Claude Skills by VincentChuWaiChow

Guard OCI Resource Manager stack plan, apply, destroy, import-state, drift, and state-version decisions with plan review, state-lock awareness, approval, rollback, and blast-radius evidence.

Guard OCI Vault key deletion, cancellation, disablement, rotation, and HSM/software key lifecycle decisions with usage, dependency, waiting-window, backup, and recovery-limit evidence.

Design, review, and troubleshoot OCI Load Balancer and Network Load Balancer traffic paths, listeners, backend sets, certificates, health checks, logging, failover, and exposure risk.

Route OCI tasks to the narrowest specialist or explicitly approved team, enforce live-guard gates, preserve evidence labels, and refuse unsafe auto-dispatch for destructive or production-changing work.

Plan OCI migrations and cutovers with dependency discovery, waves, replication, DNS, identity, data validation, rollback, support readiness, and go/no-go evidence.

Design and review OCI-connected multi-cloud architectures across Azure, AWS, Google Cloud, on-premises, and SaaS with routing, identity, DNS, security, observability, cost, latency, and failure-mode evidence.

Review OCI MySQL HeatWave, HeatWave clusters, Lakehouse, AutoML, GenAI, vector/RAG workflows, object storage ingestion, SQL safety, and operational readiness with source-grounded evidence.

Design, review, and troubleshoot OCI VCNs, subnets, route tables, DRGs, gateways, peering, security lists, NSGs, load balancers, DNS, and connectivity without cargo-cult exposure.

Triage OCI Monitoring alarms, Logging, Events, Notifications, service health, metrics, runbooks, and responder permissions with scoped evidence and safe containment.

Operate and review OCI Recovery Service protected databases, protection policies, recovery service subnets, backup health, redo status, recovery windows, and restore readiness without confusing backup configuration with recoverability.

Govern OCI Container Registry repositories, container images, Helm/OCI artifacts, public access, retention policies, signatures, vulnerability scanning, provenance, and least-privilege push/pull access.

Build OCI resource inventories and dependency maps using Resource Search, compartments, tags, lifecycle states, and cross-service discovery without treating partial search visibility as complete tenancy truth.

Review OCI security, IAM, network exposure, logging, encryption, Cloud Guard, Vulnerability Scanning, Security Zones, and compliance evidence with least-privilege and source-grounded findings.

Design and stress-test OCI solution architectures across identity, compartments, networking, compute, database, storage, observability, security, reliability, cost, and operations with evidence-backed tradeoffs.

Operate as an OCI storage and backup steward for Object Storage, Block Volume, File Storage, backup policies, retention, replication, lifecycle rules, restore readiness, and IAM-scoped storage operations.

Coordinate OCI support incidents with sanitized evidence, severity discipline, ownership, timelines, impact statements, and safe escalation packages.

Review OCI Well-Architected cost optimization posture across usage, budgets, tags, idle resources, rightsizing, quotas, forecasts, and Cloud Advisor recommendations.

Review OCI Well-Architected reliability posture across regions, availability domains, fault domains, backups, replication, monitoring, failover, and disaster recovery drills.

Review OCI Well-Architected security posture across IAM, compartments, network exposure, encryption, logging, Cloud Guard, Security Zones, vulnerability scanning, and compliance guardrails.

Ground Oracle, OCI, SQLcl, database, and Model Context Protocol recommendations in official Oracle sources and read-only evidence before advising.

Use this skill for OpenTelemetry Operator review covering OpenTelemetryCollector deployment modes (Deployment, StatefulSet, DaemonSet, Sidecar), Instrumentation CR auto-instrumentation across Java/Node/Python/.NET/Go, Target Allocator for distributed Prometheus scraping, and pipeline correctness across receivers, processors, and exporters. Trigger when the user asks whether a collector configuration will lose telemetry, whether the right deployment mode is used, whether memory_limiter and bat...

Analyze OVHcloud Public Cloud cost posture across projects and regions: identify idle instances and unattached volumes, review Savings Plans and commitment coverage, recommend rightsizing and tagging improvements, and surface forecast risks. Use when the user asks to reduce, explain, or govern OVHcloud spend without compromising observability, backups, or redundancy.

Review OVHcloud IAM policies for overly permissive allow rules, missing deny blocks, unscoped URNs, absent condition blocks (IP CIDR, resource tag, expiration), and identity-group hygiene. Use when the user needs to audit access control, review `ovh_iam_policy` Terraform resources, assess OAuth2 service account scopes, or validate conditional access configuration against the principle of least privilege.

Review and advise on OVHcloud Managed Kubernetes (MCK) cluster lifecycle, node pool sizing, autoscaling configuration, version upgrade planning, workload placement via taints and tolerations, network policies, RBAC hardening, and cluster security posture. Use when the user needs MCK operational guidance, Terraform IaC review for `ovh_cloud_project_kube` resources, or upgrade risk assessment.

Gate and audit OVHcloud KMS key version destruction requests by enforcing five mandatory checks: confirmed key ID and KMS service URN, named approving identity, usage audit confirming zero active references within the retention window, documented waiting period, and a rollback or data-recovery plan. Use when a user requests destruction or rotation of an OVHcloud KMS key version. Hard-stop if any gate is absent or ambiguous.

Classify incoming OVHcloud requests by domain and route to the narrowest qualified specialist agent. Use when the user's task spans or is unclear across IAM, FinOps, Kubernetes, networking, or live-guard KMS domains. Does not answer specialist questions directly; produces a routing verdict with evidence and hands off with a clear scope statement.

Design and review OVHcloud network topology including vRack private network segmentation, VLAN configuration, Public Cloud private network attachment, dedicated server connectivity, load balancer placement, DNS zone design, security group rules, and blast-radius scoping for topology changes. Use when the user needs vRack design guidance, network isolation review, or Terraform IaC review for `ovh_vrack` and related resources.

Use this skill to review PHP Composer dependency supply-chain posture — whether composer audit is wired into CI with a failing exit-code gate on security advisories, whether config.policy.advisories.audit and config.policy.abandoned settings are configured to actually surface risk, whether abandoned packages have a tracked replacement plan, and whether composer.lock is present, current, and pins dependencies at security-sensitive boundaries. Use when a vulnerable or abandoned Packagist depend...

Route PHP-board governance tasks to the narrowest specialist or a genuinely multi-domain parallel team from the PHP catalog. Use when you do not already know which PHP specialist handles the task. Not for direct PHP answers or specialist review; Maestro classifies, dispatches, and hands off to php-board-chair-agent (or the named owning human until one exists) only. Detects and refuses live-mutation or destructive requests (deploy, database migration in prod, force-push), requiring explicit hu...

Use this skill to review PHP runtime upgrade readiness — whether the target or running PHP version is past php.net's published four-year support window (active support, then security-only, then EOL) — and to review production OPcache (enable, validate_timestamps, memory sizing) and PHP-FPM (pm, max_children, max_requests) hardening. Use when production PHP could be running an EOL or soon-security-only-EOL version, or when OPcache/FPM configuration could serve stale code or let a traffic spike...

Use this skill to statically review PHP code for object-injection risk from unserialize() on untrusted input, session fixation/hijacking from missing session_regenerate_id() or weak session cookie hardening, and unsafe file-upload handling that trusts the client or stores/executes uploads inside the webroot. Use when reviewing a PHP application for deserialization, authentication-session, or upload-handling security issues. Static review only; it never executes payloads, uploads, or requests ...

Use this skill to review WordPress plugin, theme, REST API, and block-editor code for missing or overly permissive REST permission_callback registration, unescaped dynamic block render_callback output, missing input validation/sanitization or output escaping, and missing nonce/capability checks on state-changing requests. Use when reviewing register_rest_route() calls, dynamic block render_callback/render.php files, form/admin-ajax handlers, or any code path that takes untrusted input and pro...

Use this skill when reviewing Prometheus or AlertManager configuration for cardinality, alerting correctness, scrape security, remote_write safety, or retention adequacy. Trigger when a user provides prometheus.yml, alertmanager.yml, recording rules YAML, alerting rules YAML, or asks whether their Prometheus setup is production-ready.

Use this skill to statically review Python application code for high-severity security defects: unsafe deserialization (pickle, yaml.load), dynamic execution (eval/exec), subprocess and shell injection, SSRF, path traversal and unsafe archive extraction, secrets exposure, cryptography misuse, and fail-open exception handling. Reads source only; it never runs code, writes an exploit, or opens a live connection.

Use this skill to statically review Python asyncio reliability: blocking calls that stall the event loop, cancellation correctness, missing timeouts on external awaits, task lifecycle and structured concurrency, backpressure on unbounded fan-out, and context propagation across executor and thread boundaries. Reads source only; it never runs the service or measures actual timing.

Use this skill to statically review business-critical Python automation governance: unowned scripts, notebooks, bots, and schedulers whose failure creates financial, regulatory, or operational exposure. Reads automation source, configuration, and process description only; it never runs the automation and makes no accounting, legal, or regulatory conclusion — those route to the finance/accounting and legal boards.

Use this skill to statically review containerized/serverless Python runtime behavior: PID 1 and signal handling, worker/process model, graceful shutdown, read-only-filesystem and cold-start assumptions, and dependency footprint. Reads Dockerfiles, process/server config, and source only; it never builds or runs a container.

Use this skill to statically review Python database access and transactions (SQLAlchemy, Django ORM, DB-API): session and transaction scope, commit/rollback boundaries, N+1 and lazy-loading, connection-pool sizing, migration safety, and multi-tenancy scoping. Reads source, models, and migrations only; it never connects to a database or runs a migration.

Use this skill to statically review Python data-pipeline reliability (Airflow, Dagster, Prefect, PySpark): task idempotency and safe backfills, partitioning and late-data handling, schema evolution and data contracts, checkpointing, retry policy, and data-quality gates. Reads DAG/pipeline source and configuration only; it never runs a pipeline, triggers a backfill, or connects to a warehouse.

Use this skill to statically review Python developer tooling and build configuration: whether linters, type-checkers, and tests are wired to catch meaningful defects (not stylistic noise), CI gate coverage, tox/nox environment isolation, build-backend and project layout, and the pre-commit developer feedback loop. Reads tool, CI, and build configuration only; it never runs ruff, mypy, tox, pre-commit, or the CI pipeline.

Use this skill to statically review Python distributed task systems (Celery, RQ, Dramatiq): idempotency under at-least-once delivery, retry policy and backoff, dead-letter and poison-message handling, duplicate execution, acknowledgement timing, scheduling, and transactional-outbox boundaries. Reads task and config source only; it never enqueues, runs, or acknowledges a task.

Use this skill to statically review Python runtime-estate support posture and upgrade sequencing: end-of-life/unsupported interpreters, deprecation exposure, dependency/framework compatibility for an upgrade, and ownership/business-criticality gaps. Reads inventory, manifests, and config only; it never runs an upgrade or installs an interpreter.

Use this skill to statically review Python free-threaded (no-GIL) adoption: invalidated GIL thread-safety assumptions, shared-state races, C-extension compatibility, and synchronization needs. Reads source, build config, and extension manifests only; it never builds or runs the free-threaded interpreter.

Use this skill to statically review Python type contracts and gradual typing: Any propagation across public boundaries, Protocol and structural typing, generics and variance soundness, overload consistency, TypedDict and dataclass contracts, and the separation of static typing from runtime validation. Reads source and type-checker config only; it never runs the checker or the code.

Use this skill to produce a normalized change plan — an exact diff, a pre-approved rollback procedure, machine-checkable verification criteria, and a stable action digest — bound to an exact target. Read-only-runtime: it holds no production credentials and executes nothing.

Use this skill to create a branch and pull request for a bounded code/dependency remediation and run approved isolated (non-production) validation against it. Mutating-runtime: it can never merge, deploy, or weaken a policy, gate, or test.

Use this skill to periodically test whether previously operating controls continue to operate, read-only by default. It runs the continuous-control checklist, opens a finding with a named owner and due date for each failure, and distinguishes a single passing observation from continuing operating effectiveness.

Use this skill to collect, hash, and seal control evidence to an approved, access-controlled, retention-managed destination and map it to controls as candidate support. It captures evidence quality dimensions, applies redaction/tokenization and retention/legal-hold, and never asserts a control is effective or a framework is satisfied.

Use this skill to govern a migration, backfill, pipeline reprocessing, or bounded data correction against a live system: confirm data ownership sign-off, data classification, a bounded record/partition scope, a reconciliation plan, and a rollback before acting, then require reconciliation evidence and apply data-minimization/residency controls to captured evidence. It never allows an unbounded or ad-hoc production data mutation.

Use this skill to record and review a policy exception: confirm a named owner distinct from the requester, an explicit scope, an expiration date, compensating controls, and a review date, refuse to approve its own exception, and automatically flag expired or incomplete exceptions as findings.