@raishin/vanguard-frontier-agentic 1.2.0 → 1.4.0

package/skills/aws/aws-cost-optimization-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-cost-optimization-governor
 description: Review AWS cost optimization and FinOps posture across Cost Explorer, Budgets, Cost Optimization Hub, Compute Optimizer, Savings Plans, Reserved Instances, tagging, showback, idle resources, rightsizing, storage, data transfer, and forecast risk. Use when the user asks to reduce or explain AWS cost.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: finops
 ---
 
 # AWS Cost Optimization Governor

package/skills/aws/aws-daily-operations-briefing-coordinator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-daily-operations-briefing-coordinator
 description: Prepare AWS daily operations briefings using CloudWatch, Personal Health Dashboard, Trusted Advisor, cost signals, deployment timelines, incidents, risks, and action backlog. Prefer this for non-destructive business and engineering status coordination; prefer observability, cost, or incident skills for deeper domain investigation.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # AWS Daily Operations Briefing Coordinator

package/skills/aws/aws-data-protection-backup-steward/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-data-protection-backup-steward
 description: Review AWS backup and data protection implementation across AWS Backup, EBS/RDS/EFS/S3 recovery patterns, vaults, vault lock, retention, encryption, cross-account/cross-Region copy, restore testing, lifecycle, and recovery evidence. Prefer resilience BCDR review for broader RTO/RPO, failover, and business continuity design.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: resilience
 ---
 
 # AWS Data Protection Backup Steward

package/skills/aws/aws-deployment-hotfix-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-deployment-hotfix-operator
 description: Patch AWS deployment hotfix config, release parameters, manifest mistakes, environment drift, rollback blockers, and rollout blockers in-repo. Use for rapid non-destructive deployment corrections; do not use for live deploy/apply/destroy actions.
+allowed-tools: Read Edit Write MultiEdit Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Deployment Hotfix Operator

package/skills/aws/aws-devops-agent-skill-designer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-devops-agent-skill-designer
 description: Design, review, and improve AWS DevOps Agent-compatible skills, investigation workflows, learned skills, tool-use best practices, agent type targeting, frontmatter descriptions, reference materials, and operational output contracts. Use when creating or adapting skills for AWS DevOps Agent or AWS-style incident agents.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS DevOps Agent Skill Designer

package/skills/aws/aws-dynamodb-data-modeling-performance-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-dynamodb-data-modeling-performance-review
 description: Review Amazon DynamoDB data modeling and performance across access patterns, partition keys, sort keys, secondary indexes, GSI/LSI design, hot partitions, query versus scan behavior, capacity mode, adaptive capacity, global tables, TTL, DAX, item size, transactions, and cost. Use when DynamoDB correctness, latency, scaling, or cost depends on table design.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: data
 ---
 
 # AWS DynamoDB Data Modeling Performance Review

package/skills/aws/aws-ec2-compute-operations-steward/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-ec2-compute-operations-steward
 description: Review Amazon EC2 compute operations across instances, Auto Scaling groups, Launch Templates, AMIs, Systems Manager, Patch Manager, Session Manager, EBS volumes, snapshots, health checks, instance refresh, lifecycle hooks, patch compliance, and fleet reliability. Use for EC2 day-2 operations and legacy workload stewardship.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # AWS EC2 Compute Operations Steward

package/skills/aws/aws-ecs-fargate-platform-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-ecs-fargate-platform-operator
 description: Review Amazon ECS and Fargate platform operations across services, task definitions, task roles, execution roles, capacity providers, load balancers, deployment circuit breakers, blue/green, autoscaling, health checks, logs, secrets, networking, and rollback. Use only for ECS/Fargate; prefer EKS operator for Kubernetes.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # AWS ECS Fargate Platform Operator

package/skills/aws/aws-ecs-service-remediation-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-ecs-service-remediation-operator
 description: Correct AWS ECS and Fargate service definitions, task definition config, deployment parameters, health checks, environment settings, and rollout wiring in-repo. Use for non-destructive repo fixes only; do not force deployments or mutate live services from this role.
+allowed-tools: Read Edit Write MultiEdit Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # AWS ECS Service Remediation Operator

package/skills/aws/aws-eks-platform-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-eks-platform-operator
 description: Review Amazon EKS Kubernetes platform operations across cluster access, IRSA, IAM roles for service accounts, pod identity, node groups, Karpenter, autoscaling, CNI/network policy, upgrades, reliability, observability, and cost. Use only for EKS/Kubernetes; prefer ECS/Fargate operator for ECS services.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # AWS EKS Platform Operator

package/skills/aws/aws-event-driven-architecture-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-event-driven-architecture-review
 description: Review AWS event-driven system design across EventBridge, event buses, Pipes, SQS, SNS, Step Functions, event schemas, filtering, cross-account routing, retries, DLQs, replay, idempotency, monitoring, and event-loop risk. Prefer serverless production readiness for Lambda runtime/deployment readiness.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # AWS Event Driven Architecture Review

package/skills/aws/aws-generative-ai-developer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-generative-ai-developer
 description: Build Amazon Bedrock and serverless generative AI applications using Lambda, API Gateway, Step Functions, EventBridge, S3, DynamoDB, SQS, Guardrails, and IAM. Prefer this for serverless GenAI app design and implementation; prefer aws-agentcore for AgentCore runtime, aws-bedrock-agent-security-governor for deep Bedrock security, and aws-serverless-production-readiness for final operational hardening.
+allowed-tools: Read Edit Write MultiEdit Grep Glob Bash
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # AWS Generative AI Developer

package/skills/aws/aws-iac-change-safety-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-iac-change-safety-review
 description: Review AWS infrastructure-as-code changes across CDK, CloudFormation, SAM, Terraform, Serverless Framework, generated templates, plans, stack updates, change sets, and drift. Use when the user asks whether an AWS IaC deployment is safe, what a change set will do, why a resource replacement will happen, or how to validate before production.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS IaC Change Safety Review

package/skills/aws/aws-iac-patch-executor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-iac-patch-executor
 description: Edit AWS IaC files including CloudFormation, SAM, CDK config, and Terraform to patch defects, prepare change set review, or unblock rollout work. Prefer this for bounded repo changes only; do not use for apply, deploy, or destructive infrastructure execution.
+allowed-tools: Read Edit Write MultiEdit Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS IaC Patch Executor

package/skills/aws/aws-iam-least-privilege-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-iam-least-privilege-review
 description: Review AWS IAM identity policies, trust policies, resource policies, permission boundaries, SCPs, session policies, role design, pass-role, federation, and Access Analyzer findings for least-privilege risk. Prefer KMS/secrets steward for key/secret lifecycle design and S3 perimeter governor for S3 exposure/data-perimeter posture unless the request is primarily policy surgery.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # AWS IAM Least Privilege Review

package/skills/aws/aws-kms-secrets-lifecycle-steward/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-kms-secrets-lifecycle-steward
 description: Review AWS KMS and Secrets Manager lifecycle posture across key policies, grants, rotation, multi-Region keys, imported key material, aliases, secret rotation, replication, caching, endpoint conditions, recovery, and break-glass access. Prefer this for cryptography/secret lifecycle; prefer IAM skill for general permissions review.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # AWS KMS Secrets Lifecycle Steward

package/skills/aws/aws-landing-zone-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-landing-zone-governor
 description: Review and design AWS landing zones, AWS Control Tower environments, Organizations structures, OUs, account vending patterns, guardrails, central logging, security/audit accounts, and multi-account governance. Use when the user asks how to structure AWS accounts or govern a cloud estate.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: compliance
 ---
 
 # AWS Landing Zone Governor

package/skills/aws/aws-live-deployment-guarded-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-live-deployment-guarded-operator
 description: Operate guarded live AWS deployment changes with explicit account, region, profile, approval, dry-run, rollback, and verification gates. Use only when the target environment is confirmed and a live deployment action is intentionally requested.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Live Deployment Guarded Operator

package/skills/aws/aws-live-ecs-rollout-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-live-ecs-rollout-guard
 description: Guard live Amazon ECS and Fargate rollout actions with ecs service, task definition, deployment circuit breaker, alarms, rollback, health check, and approval gates. Use only for intentional live ECS rollout actions against confirmed targets.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Live ECS Rollout Guard

package/skills/aws/aws-live-iac-change-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-live-iac-change-guard
 description: Guard live CloudFormation, SAM, CDK, and Terraform-backed AWS infrastructure changes with change set, drift, stack policy, rollback trigger, approval, and execute gates. Use only for intentional live IaC execution with confirmed targets.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Live IaC Change Guard

package/skills/aws/aws-live-pipeline-approval-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-live-pipeline-approval-operator
 description: Handle live CodePipeline approval and gated resume decisions with pipeline, stage, approver, SNS, approval, blast radius, and rollback checks. Use only when a real pipeline execution is paused or about to be approved.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Live Pipeline Approval Operator

package/skills/aws/aws-live-serverless-release-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-live-serverless-release-guard
 description: Guard live Lambda and serverless release actions with lambda alias, codedeploy, canary, linear, alarms, rollback, and approval gates. Use only for intentional live serverless rollout actions against confirmed targets.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Live Serverless Release Guard

package/skills/aws/aws-maestro/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-maestro
 description: Route AWS tasks to the narrowest specialist or team of specialists from the 42-agent catalog. Use when you do not already know the specialist. Not for direct AWS answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live deployment or production-change specialist.
+allowed-tools: Agent Skill Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # AWS Maestro — Routing Skill

package/skills/aws/aws-maestro/references/workflow-and-output.md

@@ -10,6 +10,7 @@ Use this reference when classifying a task or selecting the right specialist(s).
 | `compute` | EC2, ECS, Fargate, EKS, Lambda, serverless, container, pod, fleet, autoscaling, AMI, launch template, capacity reservation, spot, deployment rollout, hotfix |
 | `data` | RDS, Aurora, DynamoDB, S3, database, query performance, data modeling, index, backup, data perimeter, bucket policy, data protection, restore |
 | `security-iam` | IAM, policy, role, permission, SCP, KMS, key rotation, secrets, Secrets Manager, posture, GuardDuty, SecurityHub, compliance, evidence, Bedrock security |
+| `pki` | ACM PCA, AWS Private CA, aws-privateca-issuer, AWSPCAIssuer, AWSPCAClusterIssuer, certificate template ARN, CRL distribution, CRL S3, IRSA cert-manager, cross-account PCA, RAM-shared CA, SubordinateCACertificate, private certificate authority |
 | `cost` | cost, spend, billing, anomaly, savings plan, reserved instance, rightsizing, waste, budget |
 | `devops-cicd` | pipeline, CI/CD, CodePipeline, CodeBuild, GitHub Actions, IaC, CloudFormation, Terraform, CDK, patch, release engineer, deploy, rollback |
 | `operations` | observability, CloudWatch, X-Ray, incident, alert, runbook, triage, ticket, escalation, change impact, briefing, daily ops, non-destructive automation |
@@ -61,6 +62,7 @@ Use this reference when classifying a task or selecting the right specialist(s).
 | `aws-kms-secrets-lifecycle-steward-agent` | security-iam | Managing KMS key lifecycle, rotation policies, or Secrets Manager secret health |
 | `aws-security-posture-hardening-agent` | security-iam | Hardening AWS account posture: GuardDuty, SecurityHub, Config rules, and remediation |
 | `aws-compliance-evidence-mapper-agent` | security-iam | Mapping AWS controls to compliance frameworks (SOC 2, PCI, HIPAA, NIST) and gathering evidence |
+| `aws-private-ca-issuer-review-agent` | pki | Reviewing AWS ACM Private CA issuer config for cert-manager: CA hierarchy, template ARN scope, IRSA permissions, CRL reachability, and cross-account RAM-shared CA |
 
 ### Cost
 

package/skills/aws/aws-migration-cutover-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-migration-cutover-architect
 description: Plan, review, and de-risk AWS migrations and cutovers across discovery, dependency mapping, wave planning, AWS Application Migration Service, Migration Hub, test launches, acceptance tests, downtime windows, rollback, DNS, data consistency, and post-cutover validation. Use for migration planning and cutover readiness.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Migration Cutover Architect

package/skills/aws/aws-network-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-network-architect
 description: Design, review, and troubleshoot AWS network, hybrid, and multi-cloud connectivity across VPCs, Transit Gateway, Direct Connect, VPN, Cloud WAN, Route 53 Resolver, private DNS, CIDRs, route tables, endpoints, segmentation, ingress, egress, inspection, and failover. Prefer this for connectivity and routing; prefer API/edge, S3, or security skills for those specialized surfaces.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: networking
 ---
 
 # AWS Network Architect

package/skills/aws/aws-non-destructive-task-automation-advisor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-non-destructive-task-automation-advisor
 description: Design AWS non-destructive task automation using EventBridge, Step Functions, Lambda, Systems Manager Automation, SNS, SQS, approvals, notifications, reporting, and evidence gathering. Use only for read-only or coordination-safe automation; do not use for destructive remediation or mutation-heavy runbooks.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Non-Destructive Task Automation Advisor

package/skills/aws/aws-observability-incident-responder/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-observability-incident-responder
 description: Investigate broad AWS incidents and observability gaps using CloudWatch metrics, logs, alarms, traces, EventBridge events, service health, runbooks, timelines, blast radius, root-cause discipline, and post-incident actions. Prefer RDS/Aurora investigator for database-specific performance incidents.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # AWS Observability Incident Responder

package/skills/aws/aws-pipeline-fix-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-pipeline-fix-operator
 description: Repair AWS pipeline configuration, buildspecs, workflow files, deployment steps, artifact wiring, release guardrails, and CodeDeploy integration in-repo. Use for non-destructive CI/CD corrections; do not trigger live pipeline runs or mutate cloud state.
+allowed-tools: Read Edit Write MultiEdit Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Pipeline Fix Operator

package/skills/aws/aws-private-ca-issuer-review/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: aws-private-ca-issuer-review
+description: Use this skill when reviewing AWS ACM Private CA (Private Certificate Authority) issuer configurations for cert-manager. Trigger on any request to audit AWSPCAIssuer, AWSPCAClusterIssuer, IRSA policy for cert-manager, certificate template ARNs, CRL configuration, or cross-account PCA usage.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-05"
+  category: security
+---
+
+# AWS Private CA Issuer Review
+
+## Purpose
+
+Review AWS ACM Private Certificate Authority configurations used by the cert-manager `aws-privateca-issuer` plugin. Identify CA hierarchy misconfigurations, overly permissive certificate templates, excessive IRSA permissions, unsafe validity periods, CRL reachability gaps, and cross-account PCA setup risks.
+
+## Lean operating rules
+
+- Flag any `AWSPCAIssuer` referencing a ROOT CA ARN directly as CRITICAL — only a SUBORDINATE CA should be active for cert-manager issuance.
+- Check `spec.template.arn`: flag any SubordinateCACertificate template as CRITICAL (allows cert-manager to mint sub-CAs). Correct template is `EndEntityCertificate/V1`.
+- Review IRSA role policy: required actions are `acm-pca:IssueCertificate`, `acm-pca:GetCertificate`, `acm-pca:DescribeCertificateAuthority`. Flag `acm-pca:DeleteCertificateAuthority` or `acm-pca:CreateCertificateAuthority` as HIGH.
+- Review `spec.duration` in Certificate resources; flag durations > 365d for workload certs as MEDIUM; best practice is <= 90d.
+- Check CRL S3 bucket reachability from within the VPC; flag unreachable CRL distribution points as HIGH (revocation disabled).
+- For cross-account PCA (RAM-shared CA): verify minimum issuance-only permissions in the security account.
+- Label all claims as live evidence, documentation-based, or inference.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md)
+- [Safety checklist](references/safety-checklist.md)
+- [Official sources](references/official-sources.md)
+
+## Response minimum
+
+- Severity-labeled findings list (CRITICAL / HIGH / MEDIUM / LOW)
+- Evidence source for each finding
+- Specific resource name or field path
+- Recommended remediation with example policy or YAML snippet
+- Overall PKI trust posture verdict

package/skills/aws/aws-private-ca-issuer-review/metadata.json

@@ -0,0 +1,21 @@
+{
+  "id": "aws-private-ca-issuer-review",
+  "name": "AWS Private CA Issuer Review",
+  "type": "skill",
+  "provider": "aws",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Review AWS ACM Private Certificate Authority issuer configurations for cert-manager, covering CA hierarchy safety, certificate template ARN scope, IRSA permissions minimization, validity period alignment, CRL reachability, and cross-account PCA usage patterns.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html",
+    "https://github.com/cert-manager/aws-privateca-issuer",
+    "https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html",
+    "https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html",
+    "https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html"
+  ],
+  "security_notes": "Using a Root CA ARN in AWSPCAIssuer exposes the root of trust directly to cert-manager. A SubordinateCACertificate template allows cert-manager to issue intermediate CAs, enabling an attacker with cert-manager IRSA access to create a shadow CA trusted by the entire corporate PKI. IRSA role must exclude acm-pca:DeleteCertificateAuthority and acm-pca:CreateCertificateAuthority.",
+  "last_verified": "2026-05-02",
+  "path": "skills/aws/aws-private-ca-issuer-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/aws/aws-private-ca-issuer-review/references/official-sources.md

@@ -0,0 +1,22 @@
+# Official sources
+
+Use this reference only when you need source grounding for AWS Private CA behavior or the detailed source list.
+
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/privateca/latest/userguide/
+- https://docs.aws.amazon.com/privateca/latest/userguide/CT-CreateCertificate.html
+- https://docs.aws.amazon.com/privateca/latest/userguide/PcaIssueCert.html
+- https://docs.aws.amazon.com/privateca/latest/userguide/CT-IssueCertificate.html
+- https://docs.aws.amazon.com/privateca/latest/userguide/crl-planning.html
+- https://github.com/cert-manager/aws-privateca-issuer
+
+## cert-manager AWS PCA issuer plugin
+
+- https://cert-manager.io/docs/configuration/issuers/
+- https://github.com/cert-manager/aws-privateca-issuer/blob/main/pkg/api/v1beta1/types.go
+
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current PCA hierarchy, IRSA trust policy, CRL reachability, RAM share scope, or live cert-manager configuration. Prefer live AWS MCP/CLI evidence or sanitized user-provided YAML for current-state claims.

package/skills/aws/aws-private-ca-issuer-review/references/safety-checklist.md

@@ -0,0 +1,30 @@
+# Safety checklist
+
+Use this reference before any recommendations on cert-manager PKI configuration, IRSA policy changes, CA hierarchy decisions, or CRL distribution point design.
+
+## Non-negotiables
+
+- Never ask users to paste secrets, access keys, private keys, CA passwords, or PKCS#12 bundles into chat.
+- Prefer official AWS MCP tools or sanitized `kubectl get` / `aws acm-pca` CLI output for current-state evidence. Label the evidence level.
+- Do not invent CA ARNs, certificate template ARNs, IRSA role ARNs, or RAM resource share IDs.
+- Require explicit platform-team sign-off before any change that modifies a CA hierarchy, revokes a CA, or deletes a PCA CRL S3 bucket.
+- Keep IRSA permissions scoped to the minimum: `acm-pca:IssueCertificate`, `acm-pca:GetCertificate`, `acm-pca:DescribeCertificateAuthority`.
+
+## PKI attack vector: required awareness
+
+cert-manager with an `AWSPCAClusterIssuer` that has `acm-pca:IssueCertificate` via IRSA can issue certificates for any DNS name trusted by your internal PKI. A compromised cert-manager pod is equivalent to a compromised subordinate CA. Always review:
+- Which namespaces can request from this ClusterIssuer (CertificateRequestPolicy coverage)
+- Whether the CA certificate template allows sub-CA issuance (SubordinateCACertificate templates are CRITICAL)
+- Whether the certificate SAN validation enforces DNS name scope
+
+## Stress checks
+
+- Which workloads trust this CA chain — blast radius of CA compromise?
+- Can cert-manager request certificates for arbitrary SANs without CertificateRequestPolicy guard?
+- Is the CA ROOT or SUBORDINATE? (ROOT issuance is CRITICAL)
+- Is the CRL S3 bucket reachable from all pods that verify TLS using this CA?
+- Is cross-account RAM share scoped to specific organizational units?
+
+## Evidence labels
+
+Use `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's live AWS state.