domehahn/skcr

network-tool-skill

Fetch a remote API and run a git command on the result.

complete-skill

Review source files without changing external state.

ai-change-risk-reviewer

Review AI-assisted changes before execution for automation boundaries, human approval, affected-system criticality, and audit evidence.

aiops-signal-correlation-reviewer

Assess correlation of logs, metrics, traces, events, and incidents to reduce noise, improve root-cause analysis, and lower alert fatigue.

alert-quality-reviewer

Review alerts for actionability, clear symptoms, runbook links, severity, ownership, SLO relation, deduplication, escalation, and remediation suitability.

api-contract-reviewer

Review REST, GraphQL, OpenAPI, and gRPC contracts, breaking changes, versioning, AuthN/AuthZ, error formats, and compatibility.

architecture-decision-recorder

Create and maintain ADRs with context, decisions, alternatives, risks, security impact, compliance relation, and review points.

audit-evidence-reviewer

Review evidence, approvals, tickets, logs, test protocols, risk decisions, versioning, and accountable owners.

audit-traceability-maintainer

Link requirements, controls, implementation, tests, tickets, and evidence into an auditable trace.

auto-remediation-reviewer

Review automated repair actions for safe limits, dry runs, approval modes, rollback, audit logs, blast radius, and loop protection.

backup-restore-reviewer

Review restore tests, RPO/RTO, data integrity, backup protection, recoverability, and disaster recovery.

cloud-governance-reviewer

Review cloud naming, tags, ownership, cost centers, allowed services, regions, data classification, policy enforcement, and audit evidence.

cloud-landing-zone-reviewer

Review cloud accounts or subscriptions, networks, IAM, logging, policies, baselines, guardrails, encryption, tagging, and tenant separation.

container-security-reviewer

Review Dockerfiles, base images, user rights, capabilities, SBOM, image signing, distroless or slim images, CVEs, and runtime hardening.

control-mapping-reviewer

Map technical measures to DORA, VAIT or BAIT migration needs, ISO 27001, BSI, internal policies, or MaRisk review expectations.

developer-experience-reviewer

Review setup, local development, error messages, Makefiles or scripts, onboarding, tooling consistency, and practicality for teams.

devsecops-maturity-reviewer

Assess maturity across plan, code, build, test, release, deploy, and operate with automation, security gates, ownership, and feedback loops.

documentation-governance-reviewer

Review documentation freshness, ownership, review cycles, approvals, versioning, validity, and traceability.

dora-readiness-reviewer

Review DORA readiness for ICT risk management, resilience testing, incidents, third-party risk, roles, policies, evidence, and auditability.

evidence-package-creator

Create auditable evidence packages from tickets, pipeline results, test reports, approvals, scans, and architecture information.

finops-reviewer

Review cloud costs, budgets, rightsizing, reserved or committed usage, anomalies, showback or chargeback, and team cost transparency.

gitops-operations-reviewer

Review Argo CD or Flux setups, sync policies, drift detection, promotion, rollback, app-of-apps, secrets, cluster access, and deployment governance.

ict-incident-reporting-reviewer

Review ICT incident classification, escalation, documentation, reportability, timelines, responsibilities, templates, and communication chains.

ict-risk-management-reviewer

Review ICT risks, protection needs, criticality, controls, residual risks, treatment, and recurring reassessment.

ict-third-party-risk-reviewer

Review cloud, SaaS, outsourcing, subcontractors, contracts, exit strategies, concentration risks, and DORA information-register readiness.

identity-access-reviewer

Review IAM, roles, service accounts, groups, tokens, OIDC federation, GitLab or GitHub permissions, cloud rights, and privilege-escalation paths.

kubernetes-platform-reviewer

Review Kubernetes clusters, namespaces, RBAC, NetworkPolicies, Pod Security, admission controllers, resource limits, secrets, ingress, tenancy, and upgrades.

llmops-security-reviewer

Review GenAI workloads for prompt injection, tool permissions, data exfiltration, RAG sources, sensitive prompt logging, evals, guardrails, and model access.

migration-change-reviewer

Review database migrations, schema changes, breaking changes, rollback ability, backward compatibility, and zero-downtime deployments.

mlops-governance-reviewer

Review model versioning, training data, bias, drift, monitoring, approvals, reproducibility, model registry, and deployment gates.

operational-resilience-tester

Review backup and restore, failover, disaster recovery, restart procedures, crisis exercises, scenario tests, and lessons learned.

outsourcing-exit-strategy-reviewer

Review exit plans, data return, provider transitions, emergency operations, suboutsourcing, cloud dependencies, and business impact.

performance-scalability-reviewer

Review load behavior, bottlenecks, caching, database access, queue behavior, scaling, timeouts, and resource limits.

pipeline-security-architect

Design and review secure CI/CD pipelines with isolated runners, minimal rights, OIDC, signed artifacts, protected environments, and approval gates.

policy-as-code-engineer

Create and review policies for OPA/Rego, Kyverno, GitLab Policies, Conftest, Checkov, Terraform, Kubernetes, and CI/CD gates.

policy-as-code-reviewer

Review GitLab Security Policies, OPA/Rego, Kyverno, Conftest, Sentinel, admission policies, compliance pipelines, and central guardrails.

policy-documentation-maintainer

Create and update policies, standards, procedures, and control descriptions.

privacy-data-protection-reviewer

Review privacy, personal data, data classification, deletion concepts, purpose limitation, GDPR risks, and sensitive-data logging.

resilience-reviewer

Review timeouts, retries, circuit breakers, failover, backpressure, degraded modes, and resilience behavior.

risk-acceptance-reviewer

Document and assess conscious risk decisions, impact and likelihood, expiry dates, and compensating measures.