Claude Skills by VincentChuWaiChow

Advise on Huawei Cloud MLPS 2.0 Level 3 technical controls mapping, China data localization requirements, Trusted Cloud (CAICT) certification controls, and government cloud configuration requirements for sovereignty-aware workloads.

Coordinate Huawei Cloud cost anomaly detection — CBC Cost Center delta analysis (>15% day-over-day threshold), budget alert configuration via Budget Management, ECS/GaussDB Yearly/Monthly vs On-Demand mode cost anomalies, OBS request cost spikes, unattached EVS volume waste, DWS idle cluster detection, and reserved instance coverage gaps.

Analyze Huawei Cloud CBC (Customer Business Console) spend, optimize Reserved Instance and CUD (Committed Use Discount) coverage, manage Cost Center allocation tags, and govern budget alert thresholds.

Coordinate the daily Huawei Cloud operations standup — CBC cost delta by Enterprise Project, AOM anomaly alert review, CCE pod failure triage, CES quota utilization warnings, LTS log error spike detection, SecMaster security finding triage, and action item assignment.

Manage Huawei DEW (Data Encryption Workshop) — KMS key lifecycle and rotation, CSMS secret rotation automation, CBH (Cloud Bastion Host) privileged access session management, and DBSS database encryption and SQL audit.

Plan and execute Huawei DRS (Data Replication Service) migration and real-time sync tasks, CDM (Cloud Data Migration) batch ETL jobs, and DMS (Distributed Message Service) Kafka cluster operations with safe cutover sequencing.

Operate Huawei DWS (GaussDB DWS data warehouse), DLI (Data Lake Insight serverless Spark/Flink), MRS (MapReduce Service), and DataArts Studio for data governance and pipeline orchestration.

Manage Huawei ECS (Elastic Cloud Server) instance lifecycle, AS (Auto Scaling) group configuration and health, IMS (Image Management Service) golden image management, DeH (Dedicated Host) tenancy, and CSBS backup snapshot governance.

Review Huawei Cloud event-driven architecture designs — DMS Kafka dead-letter configuration, ROMA Connect integration flow capacity, FunctionGraph event trigger idempotency, SMN delivery retry policy, consumer group lag monitoring, cross-region event replication, and retry storm prevention.

Deploy and operate Huawei FunctionGraph functions (event triggers, cold start optimization, concurrency), ServiceStage application lifecycle management, and CSE (Cloud Service Engine) Spring Cloud/ServiceComb microservice governance.

Manage Huawei GaussDB (MySQL, PostgreSQL, Oracle-compatible), RDS instances, DDS (Document Database Service, MongoDB-compatible), database proxy connection pooling, and HA/backup architecture with CBR integration.

Review Terraform and RFS (Resource Formation Service) changes targeting Huawei Cloud — blast radius analysis, resource deletion detection, Organizations SCP cascade scope, cross-stack dependency impact, state file security, and rollback plan completeness.

Audit Huawei Cloud IAM fine-grained policies, SCP (Service Control Policy) at Organizations level, agency trust relationships (cross-account delegation), and enterprise project permission boundaries.

Manage IEF (Intelligent Edge Fabric) edge node lifecycle, edge application deployment as container workloads, IoT device twin management, and cloud-edge-device unified control plane with offline operation support.

Set up Huawei Cloud Organizations with SCP baseline, IAM fine-grained permission structure, Enterprise Projects governance model, and master account structure for multi-account/multi-project governance.

Gate CCE deployment mutations, node pool upgrades, and cluster version changes against rollback posture and workload disruption budget before any production change. Prevents irreversible CCE cluster upgrades from proceeding without workload PDB verification, addon compatibility check, node pool drain confirmation, and explicit operator approval.

Gate Huawei Cloud CBC budget threshold changes, Reserved Instance purchases, and CUD commitments — budget threshold reduction can trigger service suspension and RI/CUD are non-refundable committed spend.

Gate GaussDB/RDS instance deletion, spec downgrade, and backup policy removal — database deletion is permanently destructive and MLPS Level 3 data destruction triggers mandatory 24-hour incident reporting.

Gate IAM fine-grained policy and SCP mutations — account-wide blast radius, privilege escalation, and potential full access denial. SCP deny statements at Organizations level cascade to ALL member accounts and cannot be overridden by IAM policies. Prevents dangerous policy mutations from proceeding without blast-radius assessment, agency trust enumeration, and explicit operator approval.

Gate DEW/KMS key deletion and disable operations — all CSMS secrets and DBSS-encrypted database data become permanently unrecoverable once the key deletion window passes.

Gate OBS bucket ACL and policy mutations — public-read/write ACL exposes data immediately and CN-* cross-border replication may violate MLPS 2.0/CSL data localization requirements.

Engineer and review Huawei Cloud ELB traffic configurations — dedicated vs shared ELB type selection, HTTP/HTTPS/TCP/UDP protocol listener setup, health check configuration, WAF integration on ELB, backend server group routing, connection draining, and TLS policy enforcement on Dedicated ELB.

Huawei Cloud Maestro routing skill. Classify the user's Huawei Cloud task, select the narrowest specialist agent or the right team of specialists from the catalog, and dispatch them — single specialist for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatch live-guard agents. MLPS 2.0 and sovereignty-aware — flags when workloads require MLPS Level 3 controls or government cloud configurations. Understands Huawei's enterprise-project model and SCP-based org governa...

Plan migrations to Huawei Cloud via MgC (Migration Center), SMS (Server Migration Service) for P2V/V2V, DRS for database replication, and OMS (Object Migration Service) for object storage, with cutover sequencing and rollback design.

Manage Huawei ModelArts training jobs (GPU and Ascend NPU cost governance), Pangu foundation model deployment, AI Gallery model management, and MLOps pipeline automation for AI/ML workloads.

Design Huawei Cloud network architecture — VPC, ELB type selection (dedicated/shared), VPN and DC Gateway (Direct Connect), Cloud Connect for inter-VPC, CFW (Cloud Firewall), Anti-DDoS, DNS. Covers Dedicated vs Shared ELB trade-offs, DC Gateway VBC connectivity, Cloud Connect cross-region/cross-account peering, and CFW east-west firewall policy.

Govern Huawei Cloud OBS (Object Storage Service) data perimeters — bucket policy and ACL public exposure, Block Public Access configuration, VPC endpoint binding for private access, WORM (Object Lock), cross-region replication compliance, and MLPS 2.0 data residency enforcement.

Manage Huawei OBS lifecycle policies, bucket ACL and policy governance, SFS (Scalable File Service) NFS shares, EVS (Elastic Volume Service) block storage, and CBR (Cloud Backup and Recovery) backup strategy for data protection compliance.

Respond to Huawei Cloud incidents via CES (Cloud Eye) metric alarms, LTS (Log Tank Service) log analytics, AOM (Application Operations Management) service topology, APM distributed tracing, and SMN notification governance.

Govern Huawei Cloud SWR (Software Repository for Container) — image retention policy, vulnerability scanning via VSS (Vulnerability Scan Service) integration, namespace permission least privilege, cross-region image replication, and supply chain security posture.

Review Huawei Cloud workload HA and BCDR designs — GaussDB High Availability (HA) instance failover, CBR (Cloud Backup and Recovery) cross-region vault, CCE multi-AZ deployment, DRS (Data Replication Service) for DR, RTO/RPO target analysis, and runbook completeness.

Operate Huawei SecMaster (integrated SIEM/SOAR/threat intelligence), HSS (Host Security Service) host intrusion detection, CFW (Cloud Firewall), WAF (Web Application Firewall), Anti-DDoS, and VSS (Vulnerability Scan Service) for comprehensive cloud security operations.

Review FunctionGraph production readiness on Huawei Cloud — VPC access configuration, concurrency limits and reserved instances, cold-start optimization, observability via LTS and AOM, timeout configuration, dependency package size, custom vs managed runtimes, and ServiceStage application lifecycle.

Design Huawei Cloud solutions — product selection, enterprise-project model design, region selection for MLPS/sovereignty requirements, architecture patterns, multi-zone and multi-region HA. Covers region mapping (China and international), GaussDB vs RDS selection, ModelArts/Ascend NPU considerations, and the six-pillar Huawei Cloud Architecture Framework including the Trusted pillar.

Coordinate Huawei Cloud support incidents — case creation with correct severity (紧急/高/中/低), Premium Support SLA enforcement, Account Manager and TAM escalation path, status page monitoring, internal stakeholder communication, and post-incident evidence packaging.

Triage Huawei Cloud operational alerts, incidents, and support tickets — P0/P1/P2/P3 classification, Huawei Cloud Premium Support SLA enforcement, Account Manager escalation, AOM alert routing, war room coordination, evidence collection from CES and LTS, and safe escalation paths.

Assess Huawei Cloud cost efficiency using the Well-Architected Framework Cost Optimization pillar: ECS flavor selection including Kunpeng Arm, Yearly/Monthly vs Pay-Per-Use billing, Spot Instances, Enterprise Project cost attribution, and Cost Center monitoring.

Assess Huawei Cloud workload reliability using the Well-Architected Framework Reliability pillar: AZ distribution, ELB load balancing, Auto Scaling, GaussDB and RDS multi-AZ HA, and CBR data protection.

Assess Huawei Cloud workload security using the Well-Architected Framework Security pillar: IAM SCP governance, VPC isolation, DEW key management, SecMaster SIEM/SOAR, and MLPS 2.0 technical controls for China-resident workloads.

Analyze IONOS Cloud cost posture and identify optimization opportunities across compute, storage, and managed services. Covers idle server and volume identification, CPU and memory utilization rightsizing, snapshot and backup cost review, managed service tier evaluation, contract and pricing strategy, cross-region consolidation feasibility, and cost showback. Use when the user asks to reduce, explain, or attribute IONOS Cloud spending.

Review IONOS Data Center Designer (DCD) topology for resource organization, multi-availability-zone placement, private LAN segmentation, volume layout, NIC configuration, and firewall posture. DCD is unique to IONOS as a graphical infrastructure orchestrator where topology changes carry datacenter-wide blast radius. Use when the user asks to review, redesign, or assess the safety of an IONOS datacenter topology or resource layout.

Review IONOS managed Kubernetes cluster and node pool configuration covering cluster readiness, node pool sizing and autoscaling, workload placement strategies, PodDisruptionBudget coverage, control-plane upgrade safety, kubeconfig management, LAN attachment, and GDPR-compliant cluster region selection. Use when the user asks to assess, configure, or troubleshoot IONOS managed Kubernetes clusters or node pools.

Execute and advise on IONOS DBaaS lifecycle operations for PostgreSQL, MariaDB, and MongoDB managed databases. Covers failover initiation, replica promotion, horizontal and vertical scaling, backup schedule review, point-in-time recovery, cluster deletion protection, and regional endpoint validation. Requires current backup verification, explicit RPO and RTO targets, and human approval before any mutation. Hard-stop when target, approval, or rollback plan is ambiguous.

Classify incoming IONOS Cloud requests and route them to the narrowest applicable specialist agent. Covers DCD topology review, security and GDPR compliance, managed Kubernetes, cost optimization, and DBaaS lifecycle operations. Use this skill when the task domain is not yet identified or spans multiple IONOS Cloud areas.

Audit IONOS Cloud security and compliance posture covering GDPR data residency and data sovereignty, ISO 27001 control alignment, encryption at rest and in transit, private LAN isolation, IAM role and bearer token hygiene, regional endpoint correctness, audit trail coverage, and vulnerability posture. Use when the user asks to assess, improve, or evidence IONOS Cloud security or GDPR compliance.

Use this skill for Istio service mesh review across both sidecar mode and ambient mode (ztunnel L4 + optional waypoint L7). Covers PeerAuthentication, AuthorizationPolicy, RequestAuthentication, Gateway, VirtualService, DestinationRule, Sidecar, and waypoint placement. Trigger when the user asks whether an Istio policy is correct, whether mTLS is strict, whether L7 AuthorizationPolicy will actually be enforced in ambient mode, or whether a mesh-wide PeerAuthentication change is safe.

Use this skill when producing a board-legible replatform-vs-renew (modernize/rehost/replatform/retire) recommendation for a proprietary Java application server (WebLogic, WebSphere, JBoss EAP or legacy JBoss) and/or an Oracle-JDK estate. Trigger when a user supplies specialist inventory findings (JDK lifecycle/support-boundary exposure, jakarta namespace debt, EJB/JAX-WS/SOAP usage, container-readiness) plus cost figures (current licence/support spend, target-state run cost, one-time migratio...

Use this skill when statically reviewing Java concurrency and Project Loom virtual-thread adoption for correctness and safety at scale — pooling or capping virtual threads, a virtual-thread migration that strips a bound on a limited downstream resource (connection pool, rate-limited API) without re-imposing it via a Semaphore, JDK-version-gated carrier-pinning risk from synchronized blocks (materially reduced from JDK 24 onward by JEP 491 versus JDK 21's JEP 444), ThreadLocal cost at millions...

Use this skill when statically reviewing whether a JVM is correctly sized and configured for the container it runs in — UseContainerSupport and cgroup v1/v2 detection, -XX:MaxRAMPercentage or a fixed -Xmx sized to leave off-heap headroom (metaspace, thread stacks, direct/NIO buffers, code cache) under the container memory limit, ActiveProcessorCount vs CPU limits driving GC and thread-pool (ForkJoinPool) sizing, the interaction between GC stop-the-world pause time and Kubernetes liveness-prob...

Use this skill when statically reviewing a Flyway or Liquibase schema-migration PR for rolling or blue-green deploy safety — immutable applied-migration discipline (checksum/history-table drift on an edited already-applied migration), expand-contract phasing for column/table drops and renames, destructive DDL (drop column/table, type narrowing, NOT NULL without a default on a populated table) landing in the same release that stops using it, long-locking DDL on large tables, out-of-order migra...