Skip to main content
v1.45.10 — What's new

Platform Skills

Your AI agent generates config. It doesn't know what breaks. Platform Skills gives it the missing context — blast radius, validation steps, and rollback plan, built in.

Get StartedView on GitHub
Works with Claude Code · Cursor · VS Code / Copilot · Codex
The problem

AI agents are great at writing YAML.
They're not great at knowing what happens next.

💥
Adds a CPU limit that throttles production at peak load
🔓
Writes IAM policies with wildcards because it's "simpler"
🕳️
No mention of what breaks if the change is wrong
🤷
No validation steps. No rollback plan. Ships anyway.

Platform Skills is a plugin that teaches your agent to think like a senior platform engineer — not just generate, but reason.

Real usage, real results

See it in a real situation

Every command follows the same pattern: understand the situation, take the right action, show the result.

Security
SA pipeline flags a CRITICAL CVE in your base image 30 minutes before a release window.
TScan the image, understand blast radius, decide whether to block or accept risk with a documented exception.
A/platform-skills:trivy image
RSeverity-gated scan with exploitability context, a pre-filled .trivyignore entry with expiry date, and a go/no-go recommendation with rollback path if you ship.
Code Review
SCopilot left 12 unresolved review threads on your PR. Release is blocked until they're cleared.
TClassify each comment, fix the real issues, reply to every thread, and resolve them — without missing one.
A/platform-skills:triage --all 100
REvery thread triaged: ACTIONABLE ones fixed and committed, INFORMATIONAL ones answered, NOT_APPLICABLE ones closed with a reason. Summary table printed.
CI/CD
SYour workflows have never been audited. Someone asks whether a PR from a fork could steal your deploy credentials.
TAudit every workflow and composite action, separate real exposure from noise, and decide what to pin and what to fix first.
A/platform-skills:zizmor
RFindings grouped by severity with the four online-only audits named explicitly, an explicit hash-pin vs semver-tag decision (SHA recommended, and why), auto-fixable items applied as a reviewable diff, and a CI gate that starts advisory instead of blocking every PR on day one.
Infrastructure
SSecurity asks if a Terraform change is safe to apply to production. You have 20 minutes.
TScan against the actual plan (not just source), surface HIGH/CRITICAL findings, map them to SOC 2 controls.
A/platform-skills:checkov plan
RDeep analysis against live state values, findings grouped by control, a .checkov.baseline diff showing what's new vs existing, and a one-line verdict: safe / needs fix / block.

Govern what your agent does, and what it costs

Two companion commands. One bounds an agent's authority, the other bounds its spend. They register on the same hook event and their failure directions are deliberately opposite: the governance evaluator fails closed once it runs, so a broken policy denies rather than waving work through, while the cost optimizer fails open so a broken config never blocks work. Neither can act if the client's hook transport times out or crashes — that always fails open, which is the gap the merge-time check exists to cover.

/platform-skills:ai-governance
Decides what an AI agent is allowed to do in your repo. Real-time session hooks for Copilot and Claude Code deny edits to protected paths and dangerous shell commands before they run. A merge-time check then re-runs the base branch’s copy of the policy against the pull request’s diff, so a PR cannot weaken the rule meant to catch it. Its scope is bounded and documented: it is a pull_request check, so a direct push to a branch it does not run on is not covered, and edits to the workflow file itself need CODEOWNERS review rather than the check. Three enforcement tiers so a rollout starts by logging, not blocking.
/platform-skills:token-optimizer
Decides which model does the reading. Broad repository discovery moves to a cheaper worker through each client’s native subagent, while the main agent keeps decisions and targeted verification. Ships a runnable benchmark rather than a savings claim, and reports delegation, worker model, redirection and read limit as four separate states, splitting the requested model from the observed one so nothing reads as proven when it is not.

51 commands. Every domain a platform team touches.

⎈
Kubernetes
Cluster baseline, Helm, KEDA autoscaling, Karpenter node provisioning
🔄
GitOps
Flux CD, Argo CD, OCI delivery, Flux Operator, gitless clusters
🏗️
Terraform
Blast radius analysis, IAM least-privilege, SOC 2 controls
☁️
AWS & Azure
CloudFront, WAF, Lambda@Edge, IAM / IRSA, AKS, Workload Identity, Azure Policy
⚙️
GitHub Actions
OIDC federation, SHA pinning, token scoping, composite actions, zizmor workflow audit
🔐
Secrets
External Secrets Operator, Sealed Secrets, provider setup, rotation runbook, audit
🔒
Security
Supply chain (Cosign, SBOM, SLSA), Falco, OPA, Kyverno, Trivy
📊
Observability
Datadog, Dynatrace, OpenTelemetry, LLM observability, DORA

Install in your agent

One command. Works where you work.

Add to marketplace
claude plugin marketplace add https://github.com/nitinjain999/platform-skills
Install
claude plugin install platform-skills
Upgrade to latest
claude plugin update platform-skills