domehahn/skil - Page 2

ci-cd-reviewer

Review CI/CD pipelines, runners, permissions, artifacts, caches, deployment gates, and token exposure.

cloud-governance-reviewer

Review cloud naming, tags, ownership, cost centers, allowed services, regions, data classification, policy enforcement, and audit evidence.

cloud-landing-zone-reviewer

Review cloud accounts or subscriptions, networks, IAM, logging, policies, baselines, guardrails, encryption, tagging, and tenant separation.

compliance-governance-reviewer

Review governance controls such as CODEOWNERS, branch protection, approvals, auditability, and policy compliance.

container-security-reviewer

Review Dockerfiles, base images, user rights, capabilities, SBOM, image signing, distroless or slim images, CVEs, and runtime hardening.

control-mapping-reviewer

Map technical measures to DORA, VAIT or BAIT migration needs, ISO 27001, BSI, internal policies, or MaRisk review expectations.

cost-based-planner

Plan coding work with minimal context, relevant file selection, risk awareness, rollback, and validation strategy.

dependency-supply-chain-reviewer

Review dependencies, lockfiles, package managers, container images, actions, and supply-chain risks.

developer-experience-reviewer

Review setup, local development, error messages, Makefiles or scripts, onboarding, tooling consistency, and practicality for teams.

devsecops-maturity-reviewer

Assess maturity across plan, code, build, test, release, deploy, and operate with automation, security gates, ownership, and feedback loops.

documentation-governance-reviewer

Review documentation freshness, ownership, review cycles, approvals, versioning, validity, and traceability.

documentation-maintainer

Create and update README files, ADRs, setup guides, API docs, runbooks, and operational documentation.

dora-readiness-reviewer

Review DORA readiness for ICT risk management, resilience testing, incidents, third-party risk, roles, policies, evidence, and auditability.

evidence-package-creator

Create auditable evidence packages from tickets, pipeline results, test reports, approvals, scans, and architecture information.

finops-reviewer

Review cloud costs, budgets, rightsizing, reserved or committed usage, anomalies, showback or chargeback, and team cost transparency.

gitops-operations-reviewer

Review Argo CD or Flux setups, sync policies, drift detection, promotion, rollback, app-of-apps, secrets, cluster access, and deployment governance.

iac-gitops-reviewer

Review Terraform, Kubernetes, Helm, Kustomize, GitOps reconciliation, promotion, and environment safety.

ict-incident-reporting-reviewer

Review ICT incident classification, escalation, documentation, reportability, timelines, responsibilities, templates, and communication chains.

ict-risk-management-reviewer

Review ICT risks, protection needs, criticality, controls, residual risks, treatment, and recurring reassessment.

ict-third-party-risk-reviewer

Review cloud, SaaS, outsourcing, subcontractors, contracts, exit strategies, concentration risks, and DORA information-register readiness.

identity-access-reviewer

Review IAM, roles, service accounts, groups, tokens, OIDC federation, GitLab or GitHub permissions, cloud rights, and privilege-escalation paths.

incident-postmortem-assistant

Support incident analysis, timeline creation, root cause analysis, impact assessment, corrective actions, and follow-up issues.

kubernetes-platform-reviewer

Review Kubernetes clusters, namespaces, RBAC, NetworkPolicies, Pod Security, admission controllers, resource limits, secrets, ingress, tenancy, and upgrades.

llmops-security-reviewer

Review GenAI workloads for prompt injection, tool permissions, data exfiltration, RAG sources, sensitive prompt logging, evals, guardrails, and model access.

migration-change-reviewer

Review database migrations, schema changes, breaking changes, rollback ability, backward compatibility, and zero-downtime deployments.

mlops-governance-reviewer

Review model versioning, training data, bias, drift, monitoring, approvals, reproducibility, model registry, and deployment gates.

observability-reviewer

Review logging, metrics, tracing, health checks, alerts, dashboards, runbooks, and operational readiness.

operational-resilience-tester

Review backup and restore, failover, disaster recovery, restart procedures, crisis exercises, scenario tests, and lessons learned.

outsourcing-exit-strategy-reviewer

Review exit plans, data return, provider transitions, emergency operations, suboutsourcing, cloud dependencies, and business impact.

performance-scalability-reviewer

Review load behavior, bottlenecks, caching, database access, queue behavior, scaling, timeouts, and resource limits.

pipeline-security-architect

Design and review secure CI/CD pipelines with isolated runners, minimal rights, OIDC, signed artifacts, protected environments, and approval gates.

policy-as-code-engineer

Create and review policies for OPA/Rego, Kyverno, GitLab Policies, Conftest, Checkov, Terraform, Kubernetes, and CI/CD gates.

policy-as-code-reviewer

Review GitLab Security Policies, OPA/Rego, Kyverno, Conftest, Sentinel, admission policies, compliance pipelines, and central guardrails.

policy-documentation-maintainer

Create and update policies, standards, procedures, and control descriptions.

privacy-data-protection-reviewer

Review privacy, personal data, data classification, deletion concepts, purpose limitation, GDPR risks, and sensitive-data logging.

release-readiness-reviewer

Assess release readiness, rollback, migrations, feature flags, monitoring, documentation, and breaking changes.

requirements-analyst

Analyze requirements, user stories, acceptance criteria, constraints, risks, and open questions before implementation.

resilience-reviewer

Review timeouts, retries, circuit breakers, failover, backpressure, degraded modes, and resilience behavior.

risk-acceptance-reviewer

Document and assess conscious risk decisions, impact and likelihood, expiry dates, and compensating measures.

runbook-playbook-maintainer

Create and review runbooks, operating instructions, incident playbooks, escalation paths, restart procedures, and checklists.