infra

Plugin infra from marketplace universal-skills in brenthaertlein/universal-skills. Commands read from the repo's manifest — 26 days ago.

Skills (23)

• assess-change-risk

  Blast-radius assessment for a pending Terraform plan, Ansible playbook, or Kubernetes manifest diff. Answers 'what could this take down?'

• draft-postmortem

  Draft a blameless postmortem from incident evidence - logs, timeline, Slack/chat transcript, and deploy history.

• draft-runbook

  Generate or refresh an operational runbook for a service, derived from its code, deploy config, existing alerts, and prior incidents.

• preflight

  IaC quality gate \u2014 validates Terraform, Ansible, Kubernetes, Helm, Docker Compose, and YAML without committing.

• review-ansible-playbooks

  [pr-review-focus-area: Ansible Playbooks] Deeper Ansible role and playbook audit beyond ansible-lint — idempotency smells, handler misuse, secret handling, become-scope, tag discipline.

• review-aws-iam

  [pr-review-focus-area: AWS IAM] AWS IAM least-privilege audit for roles, policies, and user permissions declared in Terraform / CloudFormation or live in the account.

• review-aws-tagging

  [pr-review-focus-area: AWS Tagging] Audit AWS resource tag compliance against an organization taxonomy (cost center, owner, environment, data classification, etc.).

• review-aws-well-architected

  [pr-review-focus-area: AWS Well-Architected] Lightweight Well-Architected Framework review across the five pillars — Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization.

• review-costs

  [pr-review-focus-area: Cloud Costs] Flag cost hotspots in Terraform plans and live cloud inventory - oversized instances, orphaned volumes, idle load balancers, untagged resources, NAT egress.

• review-disaster-recovery

  [pr-review-focus-area: Disaster Recovery] Audit DR readiness — backup coverage, declared RTO/RPO vs configured reality, failover paths, and whether DR has been exercised recently.

• review-drift

  [pr-review-focus-area: IaC Drift] Detect drift between IaC state (Terraform/Pulumi/CloudFormation) and live cloud or baremetal reality.

• review-gcp-iam

  [pr-review-focus-area: GCP IAM] GCP IAM least-privilege audit across project, folder, and org policies, including service-account usage and impersonation paths.

• review-gke

  [pr-review-focus-area: GKE] GKE cluster hardening and cost review — Autopilot vs Standard, workload identity, node-pool sizing, cluster autoscaler, network policy.

• review-kubernetes-rbac

  [pr-review-focus-area: Kubernetes RBAC] Audit Kubernetes RBAC across a cluster — ClusterRoles, Roles, bindings, and ServiceAccount permissions. Works on EKS, GKE, AKS, and on-prem.

• review-linux-hardening

  [pr-review-focus-area: Linux Hardening] Lightweight CIS-benchmark-style audit of Linux host configuration as declared in Ansible inventory / roles / playbooks. Read-only, repo-local.

• review-observability

  [pr-review-focus-area: Observability] Audit a service for logging, metrics, and tracing coverage. Flags missing RED/USE signals, alerts without runbooks, dashboards without owners.

• review-systemd-units

  [pr-review-focus-area: systemd Units] Audit systemd unit files (in Ansible templates / roles / repo) for Restart, resource limits, and sandboxing directives.

• security-audit

  Comprehensive security and PII audit for infrastructure repos. Scan for secrets, credentials, and sensitive data before committing.

• suggest

  Use when the user wants recommendations for new self-hosted services, infrastructure tools, or additions to run on Docker, K8s, VMs, or LXC containers.

• triage-aws-security-findings

  Consolidate AWS Security Hub, GuardDuty, Inspector, and Trusted Advisor findings into one deduplicated, ranked action list.

• triage-gcp-recommender

  Pull GCP Recommender API findings (IAM, rightsizing, idle VMs, commitment use, unattended project) and rank by dollar / risk impact.

• triage-hardware-health

  Triage baremetal hardware health from Ansible fact caches or pre-collected reports — SMART disk data, mdadm/ZFS pool status, IPMI/BMC alerts, firmware/microcode currency.

• triage-vulnerabilities

  Triage CVE and SBOM scanner output (Trivy, Grype, Snyk, Docker Scout, Dependabot) into a ranked, deduplicated action list.

Slash commands (1)

• /infra:infra-inventory

  Print a concise inventory of IaC artifacts and cloud auth status for the current repo

Subagents (2)

• appsec-engineer

  Principal-level application & cloud security engineer. Use when security findings or a change with real attack surface need adversarial scrutiny — threat modeling, exploitability triage, blast radius of a compromised credential, separating real risk from checkbox noise. Dispatched by security-audit

• principal-sre

  Principal-level sysadmin / DevOps / SRE reviewer. Use when infrastructure decisions need senior scrutiny — blast-radius analysis, postmortems, runbook reviews, capacity and reliability tradeoffs, and cross-cutting production readiness. Skills like assess-change-risk, draft-postmortem, review-disaste

Hooks (4)

• PreToolUse

  bash -c 'input="$CLAUDE_TOOL_INPUT"; if echo "$input" | grep -qE "git commit"; then msg="REMINDER: Run /security-audit before committing infrastructure code. If staged changes include *.tf, kustomizat

• PreToolUse

  bash -c 'input="$CLAUDE_TOOL_INPUT"; if echo "$input" | grep -qE "terraform (apply|destroy)"; then msg="SAFEGUARD: terraform apply/destroy is mutating. If you have not already: run /assess-change-risk

• PreToolUse

  bash -c 'input="$CLAUDE_TOOL_INPUT"; if echo "$input" | grep -qE "kubectl (apply|delete|patch|replace|scale|rollout)"; then msg="SAFEGUARD: kubectl mutating operation detected. Confirm the target cont

• PreToolUse

  bash -c 'input="$CLAUDE_TOOL_INPUT"; if echo "$input" | grep -qE "ansible-playbook" && ! echo "$input" | grep -qE -- "--check"; then msg="SAFEGUARD: ansible-playbook without --check will mutate hosts.

Similar plugins