mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
25 KiB
25 KiB
🛡️ DevOps & Security Agent Skills
Your AI-Powered Second Brain for Infrastructure & Security
Stop Googling. Start Shipping.
Explore Skills · Get Started · Contribute
💡 The Problem
You're a solo founder, indie hacker, or one-person DevOps team. You need to:
- Set up CI/CD pipelines across 5 different platforms
- Harden your Linux servers (but you forgot the sysctl parameters)
- Write that Terraform module for the 47th time
- Remember how CloudTrail works... again
- Configure Kubernetes security contexts properly
- Actually understand what SOC2 needs
You can't remember everything. You shouldn't have to.
🚀 The Solution
This repo is a comprehensive knowledge base designed to be loaded into AI agents. It's your DevOps second brain — battle-tested scripts, production-ready configs, and expert knowledge organized using the Agent Skills format. You can install them with the skills.sh CLI (npx skills add, CLI docs, FAQ) alongside cloning this repository:
| Domain | What You Get |
|---|---|
| 🔧 DevOps | CI/CD, containers, K8s, observability, release management |
| 🔒 Security | Scanning, secrets, hardening, network security, incident response |
| ☁️ Infrastructure | AWS, Azure, GCP, servers, networking, databases, storage |
| 🤖 AI & Platforms | Agent infrastructure, local LLM ops, and modern app platforms |
| 📋 Compliance | SOC2, HIPAA, GDPR, PCI-DSS, governance, auditing |
✨ What's Inside
This isn't just documentation. Each skill includes:
skill/
├── SKILL.md # AI-readable instructions & knowledge
├── scripts/ # Ready-to-run automation scripts
├── references/ # Deep-dive guides & cheatsheets
└── assets/ # Config templates & examples
🎯 Real Examples
Need to debug a crashing pod?
./devops/orchestration/kubernetes-ops/scripts/pod-debug.sh my-pod
Hardening a fresh Linux server?
./security/hardening/linux-hardening/scripts/harden-system.sh --apply
Setting up Vault from scratch?
./security/secrets/hashicorp-vault/scripts/vault-init.sh
Collecting evidence during an incident?
./security/operations/incident-response/scripts/collect-evidence.sh INC-2024-001
🧠 How It Works
Agent Skills is an open format for extending AI agent capabilities. Here's the flow:
┌─────────────────────────────────────────────────────────────────┐
│ 1. DISCOVER 2. MATCH 3. ACTIVATE │
│ │
│ Agent scans → User asks about → Agent reads full │
│ skill folders Kubernetes SKILL.md + runs │
│ at startup debugging scripts as needed │
└─────────────────────────────────────────────────────────────────┘
Each SKILL.md has YAML frontmatter (name + description) that agents load at startup for matching, and markdown instructions that get loaded only when the skill is activated. This keeps context usage efficient.
📖 Full spec: agentskills.io/specification
🏃 Quick Start
1. Install with the skills CLI (skills.sh)
The skills CLI discovers every SKILL.md in this repository (including nested paths) and can symlink or copy them into your agent’s skills directory—Cursor, Claude Code, Codex, OpenCode, and many others are supported. See the CLI reference and FAQ for details.
# Install from GitHub (use your fork’s owner/repo if different)
npx skills add bagelhole/DevOps-Security-Agent-Skills
# List skills without installing
npx skills add bagelhole/DevOps-Security-Agent-Skills --list
# Install specific skills to Cursor, non-interactively
npx skills add bagelhole/DevOps-Security-Agent-Skills --skill kubernetes-ops --skill hashicorp-vault -a cursor -y
# Global install (~/) instead of the current project
npx skills add bagelhole/DevOps-Security-Agent-Skills -g -y
# Install a single skill by path in the repo
npx skills add https://github.com/bagelhole/DevOps-Security-Agent-Skills/tree/main/devops/orchestration/kubernetes-ops
You can also install from a local clone of this repo: npx skills add . --list from the repository root.
2. Download the Skills (clone or submodule)
# Clone to your skills directory
git clone https://github.com/bagelhole/DevOps-Security-Agent-Skills.git ~/.skills/devops-security
# Or add as a submodule to your project
git submodule add https://github.com/bagelhole/DevOps-Security-Agent-Skills.git .skills/devops-security
3. Integrate with Your Agent
Filesystem-based agents (Cursor, Claude with computer use, Cline, etc.) are the easiest — the agent can read skills directly:
# Agent reads skill when needed
cat ~/.skills/devops-security/devops/orchestration/kubernetes-ops/SKILL.md
Tool-based agents need skills injected into the system prompt. Use the skills-ref CLI:
# Generate XML for your agent's system prompt
skills-ref to-prompt ~/.skills/devops-security/devops/ci-cd/*
# Output:
# <available_skills>
# <skill>
# <name>github-actions</name>
# <description>Build, test, and deploy with GitHub Actions workflows...</description>
# <location>~/.skills/devops-security/devops/ci-cd/github-actions/SKILL.md</location>
# </skill>
# ...
# </available_skills>
4. Validate Skills (Optional)
# Check skill format is correct
skills-ref validate ~/.skills/devops-security/security/secrets/hashicorp-vault
For Humans
No agent? No problem. Browse the skills, copy the scripts, use the configs. It's MIT licensed — go wild.
📚 Skill Catalog
🔧 DevOps
CI/CD
| Skill | Description |
|---|---|
| github-actions | Build, test, and deploy with GitHub Actions |
| gitlab-ci | GitLab CI/CD pipelines and runners |
| jenkins | Jenkins pipelines and shared libraries |
| azure-devops | Azure Pipelines and release management |
| circleci | CircleCI workflows and orbs |
Containers
| Skill | Description |
|---|---|
| docker-management | Docker images, multi-stage builds, optimization |
| docker-compose | Multi-container applications |
| podman | Rootless container management |
| container-registries | ECR, ACR, GCR, Docker Hub |
Orchestration
| Skill | Description |
|---|---|
| kubernetes-ops | Deploy, scale, troubleshoot K8s |
| helm-charts | Helm chart development and deployment |
| argocd-gitops | GitOps with ArgoCD |
| kustomize | Kubernetes manifest customization |
| openshift | OpenShift cluster management |
| model-serving-kubernetes | KServe and Triton model serving with canary deployments and GPU autoscaling |
Observability
| Skill | Description |
|---|---|
| prometheus-grafana | Metrics and dashboards |
| opentelemetry | Vendor-neutral traces, metrics, and logs |
| elk-stack | Elasticsearch, Logstash, Kibana |
| loki-logging | Grafana Loki log aggregation |
| datadog | Datadog monitoring and APM |
| new-relic | New Relic observability |
| alerting-oncall | Alert rules and on-call rotations |
AI Engineering
| Skill | Description |
|---|---|
| agent-observability | Tracing, latency, token, and cost telemetry for agents |
| agent-evals | Automated regression and safety eval suites for agents |
| llm-cost-optimization | Cut LLM API costs with caching, batching, model routing, and self-hosting |
| llm-caching | Exact and semantic caching layers to reduce API calls by 30–70% |
| ai-pipeline-orchestration | Orchestrate RAG ingestion, training, and batch inference with Prefect/Airflow |
| llmops-platform-engineering | Build enterprise LLMOps platforms with evaluation gates, promotions, rollback, and governance |
| model-registry-governance | Define model metadata, approvals, lifecycle policy, and auditable promotion controls |
| rag-observability-evals | Measure retrieval quality, groundedness, hallucination risk, and RAG regressions continuously |
| ai-sre-incident-response | AI-specific SRE playbooks for model outages, quality regressions, safety incidents, and spend spikes |
Release Management
| Skill | Description |
|---|---|
| git-workflow | Branching strategies and PR workflows |
| semantic-versioning | Automated versioning and changelogs |
| feature-flags | LaunchDarkly, Unleash |
| blue-green-deploy | Zero-downtime deployments |
🔒 Security
Scanning
| Skill | Description |
|---|---|
| vulnerability-scanning | CVE scanning with Trivy, Grype |
| sast-scanning | Semgrep, CodeQL, SonarQube |
| dast-scanning | OWASP ZAP, Nuclei |
| dependency-scanning | Snyk, Dependabot |
| container-scanning | Image vulnerability scanning |
| sbom-supply-chain | SBOM generation, signing, and provenance verification |
Secrets Management
| Skill | Description |
|---|---|
| hashicorp-vault | Vault setup, policies, secrets engines |
| aws-secrets-manager | AWS secrets and rotation |
| azure-keyvault | Azure Key Vault |
| gcp-secret-manager | GCP Secret Manager |
| sops-encryption | Mozilla SOPS |
Hardening
| Skill | Description |
|---|---|
| linux-hardening | CIS benchmarks, sysctl, SSH |
| windows-hardening | Windows security baselines |
| container-hardening | Secure Docker/K8s configs |
| kubernetes-hardening | K8s security contexts and policies |
| cis-benchmarks | CIS benchmark auditing |
| openclaw-deployment-hardening | OpenClaw CI/CD, container, and runtime hardening guardrails |
Network Security
| Skill | Description |
|---|---|
| firewall-config | iptables, UFW, cloud firewalls |
| waf-setup | AWS WAF, Cloudflare WAF |
| zero-trust | Zero-trust architecture |
| vpn-setup | WireGuard, OpenVPN |
| ssl-tls-management | Let's Encrypt, certificate management |
Security Operations
| Skill | Description |
|---|---|
| incident-response | IR playbooks and evidence collection |
| threat-modeling | STRIDE methodology |
| penetration-testing | Basic pentesting |
| security-automation | Security workflow automation |
AI Security
| Skill | Description |
|---|---|
| ai-agent-security | Defend agents against injection, tool abuse, and exfiltration |
| llm-app-security | Harden LLM app inputs, outputs, and tenant isolation |
| ai-security-hardening | Harden LLM deployments against prompt injection, model theft, and data exfiltration |
| prompt-injection-defense | Defend against direct/indirect prompt injection with isolation, tool controls, and output validation |
| ai-red-teaming | Run adversarial AI red team programs for jailbreaks, exfiltration, and tool abuse resilience |
| model-supply-chain-security | Protect model artifacts with signing, provenance, SBOM workflows, and trusted promotion policies |
☁️ Infrastructure
AWS
| Skill | Description |
|---|---|
| terraform-aws | AWS infrastructure as code |
| cloudformation | CloudFormation templates |
| aws-ec2 | EC2 instances and AMIs |
| aws-ecs-fargate | Container orchestration |
| aws-lambda | Serverless functions |
| aws-rds | Managed databases |
| aws-s3 | Object storage |
| aws-vpc | Networking |
| aws-iam | Identity and access |
| aws-cost-optimization | FinOps cost reduction and spend governance |
Cloudflare
| Skill | Description |
|---|---|
| cloudflare-workers | Edge functions and APIs with Wrangler |
| cloudflare-pages | Static/full-stack deployments with previews |
| cloudflare-r2 | S3-compatible object storage without egress fees |
| cloudflare-zero-trust | Access policies and private app protection |
Azure
| Skill | Description |
|---|---|
| terraform-azure | Azure infrastructure as code |
| arm-templates | ARM/Bicep templates |
| azure-vms | Virtual machines |
| azure-functions | Serverless |
| azure-aks | Kubernetes |
| azure-sql | Databases |
| azure-networking | VNets and NSGs |
GCP
| Skill | Description |
|---|---|
| terraform-gcp | GCP infrastructure as code |
| gcp-compute | Compute Engine |
| gcp-cloud-functions | Serverless |
| gcp-gke | Kubernetes |
| gcp-cloud-sql | Databases |
| gcp-networking | VPCs and firewall |
Server Management
| Skill | Description |
|---|---|
| linux-administration | Core Linux admin |
| windows-server | Windows administration |
| ssh-configuration | SSH and bastion hosts |
| user-management | Users, groups, sudo |
| systemd-services | Services and timers |
| performance-tuning | System optimization |
| gpu-server-management | NVIDIA GPU driver setup, MIG partitioning, DCGM monitoring for AI workloads |
Networking
| Skill | Description |
|---|---|
| dns-management | DNS and Route53 |
| load-balancing | ALB, nginx, HAProxy |
| cdn-setup | CloudFront, Cloudflare |
| reverse-proxy | nginx, Traefik |
| service-mesh | Istio, Linkerd |
| llm-gateway | Unified LLM API gateway with routing, rate limiting, virtual keys, and semantic caching |
| ai-inference-service-mesh | Service mesh patterns for mTLS, canary inference routing, and resilient AI east-west traffic |
Databases
| Skill | Description |
|---|---|
| postgresql | PostgreSQL admin |
| mysql | MySQL/MariaDB |
| planetscale | Branch-based MySQL schema deployments |
| mongodb | MongoDB clusters |
| redis | Redis caching |
| database-backups | Backup strategies |
| vector-database-ops | Qdrant, Weaviate, and pgvector for production AI search and RAG workloads |
Storage
| Skill | Description |
|---|---|
| block-storage | EBS, LVM |
| object-storage | S3, MinIO |
| nfs-storage | NFS servers |
| backup-recovery | Backup with restic |
Platforms
| Skill | Description |
|---|---|
| vercel-deployments | Preview and production web app deployments |
| convex-backend | Realtime managed backend with typed functions |
| firebase-app-platform | Firebase auth, data, functions, and hosting |
Local AI Infrastructure
| Skill | Description |
|---|---|
| ollama-stack | Private local inference stack with Ollama |
| mac-mini-llm-lab | Mac mini setup for always-on local LLM serving |
| openclaw-local-mac-mini | OpenClaw setup for local development and Mac mini hosting |
| openclaw-security-hardening | OpenClaw host, auth, secrets, and network hardening for self-hosted deployments |
| vllm-server | High-throughput LLM serving with vLLM — PagedAttention, tensor parallelism, OpenAI API |
| llm-inference-scaling | Auto-scale LLM inference clusters on Kubernetes with KEDA and GPU-aware scheduling |
| rag-infrastructure | Production RAG with vector stores, hybrid search, embedding pipelines, and reranking |
| llm-fine-tuning | QLoRA and full fine-tuning with Axolotl, DeepSpeed, and DPO alignment on GPU clusters |
| gpu-kubernetes-operations | Run GPU Kubernetes clusters with MIG, autoscaling, node health checks, and AI cost controls |
| multi-tenant-llm-hosting | Secure multi-tenant LLM hosting with quotas, isolation boundaries, and per-tenant billing controls |
IT Operations
| Skill | Description |
|---|---|
| startup-it-troubleshooting | Practical IT troubleshooting for small teams |
📋 Compliance
Frameworks
| Skill | Description |
|---|---|
| soc2-compliance | SOC2 Trust Services Criteria |
| hipaa-compliance | HIPAA security rules |
| gdpr-compliance | GDPR data protection |
| pci-dss-compliance | PCI-DSS requirements |
| iso27001-compliance | ISO 27001 ISMS |
| fedramp-compliance | FedRAMP controls |
Governance
| Skill | Description |
|---|---|
| policy-as-code | OPA, Kyverno, Checkov |
| access-review | IAM access reviews |
| change-management | Change control |
| asset-inventory | Asset tracking |
| vendor-management | Third-party security |
Auditing
| Skill | Description |
|---|---|
| audit-logging | Centralized audit logs |
| aws-cloudtrail | CloudTrail configuration |
| azure-monitor-audit | Azure Monitor logs |
| gcp-audit-logs | GCP Cloud Audit Logs |
Business Continuity
| Skill | Description |
|---|---|
| disaster-recovery | DR strategies |
| business-continuity | BCP planning |
| incident-management | Incident processes |
| runbook-creation | Operational runbooks |
🤝 Contributing
Found a bug? Want to add a skill? PRs are welcome!
See CONTRIBUTING.md for guidelines.
⭐ Support
If this helped you ship faster, star this repo — it helps others find it too.
Built with ☕ by Toby Miller