🛡️ DevOps & Security Agent Skills

Your AI-Powered Second Brain for Infrastructure & Security

Stop Googling. Start Shipping.

Explore Skills · Get Started · Contribute

                    

---

💡 The Problem

You're a solo founder, indie hacker, or one-person DevOps team. You need to:

• Set up CI/CD pipelines across 5 different platforms
• Harden your Linux servers (but you forgot the sysctl parameters)
• Write that Terraform module for the 47th time
• Remember how CloudTrail works... again
• Configure Kubernetes security contexts properly
• Actually understand what SOC2 needs

You can't remember everything. You shouldn't have to.

---

🚀 The Solution

This repo is a comprehensive knowledge base designed to be loaded into AI agents. It's your DevOps second brain — battle-tested scripts, production-ready configs, and expert knowledge organized using the Agent Skills format:

Domain	What You Get
🔧 DevOps	CI/CD, containers, K8s, observability, release management
🔒 Security	Scanning, secrets, hardening, network security, incident response
☁️ Infrastructure	AWS, Azure, GCP, servers, networking, databases, storage
🤖 AI & Platforms	Agent infrastructure, local LLM ops, and modern app platforms
📋 Compliance	SOC2, HIPAA, GDPR, PCI-DSS, governance, auditing

---

✨ What's Inside

This isn't just documentation. Each skill includes:

skill/
├── SKILL.md          # AI-readable instructions & knowledge
├── scripts/          # Ready-to-run automation scripts
├── references/       # Deep-dive guides & cheatsheets  
└── assets/           # Config templates & examples

🎯 Real Examples

Need to debug a crashing pod?

./devops/orchestration/kubernetes-ops/scripts/pod-debug.sh my-pod

Hardening a fresh Linux server?

./security/hardening/linux-hardening/scripts/harden-system.sh --apply

Setting up Vault from scratch?

./security/secrets/hashicorp-vault/scripts/vault-init.sh

Collecting evidence during an incident?

./security/operations/incident-response/scripts/collect-evidence.sh INC-2024-001

---

🧠 How It Works

Agent Skills is an open format for extending AI agent capabilities. Here's the flow:

┌─────────────────────────────────────────────────────────────────┐
│  1. DISCOVER        2. MATCH           3. ACTIVATE              │
│                                                                 │
│  Agent scans     →  User asks about  →  Agent reads full       │
│  skill folders      Kubernetes          SKILL.md + runs        │
│  at startup         debugging           scripts as needed      │
└─────────────────────────────────────────────────────────────────┘

Each SKILL.md has YAML frontmatter (name + description) that agents load at startup for matching, and markdown instructions that get loaded only when the skill is activated. This keeps context usage efficient.

📖 Full spec: agentskills.io/specification

---

🏃 Quick Start

1. Download the Skills

# Clone to your skills directory
git clone https://github.com/bagelhole/DevOps-Security-Agent-Skills.git ~/.skills/devops-security

# Or add as a submodule to your project
git submodule add https://github.com/bagelhole/DevOps-Security-Agent-Skills.git .skills/devops-security

2. Integrate with Your Agent

Filesystem-based agents (Cursor, Claude with computer use, Cline, etc.) are the easiest — the agent can read skills directly:

# Agent reads skill when needed
cat ~/.skills/devops-security/devops/orchestration/kubernetes-ops/SKILL.md

Tool-based agents need skills injected into the system prompt. Use the skills-ref CLI:

# Generate XML for your agent's system prompt
skills-ref to-prompt ~/.skills/devops-security/devops/ci-cd/*

# Output:
# <available_skills>
#   <skill>
#     <name>github-actions</name>
#     <description>Build, test, and deploy with GitHub Actions workflows...</description>
#     <location>~/.skills/devops-security/devops/ci-cd/github-actions/SKILL.md</location>
#   </skill>
#   ...
# </available_skills>

3. Validate Skills (Optional)

# Check skill format is correct
skills-ref validate ~/.skills/devops-security/security/secrets/hashicorp-vault

For Humans

No agent? No problem. Browse the skills, copy the scripts, use the configs. It's MIT licensed — go wild.

---

📚 Skill Catalog

🔧 DevOps

CI/CD

Skill	Description
github-actions	Build, test, and deploy with GitHub Actions
gitlab-ci	GitLab CI/CD pipelines and runners
jenkins	Jenkins pipelines and shared libraries
azure-devops	Azure Pipelines and release management
circleci	CircleCI workflows and orbs

Containers

Skill	Description
docker-management	Docker images, multi-stage builds, optimization
docker-compose	Multi-container applications
podman	Rootless container management
container-registries	ECR, ACR, GCR, Docker Hub

Orchestration

Skill	Description
kubernetes-ops	Deploy, scale, troubleshoot K8s
helm-charts	Helm chart development and deployment
argocd-gitops	GitOps with ArgoCD
kustomize	Kubernetes manifest customization
openshift	OpenShift cluster management
model-serving-kubernetes	KServe and Triton model serving with canary deployments and GPU autoscaling

Observability

Skill	Description
prometheus-grafana	Metrics and dashboards
opentelemetry	Vendor-neutral traces, metrics, and logs
elk-stack	Elasticsearch, Logstash, Kibana
loki-logging	Grafana Loki log aggregation
datadog	Datadog monitoring and APM
new-relic	New Relic observability
alerting-oncall	Alert rules and on-call rotations

AI Engineering

Skill	Description
agent-observability	Tracing, latency, token, and cost telemetry for agents
agent-evals	Automated regression and safety eval suites for agents
llm-cost-optimization	Cut LLM API costs with caching, batching, model routing, and self-hosting
llm-caching	Exact and semantic caching layers to reduce API calls by 30–70%
ai-pipeline-orchestration	Orchestrate RAG ingestion, training, and batch inference with Prefect/Airflow
llmops-platform-engineering	Build enterprise LLMOps platforms with evaluation gates, promotions, rollback, and governance
model-registry-governance	Define model metadata, approvals, lifecycle policy, and auditable promotion controls
rag-observability-evals	Measure retrieval quality, groundedness, hallucination risk, and RAG regressions continuously
ai-sre-incident-response	AI-specific SRE playbooks for model outages, quality regressions, safety incidents, and spend spikes

Release Management

Skill	Description
git-workflow	Branching strategies and PR workflows
semantic-versioning	Automated versioning and changelogs
feature-flags	LaunchDarkly, Unleash
blue-green-deploy	Zero-downtime deployments

🔒 Security

Scanning

Skill	Description
vulnerability-scanning	CVE scanning with Trivy, Grype
sast-scanning	Semgrep, CodeQL, SonarQube
dast-scanning	OWASP ZAP, Nuclei
dependency-scanning	Snyk, Dependabot
container-scanning	Image vulnerability scanning
sbom-supply-chain	SBOM generation, signing, and provenance verification

Secrets Management

Skill	Description
hashicorp-vault	Vault setup, policies, secrets engines
aws-secrets-manager	AWS secrets and rotation
azure-keyvault	Azure Key Vault
gcp-secret-manager	GCP Secret Manager
sops-encryption	Mozilla SOPS

Hardening

Skill	Description
linux-hardening	CIS benchmarks, sysctl, SSH
windows-hardening	Windows security baselines
container-hardening	Secure Docker/K8s configs
kubernetes-hardening	K8s security contexts and policies
cis-benchmarks	CIS benchmark auditing
openclaw-deployment-hardening	OpenClaw CI/CD, container, and runtime hardening guardrails

Network Security

Skill	Description
firewall-config	iptables, UFW, cloud firewalls
waf-setup	AWS WAF, Cloudflare WAF
zero-trust	Zero-trust architecture
vpn-setup	WireGuard, OpenVPN
ssl-tls-management	Let's Encrypt, certificate management

Security Operations

Skill	Description
incident-response	IR playbooks and evidence collection
threat-modeling	STRIDE methodology
penetration-testing	Basic pentesting
security-automation	Security workflow automation

AI Security

Skill	Description
ai-agent-security	Defend agents against injection, tool abuse, and exfiltration
llm-app-security	Harden LLM app inputs, outputs, and tenant isolation
ai-security-hardening	Harden LLM deployments against prompt injection, model theft, and data exfiltration
prompt-injection-defense	Defend against direct/indirect prompt injection with isolation, tool controls, and output validation
ai-red-teaming	Run adversarial AI red team programs for jailbreaks, exfiltration, and tool abuse resilience
model-supply-chain-security	Protect model artifacts with signing, provenance, SBOM workflows, and trusted promotion policies

☁️ Infrastructure

AWS

Skill	Description
terraform-aws	AWS infrastructure as code
cloudformation	CloudFormation templates
aws-ec2	EC2 instances and AMIs
aws-ecs-fargate	Container orchestration
aws-lambda	Serverless functions
aws-rds	Managed databases
aws-s3	Object storage
aws-vpc	Networking
aws-iam	Identity and access
aws-cost-optimization	FinOps cost reduction and spend governance

Cloudflare

Skill	Description
cloudflare-workers	Edge functions and APIs with Wrangler
cloudflare-pages	Static/full-stack deployments with previews
cloudflare-r2	S3-compatible object storage without egress fees
cloudflare-zero-trust	Access policies and private app protection

Azure

Skill	Description
terraform-azure	Azure infrastructure as code
arm-templates	ARM/Bicep templates
azure-vms	Virtual machines
azure-functions	Serverless
azure-aks	Kubernetes
azure-sql	Databases
azure-networking	VNets and NSGs

GCP

Skill	Description
terraform-gcp	GCP infrastructure as code
gcp-compute	Compute Engine
gcp-cloud-functions	Serverless
gcp-gke	Kubernetes
gcp-cloud-sql	Databases
gcp-networking	VPCs and firewall

Server Management

Skill	Description
linux-administration	Core Linux admin
windows-server	Windows administration
ssh-configuration	SSH and bastion hosts
user-management	Users, groups, sudo
systemd-services	Services and timers
performance-tuning	System optimization
gpu-server-management	NVIDIA GPU driver setup, MIG partitioning, DCGM monitoring for AI workloads

Networking

Skill	Description
dns-management	DNS and Route53
load-balancing	ALB, nginx, HAProxy
cdn-setup	CloudFront, Cloudflare
reverse-proxy	nginx, Traefik
service-mesh	Istio, Linkerd
llm-gateway	Unified LLM API gateway with routing, rate limiting, virtual keys, and semantic caching
ai-inference-service-mesh	Service mesh patterns for mTLS, canary inference routing, and resilient AI east-west traffic

Databases

Skill	Description
postgresql	PostgreSQL admin
mysql	MySQL/MariaDB
planetscale	Branch-based MySQL schema deployments
mongodb	MongoDB clusters
redis	Redis caching
database-backups	Backup strategies
vector-database-ops	Qdrant, Weaviate, and pgvector for production AI search and RAG workloads

Storage

Skill	Description
block-storage	EBS, LVM
object-storage	S3, MinIO
nfs-storage	NFS servers
backup-recovery	Backup with restic

Platforms

Skill	Description
vercel-deployments	Preview and production web app deployments
convex-backend	Realtime managed backend with typed functions
firebase-app-platform	Firebase auth, data, functions, and hosting

Local AI Infrastructure

Skill	Description
ollama-stack	Private local inference stack with Ollama
mac-mini-llm-lab	Mac mini setup for always-on local LLM serving
openclaw-local-mac-mini	OpenClaw setup for local development and Mac mini hosting
openclaw-security-hardening	OpenClaw host, auth, secrets, and network hardening for self-hosted deployments
vllm-server	High-throughput LLM serving with vLLM — PagedAttention, tensor parallelism, OpenAI API
llm-inference-scaling	Auto-scale LLM inference clusters on Kubernetes with KEDA and GPU-aware scheduling
rag-infrastructure	Production RAG with vector stores, hybrid search, embedding pipelines, and reranking
llm-fine-tuning	QLoRA and full fine-tuning with Axolotl, DeepSpeed, and DPO alignment on GPU clusters
gpu-kubernetes-operations	Run GPU Kubernetes clusters with MIG, autoscaling, node health checks, and AI cost controls
multi-tenant-llm-hosting	Secure multi-tenant LLM hosting with quotas, isolation boundaries, and per-tenant billing controls

IT Operations

Skill	Description
startup-it-troubleshooting	Practical IT troubleshooting for small teams

📋 Compliance

Frameworks

Skill	Description
soc2-compliance	SOC2 Trust Services Criteria
hipaa-compliance	HIPAA security rules
gdpr-compliance	GDPR data protection
pci-dss-compliance	PCI-DSS requirements
iso27001-compliance	ISO 27001 ISMS
fedramp-compliance	FedRAMP controls

Governance

Skill	Description
policy-as-code	OPA, Kyverno, Checkov
access-review	IAM access reviews
change-management	Change control
asset-inventory	Asset tracking
vendor-management	Third-party security

Auditing

Skill	Description
audit-logging	Centralized audit logs
aws-cloudtrail	CloudTrail configuration
azure-monitor-audit	Azure Monitor logs
gcp-audit-logs	GCP Cloud Audit Logs

Business Continuity

Skill	Description
disaster-recovery	DR strategies
business-continuity	BCP planning
incident-management	Incident processes
runbook-creation	Operational runbooks

---

🤝 Contributing

Found a bug? Want to add a skill? PRs are welcome!

See CONTRIBUTING.md for guidelines.

---

⭐ Support

If this helped you ship faster, star this repo — it helps others find it too.

Built with ☕ by Toby Miller

---

⬆ Back to Top