DSACMS

Use when planning, implementing, reviewing, or verifying CMS Hybrid Cloud infrastructure that needs Splunk integration, including CloudWatch Logs, CloudWatch Agent configuration, S3 service-log fallback, Splunk sourcetypes and indexes, EUA job code access, and efficient Splunk Search Head verification.

Draft and approval-gate FFS Jira tickets for work created by Emmy governance decisions, governance documents, ATO control findings, or implementation gaps. Use when a Confluence governance page, ATO/CFACTS control, policy decision, repo configuration, or system evidence implies follow-up engineering, remediation, evidence, decision, or CFACTS update work.

Use when interpreting, drafting, refining, or creating Emmy Jira tickets in the FFS project, especially when an agent needs to apply team ticket conventions for engineering, product, API, design, bug, spike, epic, infrastructure, or ATO-labeled work; choose issue type/labels/priority; format Jira wiki descriptions; inspect similar tickets or epics; or create Jira issues through the CMS Atlassian MCP server with explicit human approval.

Facilitate interactive development of the ideas behind a future Emmy governance document. Use when a human wants to explore, shape, pressure-test, or reason through a governance need, operating model, policy, process, decision, or obligation before drafting the Confluence governance document.

Draft or create Emmy governance documents from an already-developed system, process, policy, or operating model. Use when asked to write, draft, create, update, or publish a Confluence governance document for Emmy ATO, open source, release, state communication, or internal governance work; do not use to develop the underlying plan itself.

Review and assess Emmy governance documents from Confluence pages, pasted text, or local Markdown. Use when asked to read, assess, critique, grade, approval-check, or recommend revisions for an Emmy governance document, including ATO, open source, release, state communication, or internal governance artifacts.

Append an approved Emmy planning-session entry to the Goals Space Planning Log in Confluence. Use only when the user explicitly authorizes recording a planning session after planning context was read; never use for ambient lookup, ticket creation, or editing goals, outcomes, or principles.

Load the Emmy Goals Space as ambient planning context from Confluence. Use when Emmy work involves planning, goal alignment, ticket proposals, roadmap decomposition, outcome selection, prioritization, or checking whether work fits current strategic principles, active delivery goals, and applicable planning requirements.

Perform a comprehensive pre-commit security review on uncommitted changes. Covers all areas of the built-in /security-review, OWASP Top 10 (where applicable), and mandatorily detects secrets, PII, and PHI in staged changes. Use whenever a security review is requested, when running as a pre-commit hook, or any time uncommitted code changes need security validation before they enter the repository. Only report findings of low severity or above. Critical, high, and medium findings block the commit; low findings warn without blocking.

Perform a comprehensive security and IaC-compliance audit of an entire existing codebase, directory-by-directory. Unlike the pre-commit and PR review skills which review diffs, this skill reviews the full content of files at rest. Designed for one-time baseline audits, periodic full reviews (e.g., quarterly), audits before a compliance assessment, and audits of repositories being onboarded into a regulated environment. Produces one markdown report per directory batch in audit-reports/, optionally with SARIF output for ingestion into security dashboards. Supports min-severity filtering and resume mode for long-running audits.

Independent second-opinion adjudication of an automated first-pass security or compliance review. Given a first-pass findings report, re-inspect the cited code with fresh eyes and classify each finding as confirmed, false positive, or overstated (downgraded), with a one-line rationale each. Removes false positives before they reach the developer or report, without any manual suppression list. Invoked automatically by the dispatcher when a first pass reports findings; the gate is then decided by the adjudicated result.

Perform a comprehensive pre-commit IaC compliance review on uncommitted infrastructure-as-code changes (Terraform, CloudFormation, Bicep, Pulumi, Ansible, Kubernetes manifests, Helm charts, CDK, and similar). Checks staged changes against CMS ARS 5.1 and NIST SP 800-53 Rev 5 controls that are directly enforceable through IaC. Blocks on critical, high, and medium findings; warns on low. Use whenever an IaC compliance review is requested, when running as a pre-commit hook, or any time uncommitted infrastructure changes need compliance validation before they enter the repository. Only report findings of low severity or above.

Perform an AI-assisted pull-request review combining security (OWASP, secrets, PII, PHI) and IaC compliance (CMS ARS 5.1 / NIST SP 800-53 Rev 5) perspectives into a single unified review. Designed for use as a second layer of review after pre-commit hooks have already run on individual commits. Produces a human-readable terminal report and a machine-readable JSON structure that the dispatcher uses to post inline review comments on the PR via the GitHub API. Use this skill whenever a PR review is requested, when running as a GitHub Actions workflow on a pull_request event, or any time a developer wants an AI-assisted PR review without (or in addition to) GitHub Copilot PR review.