Push the current branch to the remote under a speaking branch name derived from the last conventional commit (<type>/<scope>-<description>). Use when the user asks to push their branch, publish their work, push before opening a PR, or push with a meaningful branch name. Hard guard: NEVER pushes the default branch (detected dynamically from origin/HEAD — main, develop, etc.) — if HEAD is on it, a speaking feature branch is carved and switched to first. Sets upstream with -u. Triggers on: "push", "push my branch", "push this", "publish my branch", "push with a good branch name", "push before PR".

2026-07-164

github-publish

ClubMediterranee/ai-core

End-to-end "send my work to GitHub": commit the current changes as a Conventional Commit, rebase onto the default branch, push under a speaking branch name, and open a GitHub pull request — in one flow. Use when the user wants to ship their work, send changes to GitHub, open a PR from their current changes, "commit push and PR", finalize a feature, or go from dirty working tree to an open PR. Composes the git-commit, git-rebase-branch, git-push-branch, and github-open-pr skills. Absolute invariant: NEVER pushes to the default branch (main, develop, etc.) — always a feature branch and a PR. Triggers on: "send to github", "ship it", "ship this", "open a PR for my changes", "commit push and open a PR", "finalize this feature", "create a PR from my work", "/github-publish".

2026-07-164

github-update

ClubMediterranee/ai-core

Update the current branch with its remote counterpart using a rebase (git pull --rebase), keeping history linear and avoiding merge commits. Fetches the branch upstream, replays local commits on top, and handles conflicts (safe automatic resolution for trivial overlaps, asks the user to arbitrate genuine logic conflicts). Use when the user asks to pull with rebase, get the latest remote commits on their branch, update/sync the current branch with its remote, resolve a "your branch is behind" state without a merge commit, or catch up before continuing work. Refuses to run on a dirty working tree (stops and asks to commit or stash first), never force-pushes, never touches git config, and prefers `git rebase --abort` over leaving a broken state. Triggers on: "pull rebase", "git pull --rebase", "get the latest commits", "update my branch from remote", "sync with the remote", "my branch is behind origin", "catch up before I continue".

2026-07-164

e2e-test-generator

ClubMediterranee/ai-core

Generate robust Playwright + TypeScript end-to-end tests for Club Med B2C sites. Use when the user asks to write E2E tests, add coverage for a user journey, or harden a flaky suite. Qualifies the test intent (including reading the repo's docs/ for PRDs and glossaries), then orchestrates five phases — ground selectors on the live site, plan scenarios, write from the grounded contract reusing existing code, prove non-flakiness by repeated cross-browser runs, and review with independent critics.

2026-07-154

git-rebase-branch

ClubMediterranee/ai-core

Rebase the current branch onto the latest default branch (detected dynamically from the remote — main, develop, or whatever origin/HEAD points to), safely. Use when the user asks to rebase, update their branch with the default branch, sync with the default branch, resolve a "branch is behind" state, or before pushing/opening a PR. Protects the default branch: if HEAD is on it, it carves a speaking feature branch from the last commit FIRST and never rebases the default branch itself. Attempts safe automatic conflict resolution and only asks the user to arbitrate genuine conflicts. Triggers on: "rebase", "rebase on main", "update my branch", "sync with main", "my branch is behind", "rebase before pushing".

2026-07-104

github-authentication

ClubMediterranee/ai-core

Generates, validates, and persists a GitHub personal access token (PAT) to .claude/settings.local.json (Claude Code local settings). Use this skill whenever a GitHub token is needed, missing, expired, or must be refreshed — before any task that calls the GitHub API or connects the GitHub MCP server. Triggers on: "generate github token", "create github token", "set up github token", "update github token", "GITHUB_TOKEN missing", "GITHUB_TOKEN not set", "GITHUB_TOKEN expired", "github token invalid", "github authentication", "connect github mcp", "configure github access", or any task that requires GitHub API access and the token is absent or invalid. Works by checking for an existing valid token first, then manual browser login (the primary path — GitHub enforces 2FA), with optional best-effort auto-login if GITHUB_USERNAME/GITHUB_PASSWORD are available. Token is stored in .claude/settings.local.json and auto-injected by Claude Code into every shell session. Browser automation uses the Playwright MCP.

2026-07-104

name	k8s-security-policies
description	Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.
allowed-tools	Read
version	1.0.0
changelog	[{"version":"1.0.0","date":"2026-06-02T00:00:00.000Z","changes":["Initial import"]}]
created-at	"2026-06-02T00:00:00.000Z"
created-by	Jeremy Wallez <jeremy.wallez@clubmed.com>
credits	https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/k8s-security-policies

Kubernetes Security Policies

Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.

Do not use this skill when

The task is unrelated to kubernetes security policies
You need a different domain or tool outside this scope

Instructions

Clarify goals, constraints, and required inputs.
Apply relevant best practices and validate outcomes.
Provide actionable steps and verification.
If detailed examples are required, open resources/implementation-playbook.md.

Purpose

Implement defense-in-depth security for Kubernetes clusters using network policies, pod security standards, and RBAC.

Use this skill when

Implement network segmentation
Configure pod security standards
Set up RBAC for least-privilege access
Create security policies for compliance
Implement admission control
Secure multi-tenant clusters

Pod Security Standards

1. Privileged (Unrestricted)

apiVersion: v1
kind: Namespace
metadata:
  name: privileged-ns
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged

2. Baseline (Minimally restrictive)

apiVersion: v1
kind: Namespace
metadata:
  name: baseline-ns
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline

3. Restricted (Most restrictive)

apiVersion: v1
kind: Namespace
metadata:
  name: restricted-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Network Policies

Default Deny All

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Allow Frontend to Backend

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

Allow DNS

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53

Reference: See assets/network-policy-template.yaml

RBAC Configuration

Role (Namespace-scoped)

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

ClusterRole (Cluster-wide)

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: default
  namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Reference: See references/rbac-patterns.md

Pod Security Context

Restricted Pod

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:1.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL

Policy Enforcement with OPA Gatekeeper

ConstraintTemplate

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("missing required labels: %v", [missing])
        }

Constraint

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-app-label
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
  parameters:
    labels: ["app", "environment"]

Service Mesh Security (Istio)

PeerAuthentication (mTLS)

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

AuthorizationPolicy

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend
  namespace: production
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/frontend"]

Best Practices

Implement Pod Security Standards at namespace level
Use Network Policies for network segmentation
Apply least-privilege RBAC for all service accounts
Enable admission control (OPA Gatekeeper/Kyverno)
Run containers as non-root
Use read-only root filesystem
Drop all capabilities unless needed
Implement resource quotas and limit ranges
Enable audit logging for security events
Regular security scanning of images

Compliance Frameworks

CIS Kubernetes Benchmark

Use RBAC authorization
Enable audit logging
Use Pod Security Standards
Configure network policies
Implement secrets encryption at rest
Enable node authentication

NIST Cybersecurity Framework

Implement defense in depth
Use network segmentation
Configure security monitoring
Implement access controls
Enable logging and monitoring

Troubleshooting

NetworkPolicy not working:

# Check if CNI supports NetworkPolicy
kubectl get nodes -o wide
kubectl describe networkpolicy <name>

RBAC permission denied:

# Check effective permissions
kubectl auth can-i list pods --as system:serviceaccount:default:my-sa
kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-sa

Reference Files

assets/network-policy-template.yaml - Network policy examples
assets/pod-security-template.yaml - Pod security policies
references/rbac-patterns.md - RBAC configuration patterns

Related Skills

k8s-manifest-generator - For creating secure manifests
gitops-workflow - For automated policy deployment

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.