
+
+```bash
+# Cost Explorer rightsizing recommendations (example)
+aws ce get-rightsizing-recommendation \
+  --service "AmazonEC2" \
+  --configuration file://rightsizing-config.json
+
+# List unattached EBS volumes
+aws ec2 describe-volumes --filters Name=status,Values=available
+
+# Retrieve budget alerts
+aws budgets describe-budgets --account-id 123456789012
+```
+
+## Related Skills
+
+- [aws-ec2](../aws-ec2/) - EC2 operations and sizing
+- [aws-s3](../aws-s3/) - S3 storage and lifecycle controls
+- [terraform-aws](../terraform-aws/) - Codifying cost guardrails

security/ai/ai-agent-security/SKILL.md

@@ -35,4 +35,4 @@ Protect agentic systems from adversarial input and unsafe tool execution.
 ## Related Skills
 
 - [llm-app-security](../llm-app-security/) - Application-layer LLM defenses
-- [threat-modeling](../operations/threat-modeling/) - Structured risk analysis
+- [threat-modeling](../../operations/threat-modeling/) - Structured risk analysis

security/ai/llm-app-security/SKILL.md

@@ -29,4 +29,4 @@ Harden chatbots and AI features embedded in web and mobile products.
 ## Related Skills
 
 - [ai-agent-security](../ai-agent-security/) - Agent-specific controls
-- [sast-scanning](../scanning/sast-scanning/) - Secure coding checks
+- [sast-scanning](../../scanning/sast-scanning/) - Secure coding checks

security/scanning/sbom-supply-chain/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: sbom-supply-chain
+description: Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# SBOM & Supply Chain Security
+
+Improve release trust with reproducible metadata and verification gates.
+
+## When to Use This Skill
+
+Use this skill when:
+- Producing SBOMs for container images or application builds
+- Verifying dependencies before deploy
+- Enforcing signed artifact and provenance policies
+- Preparing for SOC2, ISO 27001, or customer security reviews
+
+## Recommended Tooling
+
+- SBOM generation: Syft, CycloneDX tools
+- Vulnerability matching: Grype, Trivy
+- Signing and attestations: Cosign, Sigstore
+- Policy enforcement: OPA, Kyverno, admission controllers
+
+## Baseline Workflow
+
+1. Generate SBOM in SPDX or CycloneDX format during CI builds.
+2. Create provenance attestations for build steps and source commit.
+3. Sign image digests and SBOM artifacts with keyless or managed keys.
+4. Verify signatures and attestations before deployment.
+5. Archive evidence for audits and incident response.
+
+## Example Commands
+
+```bash
+# Generate SBOM for an image
+syft registry:ghcr.io/acme/api:1.2.3 -o cyclonedx-json > sbom.json
+
+# Sign container image digest
+cosign sign ghcr.io/acme/api@sha256:abc123...
+
+# Attach SBOM attestation
+cosign attest --predicate sbom.json --type cyclonedx ghcr.io/acme/api@sha256:abc123...
+
+# Verify signatures
+cosign verify ghcr.io/acme/api@sha256:abc123...
+```
+
+## Related Skills
+
+- [dependency-scanning](../dependency-scanning/) - Library vulnerability triage
+- [container-scanning](../container-scanning/) - Container CVE scanning
+- [policy-as-code](../../../compliance/governance/policy-as-code/) - Policy enforcement