Designs and runs cloud infrastructure — environments, infrastructure as code, networking and isolation, scaling, and cost. Use this to design a cloud environment, control infrastructure spend, set up environment separation, plan for scale or region failure, or review infrastructure someone configured by hand.
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
Cloud replaces capital cost with an operating cost that scales with carelessness. The discipline is mostly about making the environment reproducible and the spend visible.
Infrastructure created by hand cannot be reviewed, reproduced, or recovered. Define it as code, review it like code, and apply it through a pipeline rather than from a laptop.
The test: could you rebuild the environment from an empty account, and do you know that because you have done it? Untested reproducibility is a belief.
Console access for humans should be read-only in production by default. Write access exists for
emergencies, is time-bound, and is logged — see security:access-and-identity for the policy this
implements.
Separate environments by blast radius, not by name. Separate accounts or subscriptions give a hard boundary; separate namespaces in one account give a soft one that a misconfigured permission crosses.
Production data does not belong in lower environments. Where realistic data is needed, mask or synthesize it — a copied production database is a breach waiting for a misconfigured bucket, and it is one of the most common ways personal data escapes.
Default deny, then open what is needed. Public exposure should be a deliberate, reviewable act rather than the residue of a default.
Keep the trust boundary explicit and few: what is reachable from the internet, what is reachable between services, what reaches data stores. Most cloud incidents are not exotic — they are a storage bucket, a database, or a management interface that was reachable and should not have been.
Scale horizontally where you can and know your actual limits — the database connection ceiling, the third-party rate limit, the single-threaded component nobody remembers. Autoscaling in front of a hard downstream limit converts a slow system into an outage.
Design for the failure of a single instance and a single zone as routine. Region failure is a
business continuity decision with a real price attached, made with
operations:business-continuity-and-resilience rather than assumed by engineering.
Cost is an architectural property. Attribute spend by team and workload from the start; without tagging, cost becomes an unattributable aggregate that only ever gets addressed in a panic.
The usual large wins are unglamorous: idle non-production resources, over-provisioned instances, storage nobody deleted, and cross-zone data transfer nobody accounted for.
references/sources.md in this skill lists the outside authorities that settle the questions
here — what each one is authoritative for, and what you may do with it. Check them before
answering on anything they cover, and cite what you used. Most are free to read and not free
to reproduce; the use note on each is binding.
Platforms: AWS, Google Cloud, Microsoft Azure, and similar; managed application platforms — Fly.io, Render, Vercel, Railway — remove most of this work and are the right answer more often than engineering pride admits.
Orchestration where you need it: Kubernetes with a managed control plane, or a container service like ECS. Kubernetes is a platform team's worth of work; adopt it when you have the team.
Infrastructure as code and secrets: Terraform, OpenTofu, Pulumi, and similar, with secrets in a
managed store rather than in the state file. it-operations:cloud-administration covers the
corporate cloud estate, which is a different problem with overlapping tools.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.
The English summary is being prepared. Showing the original description.
Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group inside each, tiering effort against account value, coordinating so the account experiences one campaign rather than several, and measuring account progression instead of leads. Use this to decide whether to run an account-based program, build one, or work out why an existing one produces activity and no pipeline.
The English summary is being prepared. Showing the original description.
Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account. Use this to design or fix signup and onboarding, diagnose why signups do not convert to active use, reduce time-to-value, or decide what a new user must accomplish first.
The English summary is being prepared. Showing the original description.
Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a script that runs in CI. Use this whenever the user wants to set up, expand, audit, or fix a multi-agent or subagent structure for a codebase; asks how to divide work between agents; wants agent charters, roles, or a surface map written; or is hitting agents that collide on the same files, review their own work, or drift from their remit. Also use when sizing a roster or deciding whether a new agent is justified.
The English summary is being prepared. Showing the original description.
Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire. Use this before deploying a model or AI feature, when defining evaluation criteria, when a model's behavior has drifted, when assessing AI risk or regulatory exposure, or when deciding whether an AI system is fit for a consequential decision.
The English summary is being prepared. Showing the original description.
Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit. Use this to analyze a market or industry, map competitors, evaluate a market-entry or build-versus-buy decision, produce a research brief, or assemble evidence for a decision. Also use when comparing options that need a structured, evidence-based verdict rather than an opinion.
The English summary is being prepared. Showing the original description.