skills

Apply battle-tested GitHub Actions security hardening to CI/CD workflows. Use this skill whenever a user asks about securing GitHub Actions, writing or reviewing workflow YAML files, setting up CI/CD pipelines, hardening release processes, managing workflow permissions or secrets, pinning actions, or anything related to supply chain security in GitHub-based projects. Also trigger when the user shares a workflow file and asks for a review, or mentions tools like zizmor or pinact.

Query the PyPI JSON API to look up the latest stable version of any Python package. Use this skill whenever you need to check a package's current version, for example when writing or updating requirements.txt, pyproject.toml, setup.cfg, Dockerfiles, CI configs, or any dependency specification. Also trigger when the user asks "what's the latest version of X", "is there a newer version of X", or when pinning, bumping, or updating Python dependencies.

Review and generate high-quality Terraform code, with checks aligned to tflint's AWS ruleset and the dave-says custom ruleset. Use whenever the user shares, pastes, or uploads any .tf files — treat shared Terraform as an implicit request for feedback even if they don't explicitly ask. Also trigger when the user asks to write, generate, scaffold, or refactor Terraform from scratch. Covers naming, file organization, IAM, S3, VPC, CloudWatch, module design, and formatting. Guidance is primarily AWS-focused, but naming, variable hygiene, file layout, and module design apply to any provider. Trigger on any mention of Terraform, HCL, .tf files, tflint, infrastructure-as-code review, "clean up my infra code", "best practices for TF", or casual sharing like "here's my Terraform, thoughts?".

Manage GitHub Dependabot configuration files (.github/dependabot.yml). Use this skill whenever the user mentions Dependabot, dependabot.yml, dependency version updates, automated dependency PRs, or wants to create, update, or review a Dependabot configuration. Also trigger when the user uploads or references a dependabot.yml file, asks about supported package ecosystems, or wants to add/remove ecosystems from their Dependabot setup. Even if the user just says "set up Dependabot" or "add npm to my dependabot config", use this skill.