Lucatronlk/justsec-agent-kit

agent-integration-testing

Test AI-agent interactions with tools, memory, and external systems under realistic failures and security boundaries.

agent-tool-development

Design bounded AI-agent tools with typed arguments, least privilege, idempotency, and approval gates.

repo-ai-readiness

Assesses repository AI-agent configuration and safety guardrails when onboarding or auditing OpenCode, Copilot, or Claude Code setup.

mcp-server-development

Build MCP servers with typed tools, resource schemas, authorization boundaries, and reliable transport behavior.

rag-development

Develop RAG retrieval pipelines with provenance, access filtering, chunking, and grounded answer evaluation.

aws-landing-zone-review

Reviews AWS Organizations, Control Tower, and landing-zone governance when a multi-account AWS assessment is requested.

azure-architecture-review

Reviews Azure workload and landing-zone architecture against Well-Architected and CAF guidance when design changes are requested.

azure-iac-generation

Generates validated first-draft Azure Bicep, ARM, Terraform, or Pulumi when new Azure infrastructure code is requested.

azure-security-review

Audits Azure resources or IaC for security and compliance gaps when an Azure security review is requested.

azure-pipelines-review

Reviews Azure DevOps pipeline YAML and deployment controls when azure-pipelines.yml or pipeline management is requested.

github-actions

Build, test, and deploy applications using GitHub Actions workflows. Create CI/CD pipelines, configure runners, manage secrets, and automate software delivery. Use when working with GitHub repositories, automating builds, running tests, or deploying…

gitlab-pipeline-review

Reviews .gitlab-ci.yml for security, efficiency, and migration readiness when a GitLab pipeline changes.

ansible-automation

Build idempotent Ansible roles and playbooks with safe inventories, check-mode gates, and controlled rollout.

azure-identity-rbac

Review and design Entra ID and Azure RBAC assignments, managed identities, PIM, and access boundaries.

azure-policy-governance

Design Azure Policy initiatives, exemptions, and remediation controls across management groups and subscriptions.

backup-validation

Verify backup completeness and recovery through isolated restore drills and measured RPO/RTO.

caddy-management

Configure Caddy reverse proxy, TLS automation, routing, and safe reloads for hosted services.

golden-paths

Build secure reusable service templates and paved paths for development, deployment, and operations.

internal-developer-platform

Design self-service developer platform contracts with ownership, guardrails, and measured adoption.

kubernetes-admission-policy

Design and test Kubernetes admission controls for workload security without blocking critical deployments.

opa-rego

Author and test Rego policies for structured authorization and infrastructure decisions with explicit deny behavior.

osquery-fleet-management

Manage osquery fleet enrollment, scheduled query packs, performance budgets, and endpoint evidence hygiene.

pipeline-security-review

Reviews GitHub Actions and GitLab CI pipelines for injection, secrets, and supply-chain risks when workflows change.

secrets-rotation

Plan and verify credential rotation with consumer discovery, overlap windows, revocation, and audit evidence.

security-policy-testing

Test authorization, admission, and infrastructure policies using adversarial fixtures and regression gates.

self-service-provisioning

Design governed self-service infrastructure requests with quotas, approvals, lifecycle, and auditability.

supply-chain-provenance

Define signed build provenance and artifact verification gates from source commit to deployment.

tailscale-management

Govern Tailscale tailnets, ACL/grants, device posture, subnet routes, and exit-node access.

terraform-drift-detection

Detect and triage Terraform-managed infrastructure drift using read-only plans and ownership checks.

terraform-state-management

Plan secure Terraform backend, locking, import, state moves, and recovery without leaking state secrets.

terraform-testing

Build layered Terraform validation covering format, schema, module contracts, plans, and isolated integration tests.

dockerfile-review

Reviews Dockerfiles and image-build pipelines when container security, size, or build hygiene needs assessment.

dockerfile-hardening

Reviews Dockerfiles and image-build pipelines for hardening when container security or runtime posture is requested.

documentation-writer

Writes or reviews Diátaxis documentation when a tutorial, how-to, reference, explanation, or architecture document is requested.

readme-generator

Generates or refreshes a README from verified repository details when project documentation is missing or stale.

incident-triage

Triages outages, failed deployments, suspicious logs, and security incidents when incident response is requested.

local-llm-routing

Measured knowledge for sending work to a local Ollama server and for configuring one. Send exactly the num_ctx a model is loaded with, think=false for cheap text tasks, code does counting/grouping and the model writes prose only, keep an evaluation record per…

linux-platform-change

Planning and diagnosis discipline for Linux and platform changes (services, systemd, udev, firewall, packages, kernel, hardware, installs). Every plan names exact target, change, evidence, blast radius and rollback; privileged commands are handed to the human…

k8s-manifest-review

Reviews Kubernetes manifests and Helm charts for security and reliability when deployment configuration changes are requested.

kubernetes-security-audit

Audits Kubernetes manifests, Helm charts, RBAC, and network policy when workload security review is requested.