菜单
Infrastructure as Code conventions for all deployed projects. Covers IaC principles, environment parity, secrets management in IaC, version control, and runbook fallback for unsupported platforms. Applied when reviewing or configuring infrastructure.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Scan a project for missing best-practice areas and implement the top recommendation for each gap (linting, unit testing) — installs tools, writes configs, verifies, and commits. Pass 'recommend' to stop after writing recommendations without implementing (replaces the old do-recommend skill).
Implement a focused code change. Use this skill as the wrapper for any implementation work so the Maverick workflow report captures what was done and so the agent applies the project's coding standards before editing. Intended to be invoked once per task from inside a do-issue-* or do-epic phase, not standalone.
Audit a codebase for security risks in one of two modes. In full-audit mode it scans the entire codebase and writes a findings report to docs/security-audit.md (run as part of do-init or on demand). In update mode it reviews only a diff plus the code it could impact, returning a structured findings list as a pre-push gate for do-issue-solo and do-issue-guided. Covers secrets exposure, dependency vulnerabilities, authentication and authorisation patterns, input validation, transport security, and common OWASP risks.
Create, restructure, or update technical documentation. Handles greenfield projects, refactoring non-compliant docs, and incremental updates after code changes.
Work on a multi-story GitHub epic end-to-end. Builds a DAG from the child stories, groups them into waves, runs waves in parallel via per-story worktrees, ejects PRs that fail agent-code-review for human handling, and propagates blocks to downstream stories. Requires git worktrees.
Initialise a project for use with Maverick — verifies the GitHub App, installs the CLI if needed, writes the project config with integration tracking, scaffolds docs, generates project skills, runs an initial cybersecurity audit, then commits the changes and opens a PR.
| name | mav-bp-infrastructure-as-code |
| description | Infrastructure as Code conventions for all deployed projects. Covers IaC principles, environment parity, secrets management in IaC, version control, and runbook fallback for unsupported platforms. Applied when reviewing or configuring infrastructure. |
| user-invocable | false |
| disable-model-invocation | true |
All infrastructure must be defined, versioned, and reproducible from code; manual provisioning is a last resort and must be documented in a runbook.
.tfvars); reference a secret manager with dynamic injection at deploy time, and mark secret outputs as sensitive.docs/runbooks/), including prerequisites, verifiable numbered steps, verification, rollback, owner, and whether it is temporary or should be migrated to IaC. Review runbooks like code.Check for docs/maverick/skills/infrastructure-as-code/SKILL.md. If present, read it and follow it — it wins on specifics (library, config, conventions). If missing, proceed with these standards and note the gap in your summary.
| Pattern | Issue | Fix |
|---|---|---|
| Hard-coded secret in IaC file | Secret exposure | Move to secret manager, reference dynamically |
| Copy-pasted templates per environment | Environment drift risk | Parameterise a single template |
| State file committed to repository | State corruption risk | Move to remote backend with locking |
| No plan step in CI pipeline | Blind apply | Add plan stage, require review before apply |
| Manual infrastructure change with no runbook | Undocumented, unreproducible | Write a runbook or convert to IaC |
| Resources with no tags or labels | Untrackable resources | Add standard tags (service, environment, owner, SHA) |
| Destructive changes auto-applied | Accidental data loss | Require human approval for destroy/replace actions |
| Mixed IaC tools for the same resource layer | Conflicting state management | Standardise on one tool per layer |