Development & Cloud Operations Skills

Comprehensive web accessibility (a11y) audit and compliance skill. Audits HTML, React, Vue, and Angular codebases against WCAG 2.2 AA standards. Activates when users ask for "accessibility audit", "a11y check", "WCAG compliance", "ADA compliance", "screen reader testing", "keyboard navigation audit", "color contrast check", "accessibility fix", or "make this accessible". Detects violations, explains impact, and generates fix-ready code. Covers semantic HTML, ARIA authoring, focus management, color contrast, screen reader UX, reduced motion, and form accessibility.

Scan and validate AI agent skills against the OWASP Agentic Skills Top 10 (AST10) security framework. Detects malicious skills, prompt injection, data exfiltration, supply chain risks, and cross-platform metadata loss. Provides CI/CD-ready security gating with SARIF output.

Design-first API development skill. Generates OpenAPI 3.1 specifications, enforces REST design best practices, validates endpoints, handles versioning, pagination, error formatting, authentication patterns, rate limiting, and idempotency. Activates when users say "design an API", "create OpenAPI spec", "API endpoint", "REST API design", "API contract", "Swagger/OpenAPI doc", "API versioning", "rate limiting", or "API security". Covers REST, GraphQL schema design, and gRPC proto generation with cross-protocol consistency.

Use when the user wants to evaluate a mobile app idea for commercial viability — whether it's a clone opportunity, a market gap, or a new launch. Produces a harsh "Build / Pivot / Kill" verdict backed by competitive analysis and revenue modeling. Use when the user says things like "Is this app idea worth building?" "Should I clone this?" "Analyze this niche" "Evaluate this competitor" even if they don't use the word "scrutiny" or "dominance report." Mobile apps only — do not activate for CLI tools, SDKs, or SaaS.

Use when the user has decided to build a mobile app and needs a complete production blueprint — not brainstorming, not feature ideas, but an actual build brief. Covers both iOS and Android with exact tech stack, screen specs, monetization, and a 30-day sprint plan. Use when the user says things like "Scaffold this app" "Give me a build plan" "Write the PRD" "How do I build this?" "Create a technical spec" "Blueprint this idea" even if they don't mention "scaffolding" or the number of sections.

Use when the user needs a complete social media advertising campaign — not just ad copy, but full creative strategy with hooks, scripts, image/video prompts, and A/B test plans. Covers X, TikTok, and Instagram. Use when the user says things like "Create a campaign for..." "Launch ads for..." "I need marketing for..." "Promote this product" "Write ad creative for..." even if they don't mention specific platforms or "advertising department." For any product, brand, service, app launch, or crowdfunding campaign.

Generate production-ready CI/CD pipeline configurations for GitHub Actions, GitLab CI, CircleCI, and Jenkins. Activates when users ask to set up CI/CD, create deployment pipelines, automate build/test/deploy workflows, configure Docker builds, set up staging/production environments, or add quality gates. Covers multi-stage pipelines, matrix builds, secrets management, caching strategies, environment promotion, canary deployments, and rollback patterns. Use when the user says "set up CI/CD", "create a pipeline", "automate deployment", "build pipeline", "GitHub Actions workflow", "GitLab CI config", or "deploy to production".

Comprehensive Git workflow automation including branching strategies, pull request creation, code reviews, merge strategies, and release management. Use when Claude needs to help with Git operations, branching models (Git Flow, GitHub Flow), pull request creation, code reviews, merge conflicts, or release processes.

Universal Infrastructure as Code (IaC) agent skill for authoring, securing, and managing cloud infrastructure across Terraform, Pulumi, CloudFormation, Ansible, and Bicep. Provides cross-tool security hardening, state management best practices, cost optimization, drift detection, and CI/CD integration. Covers AWS, Azure, GCP, and hybrid-cloud environments with a unified workflow that spans the full IaC lifecycle—from greenfield module authoring through production hardening audits to multi-tool migration planning. Designed for DevOps engineers who switch between IaC tools daily: includes a decision tree for tool selection, per-tool authoring guidelines (HCL patterns, Pulumi TypeScript/Python idioms, CloudFormation YAML conventions, Ansible playbook structure, Bicep DSL tips), security checklist aligned to CIS benchmarks and SOC 2, drift detection workflows that catch configuration skew before it causes outages, and cost-optimization guardrails built into the authoring phase. The skill bridges the gap left by single-tool IaC skills—HashiCorp's focus is Terraform-only, Pulumi's official guidance stays within its own ecosystem—by providing a tool-agnostic framework that treats IaC as a discipline, not a product silo.

End-to-end production engineering workflows that encode the complete software development lifecycle into repeatable, quality-gated agent commands. Covers everything from spec-driven ideation through planning, test-driven implementation, automated testing, rigorous code review, web performance auditing, code simplification, and production deployment. Slash-command entry points: /spec, /plan, /build, /test, /review, /webperf, /code-simplify, /ship. Primary keyword clusters: production engineering automation, SDLC automation agent, spec-driven development workflow, TDD agent workflow, automated deployment pipeline agent, web performance audit automated, code simplification automation, AI code review pipeline, feature flag deployment workflow, continuous delivery agent, production readiness review, software delivery lifecycle AI, DevSecOps agent skills, trunk-based development automation, incremental rollout automation. Designed for agentic platforms — Claude Code, Codex, Cursor, Gemini CLI, OpenClaw, GitHub Copilot, Windsurf, and OpenCode.

Safe-by-default DevOps/SRE runbook automation for incident response, postmortems, on-call handovers, and operational troubleshooting. Implements Google SRE principles with agent-safe execution patterns including dry-run modes, human approval gates, and blast-radius limits.

AI-powered software supply chain security auditing skill for agentic platforms. Performs comprehensive dependency vulnerability scanning across npm, PyPI, Maven, Go modules, Cargo, and container images. Generates SBOMs (Software Bill of Materials) in SPDX and CycloneDX formats using Syft and Grype. Validates license compliance against organizational policies and detects copyleft risks. Verifies cryptographic provenance and SLSA framework attestations using cosign and slsa-verifier. Executes a structured audit methodology—Scan → Analyze → Report → Remediate—producing machine-readable vulnerability reports with CVSS scores, exploitability assessments, and actionable fix recommendations aligned with OWASP Agentic Skills Top 10 guidance. Integrates with ecosystem vulnerability databases including NVD (National Vulnerability Database), GitHub Advisory Database (GHSA), and Open Source Vulnerabilities (OSV). Covers software composition analysis (SCA) workflows, dependency confusion detection, typosquatting checks, and end-to-end software supply chain integrity verification. Designed for CI/CD pipeline integration, pre-commit hooks, and ad-hoc security audits. Suitable for DevSecOps teams, open-source maintainers, and enterprise compliance programs adopting SLSA Level 1–3 supply chain security requirements. Works with existing toolchains: npm audit, pip-audit, OWASP Dependency-Check, Syft, Grype, cosign, slsa-verifier, and trivy. All findings include remediation paths and SBOM lifecycle management guidance.