@raishin/vanguard-frontier-agentic 1.1.0 → 1.3.0

package/skills/oci/oci-live-autonomous-db-lifecycle-guard/references/rollback-playbook.md

@@ -0,0 +1,44 @@
+# Rollback Playbook: OCI Live Autonomous DB Lifecycle Guard
+
+## Restore from automatic backup (after accidental stop or data issue)
+
+```bash
+# List available backups
+oci db autonomous-database-backup list \
+  --autonomous-database-id <ADB_OCID> \
+  --query "data[].{id:id,displayName:\"display-name\",timeStarted:\"time-started\",type:type}"
+
+# Restore to a specific backup
+oci db autonomous-database restore \
+  --autonomous-database-id <ADB_OCID> \
+  --timestamp <ISO8601_TIMESTAMP>
+# Example: --timestamp "2025-04-29T12:00:00.000Z"
+```
+
+## Start a stopped database
+
+```bash
+oci db autonomous-database start \
+  --autonomous-database-id <ADB_OCID>
+
+# Poll for AVAILABLE state
+oci db autonomous-database get \
+  --autonomous-database-id <ADB_OCID> \
+  --query "data.\"lifecycle-state\""
+```
+
+## Scale CPU down (if over-provisioned)
+
+```bash
+oci db autonomous-database update \
+  --autonomous-database-id <ADB_OCID> \
+  --ocpu-count <TARGET_COUNT>
+# Note: storage cannot be scaled down — only CPU is reversible
+```
+
+## Rollback limitations
+
+- **Termination is permanent** — no recovery path exists after an ADB is terminated.
+- **Storage scale-up is irreversible** — OCI does not shrink ADB storage after an increase.
+- Point-in-time restore is available only within the automatic backup retention window (default: 60 days).
+- Connection wallet files generated for the new ADB (after clone) are not interchangeable with the source ADB wallet.

package/skills/oci/oci-live-cost-budget-runaway-guard/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: oci-live-cost-budget-runaway-guard
+description: Gate OCI budget mutations and GPU/HPC shape provisioning against compartment spend limits, with inventory searches, quota audits, and emergency spend-stop playbooks.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# OCI Live Cost Budget Runaway Guard
+
+## Purpose
+
+Act as the guarded live OCI operator for oci-live-cost-budget-runaway-guard work. Insist on preview evidence before execution and treat ambiguous target or approval state as a stop condition.
+
+## When to use
+
+Use this skill when:
+
+- an OCI budget rule threshold or alert must be modified for a tenancy or compartment
+- a GPU or HPC shape provisioning request requires spend-limit approval before creating
+- a runaway GPU cost event is detected and emergency quota reduction or instance stop is needed
+
+## Lean operating rules
+
+- Prefer OCI CLI (`oci`) official documentation when available; fall back to Oracle Cloud docs and sanitized user evidence.
+- Do not execute a live OCI change until tenancy, compartment, active principal, and resource ownership are explicit.
+- Prefer plan, detect-drift, inspect, read, describe, and rollback evidence before execution.
+- If the request skips preview or rollback design, push back.
+- Never print secrets, API keys, tenancy OCIDs, private key contents, or raw config values. Summarize sanitized evidence only.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Preflight commands](references/preflight-commands.md) — OCI CLI commands to run before any mutation.
+- [Rollback playbook](references/rollback-playbook.md) — concrete rollback steps for this service.
+- [Permission model](references/permission-model.md) — OCI IAM policy statements and dynamic group guidance.
+- [Official sources](references/official-sources.md) — authoritative OCI documentation links.
+
+## Response minimum
+
+Return, at minimum:
+
+- confirmed tenancy, compartment, and active principal
+- preflight evidence (plan output, drift result, inspect/read, health check)
+- approval status for the proposed mutation
+- rollback posture or explicit statement of what cannot be rolled back
+- post-action verification steps or refusal reason

package/skills/oci/oci-live-cost-budget-runaway-guard/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "oci-live-cost-budget-runaway-guard",
+  "name": "OCI Live Cost Budget Runaway Guard",
+  "type": "skill",
+  "provider": "oci",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Gate OCI budget mutations and GPU/HPC shape provisioning against compartment spend limits, with inventory searches, quota audits, and emergency spend-stop playbooks.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.oracle.com/en-us/iaas/Content/Billing/Tasks/managingbudgets.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/managinginstances.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Tagging/Tasks/managingtagsandtagnamespaces.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/General/Concepts/resourcequotas.htm"
+  ],
+  "security_notes": "GPU/HPC shapes (BM.GPU4.8, A100, BM.HPC2.36) can generate six-figure monthly costs when left running. Never approve quota increases or budget threshold raises without explicit financial-authority approval. Emergency stop requires Compute operator rights \u2014 escalate if not held.",
+  "last_verified": "2026-04-30",
+  "path": "skills/oci/oci-live-cost-budget-runaway-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/oci/oci-live-cost-budget-runaway-guard/references/official-sources.md

@@ -0,0 +1,17 @@
+# Official Sources: OCI Live Cost Budget Runaway Guard
+
+## OCI Budgets and cost management
+
+- https://docs.oracle.com/en-us/iaas/Content/Billing/Concepts/budgetsoverview.htm
+- https://docs.oracle.com/en-us/iaas/Content/Billing/Tasks/managingbudgets.htm
+- https://docs.oracle.com/en-us/iaas/Content/Billing/Tasks/managingalertrules.htm
+
+## OCI Quotas
+
+- https://docs.oracle.com/en-us/iaas/Content/Quotas/Concepts/quotasoverview.htm
+- https://docs.oracle.com/en-us/iaas/Content/Quotas/Tasks/managingquotas.htm
+
+## Source-grounding rule
+
+Use official Oracle Cloud Infrastructure documentation as the source of truth.
+Budget behavior and alert rule mechanics must be verified against current OCI docs.

package/skills/oci/oci-live-cost-budget-runaway-guard/references/permission-model.md

@@ -0,0 +1,59 @@
+# Permission Model: OCI Live Cost Budget Runaway Guard
+
+## 3-tier separation
+
+| Tier | Group | Verb | Scope |
+|------|-------|------|-------|
+| Audit | `<cost-auditors>` | inspect / read | tenancy |
+| Operator | `<cost-operators>` | use | tenancy / compartment |
+| Admin | `<cost-admins>` | manage | tenancy |
+
+## Budget read (audit — no mutation)
+
+```
+Allow group <cost-auditors> to inspect usage-budgets in tenancy
+Allow group <cost-auditors> to read usage-budgets in tenancy
+Allow group <cost-auditors> to inspect costs in tenancy
+Allow group <cost-auditors> to read costs in tenancy
+```
+
+## Budget write (manage — budgets are tenancy-scoped resources)
+
+```
+Allow group <cost-admins> to manage usage-budgets in tenancy
+```
+
+## Quota inspection and resource search
+
+```
+Allow group <cost-admins> to inspect quota in tenancy
+Allow group <cost-admins> to read quota in tenancy
+Allow group <cost-admins> to use resource-search in tenancy
+```
+
+## Cost operators (middle tier — adjust budgets, cannot delete)
+
+`use usage-budgets` permits update + alert rule changes. It does NOT permit
+budget creation or deletion — those remain with `<cost-admins>`.
+
+```
+Allow group <cost-operators> to use usage-budgets in tenancy
+Allow group <cost-operators> to read costs in tenancy
+Allow group <cost-operators> to use ons-topics in compartment <cost-alerts-compartment>
+```
+
+## GPU/HPC shape gate via compartment quota
+
+```
+set compute-core-count quota gpu-vm-count to 0 in compartment <default-compute>
+```
+
+This physically prevents GPU shape provisioning without a quota increase — a harder gate than IAM deny policies.
+
+## Do not use
+
+```
+# FORBIDDEN
+Allow group <cost-admins> to manage all-resources in tenancy
+Allow group <cost-admins> to manage compute-instances in tenancy
+```

package/skills/oci/oci-live-cost-budget-runaway-guard/references/preflight-commands.md

@@ -0,0 +1,42 @@
+# Preflight Commands: OCI Live Cost Budget Runaway Guard
+
+Run these before any budget modification. Paste sanitized output as evidence.
+
+## 1. Confirm identity and tenancy target
+
+```bash
+oci iam region-subscription list --query "data[].{homeRegion:\"is-home-region\",regionName:\"region-name\"}"
+oci budgets budget list --compartment-id <TENANCY_OCID> \
+  --query "data[].{displayName:\"display-name\",amount:amount,actualSpend:\"actual-spend\",forecastedSpend:\"forecasted-spend\",lifecycleState:\"lifecycle-state\"}"
+```
+
+## 2. Inspect a specific budget
+
+```bash
+oci budgets budget get --budget-id <BUDGET_OCID> \
+  --query "data.{displayName:\"display-name\",amount:amount,actualSpend:\"actual-spend\",percentUsed:\"percent-used\",alertRuleCount:\"alert-rule-count\",targets:targets}"
+```
+
+## 3. List alert rules on the budget
+
+```bash
+oci budgets alert-rule list --budget-id <BUDGET_OCID> \
+  --query "data[].{displayName:\"display-name\",type:type,threshold:threshold,thresholdType:\"threshold-type\",recipients:recipients}"
+```
+
+## 4. Check current compute shape usage against quota
+
+```bash
+oci limits resource-availability get \
+  --service-name compute \
+  --limit-name standard-e4-core-count \
+  --compartment-id <COMPARTMENT_OCID> \
+  --availability-domain <AD>
+```
+
+## 5. Verify ONS topic is active (for alert routing)
+
+```bash
+oci ons topic get --topic-id <TOPIC_OCID> \
+  --query "data.{displayName:\"display-name\",lifecycleState:\"lifecycle-state\"}"
+```

package/skills/oci/oci-live-cost-budget-runaway-guard/references/rollback-playbook.md

@@ -0,0 +1,44 @@
+# Rollback Playbook: OCI Live Cost Budget Runaway Guard
+
+## Revert a budget threshold change
+
+```bash
+# Re-apply original budget amount
+oci budgets budget update \
+  --budget-id <BUDGET_OCID> \
+  --amount <ORIGINAL_AMOUNT>
+```
+
+## Remove a runaway alert rule
+
+```bash
+# List current alert rules
+oci budgets alert-rule list --budget-id <BUDGET_OCID> \
+  --query "data[].{id:id,displayName:\"display-name\",threshold:threshold}"
+
+# Delete a specific alert rule
+oci budgets alert-rule delete \
+  --budget-id <BUDGET_OCID> \
+  --alert-rule-id <RULE_OCID> \
+  --force
+```
+
+## Restore previous alert rule configuration
+
+```bash
+oci budgets alert-rule create \
+  --budget-id <BUDGET_OCID> \
+  --display-name <NAME> \
+  --type <ACTUAL|FORECAST> \
+  --threshold <VALUE> \
+  --threshold-type <PERCENTAGE|ABSOLUTE> \
+  --recipients <EMAIL> \
+  --message "Budget threshold reached"
+```
+
+## Rollback limitations
+
+- Spend that already occurred before the budget alert triggered cannot be reversed.
+- Deleting a budget does NOT stop any running compute instances — it only removes the alert.
+- Compartment quota reductions (setting `gpu-vm-count to 0`) take effect immediately but do not terminate existing instances.
+- OCI does not auto-stop resources when budget limits are hit — only notifications are sent.

package/skills/oci/oci-live-iam-policy-compartment-guard/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: oci-live-iam-policy-compartment-guard
+description: Guard OCI IAM policy writes and dynamic group changes with verb-hierarchy audit, compartment scope enforcement, anti-pattern detection (any-user/any-group), and rollback via statement restore.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# OCI Live IAM Policy Compartment Guard
+
+## Purpose
+
+Act as the guarded live OCI operator for oci-live-iam-policy-compartment-guard work. Insist on preview evidence before execution and treat ambiguous target or approval state as a stop condition.
+
+## When to use
+
+Use this skill when:
+
+- an OCI IAM policy must be created or modified in a compartment or at tenancy root
+- a dynamic group rule must be changed and blast-radius must be audited before write
+- an IAM audit finds overly broad policies that must be narrowed with least-privilege verb selection
+
+## Lean operating rules
+
+- Prefer OCI CLI (`oci`) official documentation when available; fall back to Oracle Cloud docs and sanitized user evidence.
+- Do not execute a live OCI change until tenancy, compartment, active principal, and resource ownership are explicit.
+- Prefer plan, detect-drift, inspect, read, describe, and rollback evidence before execution.
+- If the request skips preview or rollback design, push back.
+- Never print secrets, API keys, tenancy OCIDs, private key contents, or raw config values. Summarize sanitized evidence only.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Preflight commands](references/preflight-commands.md) — OCI CLI commands to run before any mutation.
+- [Rollback playbook](references/rollback-playbook.md) — concrete rollback steps for this service.
+- [Permission model](references/permission-model.md) — OCI IAM policy statements and dynamic group guidance.
+- [Official sources](references/official-sources.md) — authoritative OCI documentation links.
+
+## Response minimum
+
+Return, at minimum:
+
+- confirmed tenancy, compartment, and active principal
+- preflight evidence (plan output, drift result, inspect/read, health check)
+- approval status for the proposed mutation
+- rollback posture or explicit statement of what cannot be rolled back
+- post-action verification steps or refusal reason

package/skills/oci/oci-live-iam-policy-compartment-guard/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "oci-live-iam-policy-compartment-guard",
+  "name": "OCI Live IAM Policy Compartment Guard",
+  "type": "skill",
+  "provider": "oci",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Guard OCI IAM policy writes and dynamic group changes with verb-hierarchy audit, compartment scope enforcement, anti-pattern detection (any-user/any-group), and rollback via statement restore.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policysyntax.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/iampolicyreference.htm"
+  ],
+  "security_notes": "Any-user and any-group policies in tenancy root are the most common OCI security misconfiguration. Never approve manage-verb policies at tenancy scope without compartment scoping. Policy deletes take effect immediately with no grace period.",
+  "last_verified": "2026-04-30",
+  "path": "skills/oci/oci-live-iam-policy-compartment-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/oci/oci-live-iam-policy-compartment-guard/references/official-sources.md

@@ -0,0 +1,13 @@
+# Official Sources: OCI Live IAM Policy Compartment Guard
+
+## OCI IAM policies
+
+- https://docs.oracle.com/en-us/iaas/Content/Identity/policiesgs/get-started-with-policies.htm
+- https://docs.oracle.com/en-us/iaas/Content/Identity/policieshow/Policy_How_Policies_Work.htm
+- https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/policyreference.htm
+- https://docs.oracle.com/en-us/iaas/Content/Identity/dynamicgroups/managingdynamicgroups.htm
+
+## Source-grounding rule
+
+Use official Oracle Cloud Infrastructure documentation as the source of truth for IAM policy syntax.
+OCI policy-based IAM does not use JSON like AWS — verify statement syntax against OCI policy reference.

package/skills/oci/oci-live-iam-policy-compartment-guard/references/permission-model.md

@@ -0,0 +1,71 @@
+# Permission Model: OCI Live IAM Policy Compartment Guard
+
+## OCI verb hierarchy
+
+```
+inspect  = ListXxx APIs only. No resource content.
+read     = GetXxx + inspect. Can see resource details.
+use      = read + limited mutation (no create/terminate).
+manage   = full CRUD. Always scope to compartment, never tenancy for broad resources.
+```
+
+## 3-tier separation
+
+| Tier | Group | Scope | Activation |
+|------|-------|-------|-----------|
+| Auditor | `<iam-auditors>` | tenancy (read-only) | Standing |
+| Operator | `<iam-operators>` | compartment + name pattern | Standing (restricted) |
+| Tenancy-root admin | `<iam-tenancy-admins>` | tenancy | Break-glass only, MFA-TOTP gated |
+
+## Audit-only policy
+
+```
+Allow group <iam-auditors> to inspect policies in tenancy
+Allow group <iam-auditors> to read policies in tenancy
+Allow group <iam-auditors> to inspect dynamic-groups in tenancy
+Allow group <iam-auditors> to read dynamic-groups in tenancy
+Allow group <iam-auditors> to inspect groups in tenancy
+Allow group <iam-auditors> to read users in tenancy
+```
+
+## Policy operator (compartment-scoped, name-pattern restricted)
+
+```
+Allow group <iam-operators> to manage policies in compartment <iam-compartment>
+  where target.policy.name = /iam-managed-*/
+Allow group <iam-operators> to manage dynamic-groups in tenancy
+  where target.dynamicGroup.name = /iam-managed-*/
+```
+
+`dynamic-groups` are tenancy-scoped in OCI — compartment scope is not supported. The
+`where target.dynamicGroup.name = /iam-managed-*/` name-pattern condition prevents
+privilege escalation through creation of an unrestricted dynamic group.
+
+**Critical syntax**: OCI IAM uses **forward-slash regex** `/pattern*/`, **not** quoted strings,
+for wildcard matching. `= 'iam-managed-*'` would only match the literal string
+`iam-managed-*` (one specific name with a literal asterisk) — the operator could
+create any other dynamic group and bypass the guard entirely. Always use `/.../`
+slashes for pattern conditions. Reference: Oracle policy conditions docs at
+`https://docs.oracle.com/en-us/iaas/Content/Identity/policysyntax/conditions.htm`.
+
+## Tenancy-root admin (break-glass only, MFA-TOTP gated)
+
+```
+Allow group <iam-tenancy-admins> to manage policies in tenancy
+  where request.user.mfaTotpVerified = 'true'
+Allow group <iam-tenancy-admins> to manage groups in tenancy
+  where target.group.name != 'Administrators'
+```
+
+- MFA-TOTP gate is enforced at policy-evaluation time, not just login.
+- Cannot modify the `Administrators` group — requires the bootstrap tenancy admin.
+- Membership must be empty by default; add only during an approved change window.
+
+## Do not use
+
+```
+# FORBIDDEN
+Allow any-group to manage policies in tenancy
+Allow group <iam-operators> to manage policies in tenancy
+Allow any-user to inspect all-resources in tenancy
+```

package/skills/oci/oci-live-iam-policy-compartment-guard/references/preflight-commands.md

@@ -0,0 +1,49 @@
+# Preflight Commands: OCI Live IAM Policy Compartment Guard
+
+Run these before any IAM policy modification. Paste sanitized output as evidence.
+
+## 1. Confirm identity and tenancy
+
+```bash
+oci iam user list --query "data[?contains(\"defined-tags\".keys(@), 'Operations')].{name:name,id:id}" 2>/dev/null | head -20
+# Or check active session
+oci iam region-subscription list
+```
+
+## 2. List policies in target compartment
+
+```bash
+oci iam policy list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --query "data[].{id:id,name:name,lifecycleState:\"lifecycle-state\",statements:statements}"
+```
+
+## 3. Inspect a specific policy
+
+```bash
+oci iam policy get --policy-id <POLICY_OCID> \
+  --query "data.{name:name,statements:statements,versionDate:\"version-date\",freeformTags:\"freeform-tags\"}"
+```
+
+## 4. List dynamic groups and their matching rules
+
+```bash
+oci iam dynamic-group list \
+  --query "data[].{name:name,id:id,matchingRule:\"matching-rule\",lifecycleState:\"lifecycle-state\"}"
+```
+
+## 5. Audit recent policy changes (Activity log)
+
+```bash
+oci audit event list \
+  --compartment-id <TENANCY_OCID> \
+  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
+  --query "data[?\"event-type\"=='com.oraclecloud.identitycontrolplane.updatepolicy'].{time:\"event-time\",user:data.\"request.headers\".\"opc-principal\"[0],policyId:data.\"request.path\"}"
+```
+
+## 6. Check for overly broad existing policies (anti-pattern scan)
+
+```bash
+oci iam policy list --compartment-id <TENANCY_OCID> --all \
+  --query "data[?contains(to_string(statements), 'manage all-resources') || contains(to_string(statements), 'any-user')].{name:name,statements:statements}"
+```

package/skills/oci/oci-live-iam-policy-compartment-guard/references/rollback-playbook.md

@@ -0,0 +1,62 @@
+# Rollback Playbook: OCI Live IAM Policy Compartment Guard
+
+## Revert to a previous policy version
+
+OCI does not natively version policies, but you can restore from the prior statements.
+
+```bash
+# Get current policy statements
+oci iam policy get --policy-id <POLICY_OCID> --query "data.statements"
+
+# Update the policy with the previous statements
+oci iam policy update \
+  --policy-id <POLICY_OCID> \
+  --statements '["Allow group <previous-group> to <verb> <resource> in <scope>", ...]' \
+  --version-date $(date +%Y-%m-%d) \
+  --force
+```
+
+## Delete an accidentally created policy
+
+> ⚠️ **IRREVERSIBILITY WARNING — IAM blast radius**
+>
+> Deleting an IAM policy is **immediate** (eventual consistency: 10–30 seconds globally) and
+> may revoke access to running production workloads before any operator can react.
+> The `--force` flag below suppresses the OCI CLI's interactive confirmation prompt.
+>
+> **Required pre-delete confirmation steps** — do not skip:
+>
+> 1. Run `oci iam policy get --policy-id <POLICY_OCID>` and inspect the statements.
+> 2. Confirm the displayed `name` and `compartment-id` match the policy you intend to delete.
+> 3. Confirm in writing (chat, ticket, change record) that the policy is not in active use:
+>    `oci search resource structured-search --query-text "query policy resources where compartmentId = '<compartment>'"`
+> 4. If unsure, prefer `oci iam policy update` to empty the `statements` array first
+>    (reversible) before issuing the `delete` command.
+>
+> Only after all four steps are complete should the `delete --force` command be executed.
+
+```bash
+# Step 1: Confirm the target policy
+oci iam policy get --policy-id <POLICY_OCID> --query "data.{name:name,compartment:\"compartment-id\",statements:statements}"
+
+# Step 2: Only after operator confirmation — delete
+oci iam policy delete --policy-id <POLICY_OCID> --force
+```
+
+## Remove a group member added by mistake (privilege de-escalation)
+
+```bash
+# Find the user's group membership
+oci iam group list-users --group-id <GROUP_OCID> \
+  --query "data[?name=='<USERNAME>'].id"
+
+# Remove from group
+oci iam group remove-user --group-id <GROUP_OCID> --user-id <USER_OCID>
+```
+
+## Rollback limitations
+
+- OCI IAM has eventual consistency — policy changes may take up to 10–30 seconds to propagate globally.
+- There is no automated version history for policies — maintain external backups of policy statements.
+- Removing a policy statement may immediately break running workloads that depend on that grant.
+- Break-glass tenancy-root admin changes require emptying the `<iam-tenancy-admins>` group immediately after use.

package/skills/oci/oci-live-network-security-rule-guard/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: oci-live-network-security-rule-guard
+description: Guard live OCI Security List and Network Security Group (NSG) rule changes with current-state capture, open-internet and sensitive-port detection, stateful/stateless assessment, and explicit approval before ingress or egress rule mutation. Use only when an intentional network rule change targets a confirmed VCN component.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# OCI Live Network Security Rule Guard
+
+## Purpose
+
+Act as the guarded live OCI operator for oci-live-network-security-rule-guard work. Security List and NSG rule changes take effect immediately with no native rollback. A wrong ingress rule exposes databases or compute to the internet instantly; a wrong egress rule can black-hole traffic for entire subnets. Treat every rule mutation as irreversible until the previous state is explicitly captured and restoration is confirmed possible.
+
+## When to use
+
+Use this skill when:
+
+- an ingress or egress rule must be added, modified, or removed from an OCI Security List or NSG in a live VCN
+- a network access audit finds over-broad CIDR blocks (`0.0.0.0/0`) or sensitive-port exposures that must be tightened
+- a workload migration requires opening or closing ports and the blast radius must be confirmed before write
+
+## Lean operating rules
+
+- Prefer OCI CLI (`oci`) official documentation when available; fall back to Oracle Cloud docs and sanitized user evidence.
+- Do not execute any Security List or NSG rule mutation until tenancy, compartment, VCN OCID, target Security List or NSG OCID, and exact rule change are all explicit.
+- Capture the complete current rule set (`oci network security-list get` or `oci network nsg rules list`) as rollback evidence before any write.
+- Flag the following as high-severity and require explicit justification before proceeding:
+  - Any ingress rule with source `0.0.0.0/0` (open to internet)
+  - Any egress rule with destination `0.0.0.0/0` and protocol `all` without restriction
+  - Rules permitting port 22 (SSH), 3389 (RDP), 1521/1522 (Oracle DB), 3306 (MySQL), 5432 (PostgreSQL) from `0.0.0.0/0`
+  - Stateless rules on subnets hosting databases or internal APIs (no connection tracking = asymmetric traffic risk)
+  - Changes to Security Lists attached to database subnets (Autonomous DB, Exadata, DB System)
+- If the request skips current-state capture, CIDR scope confirmation, or subnet-criticality assessment, push back.
+- Never print API signing keys, auth tokens, tenancy OCIDs, or instance credentials. Summarize sanitized evidence only.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Preflight commands](references/preflight-commands.md) — OCI CLI commands to inspect current rules and capture rollback state before any mutation.
+- [Rollback playbook](references/rollback-playbook.md) — how to restore a previous Security List or NSG rule set after a bad change.
+- [Permission model](references/permission-model.md) — least-privilege IAM policy for network rule mutation and read-only audit.
+- [Official sources](references/official-sources.md) — authoritative OCI documentation links.
+
+## Response minimum
+
+Return, at minimum:
+
+- confirmed tenancy, compartment, VCN, and target Security List or NSG OCID
+- current rule set capture (rollback baseline)
+- risk classification of the proposed rule (open-internet / sensitive-port / safe)
+- stateful vs stateless assessment and subnet criticality
+- approval status with explicit business justification
+- rollback command to restore prior rule state
+- post-change connectivity verification steps or refusal reason

package/skills/oci/oci-live-network-security-rule-guard/metadata.json

@@ -0,0 +1,28 @@
+{
+  "id": "oci-live-network-security-rule-guard",
+  "name": "OCI Live Network Security Rule Guard",
+  "type": "skill",
+  "provider": "oci",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Guard live OCI Security List and NSG rule changes with current-state capture, open-internet and sensitive-port detection, stateful/stateless assessment, and explicit approval before ingress or egress mutation.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/manage-nsg-security-rules.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/update-securitylist.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/path_analyzer.htm"
+  ],
+  "security_notes": "oci network security-list update is a full replace — always capture the complete current rule set before writing. Never approve 0.0.0.0/0 ingress rules on database subnets. Prefer NSGs over Security Lists for production database VNICs to minimize blast radius. Enable VCN Flow Logs before any rule change for forensic coverage.",
+  "last_verified": "2026-05-01",
+  "path": "skills/oci/oci-live-network-security-rule-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}