devops

Plugin devops from marketplace devops-marketplace in MILTONADINA/DevOPs. Commands read from the repo's manifest — 3 days ago.

Skills (25)

• fastapi-dependency-injection

  FastAPI dependency-injection patterns and anti-patterns -- request-scoped auth tokens leaking into singleton DI graphs, missing `Depends()` declarations on auth-required routes, `dependency_overrides` mis-use leaking a fake identity across tests. Triggers on FastAPI route authoring (`@app.get`, `@ap

• nextjs-check-route-types

  Type-system hygiene for Next.js App Router routes -- `any`-typed params, missing route handler signatures, generated-types staleness from `next dev` and `next build` typecheck gaps. Triggers on Next.js route handler authoring (`app/**/route.ts`, `app/**/page.tsx` typed-segments). Not agent-specific

• nextjs-server-action-safety

  Defend against client/server boundary confusion in Next.js Server Actions. Patterns covered include authn drift in token-bound mutations, input validation at the action boundary, and mutation idempotency under retry. Triggers on Server Action authoring (functions with `use server` directive) and Nex

• rust-cargo-audit

  Cargo dependency auditing discipline -- `cargo audit` invocation in CI, `cargo-deny` advisory enforcement, RUSTSEC ID monitoring, and pinned-version vs floating-range tradeoffs. Triggers on Rust dependency authoring (`Cargo.toml` edits, `Cargo.lock` updates). OWASP AST08 (Update tampering) defense -

• rust-error-handling

  Rust error-handling patterns and anti-patterns -- `unwrap()` in request hot paths, `panic!` instead of returning a `Result`, leaking error internals via `Debug` derive on error types containing privileged state. Patterns covered include `thiserror` for typed errors, `anyhow` for application-layer er

• stripe-pci-scope-minimization

  Minimize PCI DSS scope when integrating Stripe -- token-only flows (Elements, Checkout, PaymentSheet), avoid raw PAN handling, audit-log discipline for cardholder-data adjacencies. References PCI DSS v4 Requirement 3 (Protect Stored Account Data) and Requirement 10 (Log and Monitor Access). Triggers

• stripe-webhook-idempotency

  Stripe-specific webhook idempotency -- signature verification with the constructEvent API, retry-id reuse via `event.id`, double-fulfilment guards on PaymentIntent / Charge / Invoice events. Extends the universal `security/webhook-idempotency` skill with Stripe's event-id discipline and signing-secr

• supabase-rls-policies

  Supabase Row-Level Security policy patterns and failure modes -- policy bypass via service-role key in client code, USING-vs-WITH-CHECK confusion, missing INSERT policies that leave write paths unprotected. References GDPR Article 32 (Security of processing) and SOC 2 Trust Services Criteria CC6.1 (

• supabase-rpc-functions

  Supabase RPC function security patterns -- SECURITY DEFINER with `SET search_path` discipline, `REVOKE EXECUTE FROM public` for least-privilege exposure, JSON-arg shape drift between client and server contracts. Triggers on Supabase RPC function authoring (`CREATE OR REPLACE FUNCTION`, `rpc(` client

• coppa-audit

  Audit code, data flows, and UI for COPPA (Children's Online Privacy Protection Act) compliance. Use whenever the project handles or might handle data from users under 13 - kid-targeted apps, K-12 or other educational tools used by children, or general apps with under-13 user segments.

• ears-spec-writing

  Write requirement specifications in EARS (Easy Approach to Requirements Syntax) notation. Use whenever authoring or editing files in /specs/, converting prose requirements into structured form, or reviewing existing specs for ambiguity. EARS uses five sentence patterns to produce unambiguous, testab

• openapi-first

  Generate API code, types, validators, mock servers, and client SDKs from a single OpenAPI 3.1 specification. Use whenever building or modifying an HTTP API endpoint. The OpenAPI doc is source of truth - drift between doc and code is a contract violation caught by tests. Triggers on requests involvin

• cost-attribution

  Track per-client and per-feature LLM and cloud spend with cryptographic audit trail. Use whenever billable operations occur - LLM API calls, infrastructure provisioning, batch jobs. Required for any project with multiple clients or cost-sensitive operations. Integrates with Stratum's append-only bil

• observability-instrument

  Add OpenTelemetry spans with user_id and tenant_id in baggage to any new code path that handles requests, runs agents, or performs billable operations. Use whenever creating a new API endpoint, background job, agent invocation, or external API call. Inline PII redaction at the span exporter is manda

• baton-handoff

  Write a complete handoff document at session end so the next agent (Claude Code, Codex, Cursor, Antigravity, Kiro, or local LLM) resumes exactly where this one stopped. Use whenever a session is approaching its limit, the user types /checkpoint, or the agent recognizes natural completion of a task.

• goal-loop

  Execute the spec-tests-implement-verify cycle for one atomic task at a time. Use after plan-decomposition has produced a task list. This is the workhorse loop - the agent implements, runs tests, reflects on failure, retries with bounded iteration. Halts at the iteration ceiling, and when a budget, l

• multi-tool-failover

  Manage session continuity when switching between Claude Code, Codex CLI, Cursor, Antigravity, Kiro, or local LLMs (OpenCode, Aider). Use when approaching session limits, switching to a different tool's strengths, or when one tool fails and another must continue. Relies on the baton protocol and univ

• plan-decomposition

  Break an approved spec into atomic, ordered, verifiable tasks before any code is written. Use after spec-extraction confirms a spec is approved and before invoking goal-loop. Each task has its own success criteria, estimated effort, and explicit dependencies. Prevents both "where do I start" paralys

• proof-of-work

  Produce structured proof artifacts for every completed claim. Use this skill whenever the agent claims to have implemented something, tested something, deployed something, or completed a task. Every claim must ship with proof — git SHA, files changed, test command, exit code, output tail, and a repr

• session-summary

  Generate the end-of-session human-reviewable report. Use at session end before writing the baton. Aggregates all verified claims, lists open blockers, links proofs, and surfaces low-confidence items for human review. Required for any session that produced verifiable work.

• spec-extraction

  Convert a user's prose requirements into EARS-formatted specifications under /specs/. Use whenever the user describes new functionality, requirements, or a feature without an existing spec. Required first step for any non-trivial implementation - no spec, no work. Triggers on phrases like "add featu

• gitleaks-scan

  Run gitleaks against the working tree to detect committed secrets, API keys, tokens, and credentials. Use whenever a file has been written, before any git commit, before any push, and as part of the tiered security gate. Catches the most common cause of credential leaks - accidental commits.

• owasp-asi-threat-model

  Produce a STRIDE + OWASP Top 10 for Agentic Applications (ASI) 2026 threat model for any new feature, API, or system. Use whenever designing a feature that touches auth, data, agents, tools, or external inputs. Triggers on terms like "design", "architecture", "new endpoint", "new agent", "new MCP",

• prompt-injection-defense

  Sanitize all external content before it enters the agent's context window. Use whenever the agent ingests documents, web pages, RAG results, tool outputs, file contents, emails, or any data from outside the user's direct typed input. Defense against OWASP ASI01 (Goal Hijacking) and ASI04 (Indirect P

• semgrep-scan

  Run Semgrep static analysis to detect insecure code patterns - SQL injection, XSS, path traversal, weak crypto, broken auth, OWASP Top 10 issues. Use on every file change touching security-sensitive code and as part of the tiered security gate. Complements gitleaks (which catches secrets) by catchin

Similar plugins