@raishin/vanguard-frontier-agentic 1.2.0 → 1.4.0

package/skills/aws/aws-private-ca-issuer-review/references/workflow-and-output.md

@@ -0,0 +1,214 @@
+# Workflow and Output Contract
+
+## Review Workflow
+
+### Step 1 — Identify the issuer resource type
+
+Determine whether the configuration uses `AWSPCAIssuer` (namespace-scoped) or `AWSPCAClusterIssuer` (cluster-scoped):
+
+```bash
+kubectl get awspcaissuer -A
+kubectl get awspcaclusterissuer
+```
+
+Retrieve the issuer spec:
+
+```bash
+kubectl get awspcaissuer <name> -n <namespace> -o yaml
+kubectl get awspcaclusterissuer <name> -o yaml
+```
+
+Key fields to extract:
+- `spec.arn` — the CA ARN (must be a SUBORDINATE CA, not ROOT)
+- `spec.region` — AWS region of the CA
+- `spec.signingAlgorithm` — signing algorithm
+- `spec.template.arn` — certificate template ARN (controls what types of certs can be issued)
+
+### Step 2 — Validate CA ARN type
+
+Use the AWS CLI to confirm the CA type:
+
+```bash
+aws acm-pca describe-certificate-authority \
+  --certificate-authority-arn <arn> \
+  --query 'CertificateAuthority.Type' \
+  --output text
+```
+
+Expected output: `SUBORDINATE`
+
+If output is `ROOT` — this is a CRITICAL finding. cert-manager is directly wired to the root of trust.
+
+Also check CA status:
+```bash
+aws acm-pca describe-certificate-authority \
+  --certificate-authority-arn <arn> \
+  --query 'CertificateAuthority.Status' \
+  --output text
+```
+
+Expected: `ACTIVE`. If `DISABLED` or `DELETED`, the issuer will fail silently until the CA is restored.
+
+### Step 3 — Validate certificate template ARN
+
+The template ARN controls what type of certificate ACM PCA will issue. Common template ARNs:
+
+| Template ARN Suffix | Purpose | Risk |
+|---------------------|---------|------|
+| `EndEntityCertificate/V1` | Standard workload cert | Safe — correct choice |
+| `EndEntityClientAuthCertificate/V1` | Client auth cert | Safe for mTLS |
+| `SubordinateCACertificate_PathLen0/V1` | Subordinate CA cert | CRITICAL — allows sub-CA issuance |
+| `SubordinateCACertificate_PathLen1/V1` | Subordinate CA with chain | CRITICAL |
+| `RootCACertificate/V1` | Root CA cert | CRITICAL |
+
+Full ARN format:
+```
+arn:aws:acm-pca:::template/EndEntityCertificate/V1
+```
+
+If no template is specified in the issuer, PCA defaults to `EndEntityCertificate/V1` — verify this assumption against the actual ACM PCA issuance policy.
+
+### Step 4 — Review IRSA IAM role policy
+
+Retrieve the IAM role attached to the cert-manager ServiceAccount:
+
+```bash
+kubectl get serviceaccount cert-manager -n cert-manager -o jsonpath='{.metadata.annotations.eks\.amazonaws\.com/role-arn}'
+```
+
+Retrieve and review the role policy:
+
+```bash
+aws iam list-role-policies --role-name <role-name>
+aws iam get-role-policy --role-name <role-name> --policy-name <policy-name>
+```
+
+Minimum required IAM policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "acm-pca:IssueCertificate",
+        "acm-pca:GetCertificate",
+        "acm-pca:DescribeCertificateAuthority"
+      ],
+      "Resource": "arn:aws:acm-pca:<region>:<account>:certificate-authority/<ca-id>"
+    }
+  ]
+}
+```
+
+**Flag as HIGH if the policy includes any of:**
+- `acm-pca:DeleteCertificateAuthority`
+- `acm-pca:CreateCertificateAuthority`
+- `acm-pca:UpdateCertificateAuthority`
+- `acm-pca:RestoreCertificateAuthority`
+- `acm-pca:*` (wildcard)
+- Resource set to `*` instead of scoped CA ARN
+
+### Step 5 — Review Certificate validity periods
+
+List all cert-manager Certificate resources and their durations:
+
+```bash
+kubectl get certificate -A -o custom-columns=\
+NAMESPACE:.metadata.namespace,\
+NAME:.metadata.name,\
+DURATION:.spec.duration,\
+RENEW_BEFORE:.spec.renewBefore,\
+ISSUER:.spec.issuerRef.name
+```
+
+Validity guidelines:
+- Workload certs: <= 90d (best practice), <= 365d (acceptable)
+- Internal service mesh mTLS: <= 24h (optimal)
+- Long-lived infrastructure certs: <= 2y (acceptable with documented justification)
+
+Note: ACM PCA silently caps certificate validity at the CA's own remaining validity. A cert with `duration: 87600h` (10 years) issued by a CA expiring in 2 years will be capped at 2 years without error. Always verify the CA's own expiration date:
+
+```bash
+aws acm-pca describe-certificate-authority \
+  --certificate-authority-arn <arn> \
+  --query 'CertificateAuthority.NotAfter' \
+  --output text
+```
+
+### Step 6 — Review CRL configuration and reachability
+
+Check the CRL configuration on the CA:
+
+```bash
+aws acm-pca describe-certificate-authority \
+  --certificate-authority-arn <arn> \
+  --query 'CertificateAuthority.RevocationConfiguration'
+```
+
+Verify the CRL S3 bucket name from the output. Then check reachability from within the VPC:
+
+- Does the VPC have an S3 Gateway VPC endpoint for the CRL bucket's region?
+- Is the CRL S3 bucket policy allowing access from the VPC?
+- Is the CRL distribution point URL embedded in issued certs accessible?
+
+```bash
+# Check for S3 gateway VPC endpoint
+aws ec2 describe-vpc-endpoints \
+  --filters "Name=service-name,Values=com.amazonaws.<region>.s3" \
+             "Name=vpc-id,Values=<vpc-id>"
+```
+
+If the CRL S3 bucket requires a VPC endpoint and none exists, revocation checking is effectively disabled (most TLS clients soft-fail on CRL/OCSP unreachability).
+
+### Step 7 — Cross-account PCA review (if applicable)
+
+Identify if the CA ARN belongs to a different AWS account than the EKS cluster:
+
+```bash
+# Extract account ID from CA ARN
+echo "arn:aws:acm-pca:<region>:<account-id>:certificate-authority/<id>"
+# Compare with current account
+aws sts get-caller-identity --query Account --output text
+```
+
+For cross-account configurations:
+
+1. Verify the RAM share exists in the security account:
+```bash
+aws ram list-resources --resource-owner SELF --resource-type acm-pca:CertificateAuthority
+```
+
+2. Verify the workload-account IRSA role trust policy references the correct EKS OIDC provider.
+
+3. Confirm the cross-account IAM permissions follow least-privilege (issuance only, not management).
+
+---
+
+## Output Format
+
+### Finding: `<short title>`
+
+| Field | Value |
+|-------|-------|
+| Severity | CRITICAL / HIGH / MEDIUM / LOW |
+| Resource | AWSPCAIssuer name, CA ARN, IAM role, or cert name |
+| Evidence | documentation-based / live evidence / inference |
+| Description | What is wrong and why it matters for PKI trust |
+| Remediation | IAM policy snippet, ARN change, or configuration fix |
+
+---
+
+### Overall PKI Trust Posture
+
+| Category | Status |
+|----------|--------|
+| CA hierarchy (subordinate only) | PASS / FAIL |
+| Certificate template scope | PASS / FAIL |
+| IRSA permissions (least-privilege) | PASS / FAIL |
+| Certificate validity periods | PASS / FAIL |
+| CRL reachability | PASS / FAIL |
+| Cross-account configuration | PASS / N/A / FAIL |
+
+**Verdict:** TRUSTED / UNTRUSTED / CONDITIONAL (list conditions)

package/skills/aws/aws-rds-aurora-performance-investigator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-rds-aurora-performance-investigator
 description: Investigate Amazon RDS and Aurora-specific incidents involving latency, connection exhaustion, slow queries, lock waits, storage pressure, CPU/I/O saturation, replica lag, failover behavior, Performance Insights, and database capacity. Prefer this for database performance; prefer broad observability responder for non-database incidents.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # AWS RDS Aurora Performance Investigator

package/skills/aws/aws-resilience-bcdr-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-resilience-bcdr-review
 description: Review AWS resilience and business continuity strategy across RTO/RPO, dependency maps, multi-AZ, multi-Region, failover/failback, game days, runbooks, drift, and recovery validation. Prefer data protection backup steward for backup-plan/vault/restore implementation details.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: resilience
 ---
 
 # AWS Resilience BCDR Review

package/skills/aws/aws-s3-data-perimeter-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-s3-data-perimeter-governor
 description: Review Amazon S3 data perimeter and exposure posture across Block Public Access, Object Ownership, ACL removal, bucket/access point policies, TLS-only access, encryption, replication, lifecycle, logging, cross-account access, and prefix boundaries. Prefer this for S3 data exposure; prefer IAM skill for generic policy surgery.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # AWS S3 Data Perimeter Governor

package/skills/aws/aws-security-posture-hardening/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-security-posture-hardening
 description: Review broad AWS security posture across Security Hub CSPM, GuardDuty, Inspector, Macie, Config, CloudTrail, IAM, public exposure, vulnerability findings, and remediation governance. Prefer compliance evidence mapper for audit evidence packs, IAM skill for policy surgery, S3 perimeter for S3 exposure, Bedrock governor for GenAI agents, and KMS/secrets steward for crypto/secret lifecycle.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # AWS Security Posture Hardening

package/skills/aws/aws-serverless-production-readiness/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-serverless-production-readiness
 description: Review AWS Lambda-centered serverless workloads for production readiness across execution roles, event sources, retries, DLQs/destinations, concurrency, idempotency, observability, deployment safety, performance, cost, and rollback. Prefer event-driven architecture for EventBridge/SNS/SQS/Step Functions system design, and DynamoDB/RDS skills for data-store performance.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # AWS Serverless Production Readiness

package/skills/aws/aws-serverless-rollout-corrector/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-serverless-rollout-corrector
 description: Patch AWS serverless rollout definitions across Lambda, API Gateway, EventBridge, SQS, SNS, event source wiring, aliases, versions, and deployment config. Prefer this for repo-side rollout corrections; do not perform live rollout actions or destructive operations.
+allowed-tools: Read Edit Write MultiEdit Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # AWS Serverless Rollout Corrector

package/skills/aws/aws-solution-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-solution-architect
 description: Design and stress-test AWS cross-domain solution architectures when the request spans multiple AWS domains or needs an architecture decision record. Prefer narrower AWS skills for single-domain IAM, network, EKS, ECS, serverless, RDS, DynamoDB, S3, Bedrock, IaC, cost, security, migration, compliance, or incident asks.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.2"
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # AWS Solution Architect

package/skills/aws/aws-ticket-triage-escalation-coordinator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: aws-ticket-triage-escalation-coordinator
 description: Triage AWS tickets and alerts using priority, owner, evidence, incident context, escalation path, OpsCenter, health signals, and safe next steps. Prefer this for non-destructive request coordination and escalation; prefer deep domain skills for implementation or root-cause investigation.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # AWS Ticket Triage Escalation Coordinator

package/skills/azure/README.md

@@ -1,6 +1,8 @@
 # Azure skills
 
-![Azure logo](../../assets/logos/cloud/azure/azure.png)
+<p align="center">
+  <img src="../../assets/logos/cloud/azure/azure.png" alt="Azure logo" width="140" />
+</p>
 
 This folder contains Azure-focused skills curated for this marketplace.
 

package/skills/azure/azure-ai-foundry-ops-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-ai-foundry-ops-governor
 description: Use this skill for Microsoft Foundry and Azure AI Foundry operations governance: resource-versus-project boundary design, RBAC review, quota planning, network isolation, logging, and safe MCP-backed read or write execution. Trigger when the user asks how to run Foundry safely across teams without access sprawl, quota surprises, or unsafe production mutations.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # Azure AI Foundry Ops Governor

package/skills/azure/azure-aks-platform-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-aks-platform-operator
 description: Operate Azure Kubernetes Service with an adversarial production posture. Use for AKS architecture sanity checks, upgrade safety, node-pool strategy, workload identity, network policy, scaling, observability, and operator-readiness reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # Azure AKS Platform Operator

package/skills/azure/azure-app-service-production-readiness/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-app-service-production-readiness
 description: Review Azure App Service and Web Apps for production readiness across plan tier fit, slots, networking, private ingress, identities, secrets, scaling, diagnostics, resilience, backup, rollback, and operator readiness. Use when a team wants a real go/no-go decision instead of shallow reassurance.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # Azure App Service Production Readiness

package/skills/azure/azure-cosmosdb-application-developer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-cosmosdb-application-developer
 description: Use this skill for Azure Cosmos DB application development work, especially NoSQL data modeling, document structure, partition-aware access patterns, point reads, query design, SDK usage, transactional batch scope, consistency-aware reads, change feed integration, and Cosmos DB development guidance.
+allowed-tools: Read Edit Write MultiEdit Grep Glob Bash
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: data
 ---
 
 # Azure Cosmos DB Application Developer

package/skills/azure/azure-cosmosdb-performance-investigator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-cosmosdb-performance-investigator
 description: Use this skill for Azure Cosmos DB performance investigation, especially RU spikes, query latency, throttling, hot partitions, indexing inefficiency, partition-skew analysis, request-charge profiling, diagnostic-log review, and evidence-driven remediation planning.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: data
 ---
 
 # Azure Cosmos DB Performance Investigator

package/skills/azure/azure-cosmosdb-platform-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-cosmosdb-platform-operator
 description: Use this skill for Azure Cosmos DB platform operations and design review, especially accounts, databases, containers, partition-key design, throughput and RU posture, consistency choices, indexing, throttling, multi-region replication, private connectivity, and Cosmos DB MCP-guided discovery.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # Azure Cosmos DB Platform Operator

package/skills/azure/azure-cost-estimation-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-cost-estimation-review
 description: Review Azure cost estimates, pricing calculator assumptions, SKU and region choices, environment sizing realism, and uncertainty handling using official Microsoft cost-management and Azure MCP pricing documentation only.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: finops
 ---
 
 # Azure Cost Estimation Review

package/skills/azure/azure-cost-optimization-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-cost-optimization-governor
 description: Review Azure spend governance, budgets, alerts, cost analysis visibility, reservation and savings-plan awareness, tagging for cost allocation, exports, and FinOps ownership with official Microsoft documentation and Azure MCP evidence where available.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: finops
 ---
 
 # Azure Cost Optimization Governor

package/skills/azure/azure-entra-id-specialist/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-entra-id-specialist
 description: Use this skill for Microsoft Entra ID specialist work, especially Conditional Access, authentication methods, MFA and SSPR registration, identity protection, workload identities, app registrations, external identities, agent identities, break-glass posture, and tenant identity control reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: security
 ---
 
 # Azure Entra ID Specialist

package/skills/azure/azure-governance-policy-guardrails/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-governance-policy-guardrails
 description: Use this skill for Azure Policy guardrails, initiatives, assignment scope, management-group inheritance, exclusions, remediation risk, tag governance, allowed regions or SKUs, and staged governance rollout reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: compliance
 ---
 
 # Azure Governance Policy Guardrails

package/skills/azure/azure-identity-governance-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-identity-governance-review
 description: Review Microsoft Entra identity governance posture for Azure operators, with focus on standing versus eligible access, Privileged Identity Management, access reviews, entitlement management, ownership gaps, and least-privilege control patterns.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: compliance
 ---
 
 # Azure Identity Governance Review

package/skills/azure/azure-key-vault-secret-lifecycle-auditor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: azure-key-vault-secret-lifecycle-auditor
 description: Audit Azure Key Vault secret lifecycle posture across RBAC, soft delete, purge protection, rotation, expiration, metadata hygiene, Event Grid notifications, and recovery readiness. Use when the question is whether secret management is actually safe, not just present.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: security
 ---
 
 # Azure Key Vault Secret Lifecycle Auditor

package/skills/azure/azure-keyvault-certificate-issuer-review/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: azure-keyvault-certificate-issuer-review
+description: Use this skill when reviewing Azure Key Vault certificate issuer configurations for cert-manager on AKS. Trigger on any request to audit Key Vault certificate policies, Managed Identity role assignments, exportability settings, private endpoint connectivity, integrated CA credentials, or rotation policy alignment.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-05"
+  category: security
+---
+
+# Azure Key Vault Certificate Issuer Review
+
+## Purpose
+
+Review Azure Key Vault configurations used as certificate issuers for cert-manager on AKS. Identify Managed Identity role assignment gaps (data plane vs management plane confusion), certificate policy misalignment, exportability risks, network connectivity issues, integrated CA credential over-scoping, and rotation race conditions between cert-manager and Key Vault auto-rotation. Output severity-labeled findings with evidence and remediation steps.
+
+## Lean operating rules
+
+- Check the Managed Identity (or Service Principal) role assignment on the Key Vault: the correct role is `Key Vault Certificate Officer` (data plane). Flag `Key Vault Contributor` as HIGH — it grants management plane access including vault deletion. Flag `Key Vault Administrator` as HIGH (full data plane + management).
+- Verify whether Key Vault RBAC mode is enabled (`enableRbacAuthorization: true`). If legacy access policies are used instead of RBAC, flag as MEDIUM (harder to audit, no Azure AD Conditional Access integration).
+- Review `exportable` in the Key Vault certificate policy. Flag `exportable: true` on certs used for cluster-internal mTLS as MEDIUM (private key unnecessarily extractable from Key Vault).
+- Check Key Vault network access configuration: if `publicNetworkAccess: Disabled`, verify the AKS cluster has private endpoint access to the Key Vault and DNS resolution via private DNS zone. Flag missing private endpoint as MEDIUM.
+- For integrated CAs (DigiCert, GlobalSign): verify the Key Vault has the CA integration configured and the credential secret is scoped to a minimum (single certificate profile, not account-wide).
+- Review cert-manager `renewBefore` against the Key Vault certificate's auto-rotation policy to detect overlapping rotation windows. Flag simultaneous rotation triggers as MEDIUM.
+- Label all findings as live evidence, documentation-based, or inference.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md)
+
+## Response minimum
+
+- Severity-labeled findings list (CRITICAL / HIGH / MEDIUM / LOW)
+- Evidence source for each finding
+- Specific resource name or field that caused the finding
+- Recommended remediation with example Azure CLI command or policy snippet
+- Overall Key Vault certificate issuer posture verdict

package/skills/azure/azure-keyvault-certificate-issuer-review/metadata.json

@@ -0,0 +1,20 @@
+{
+  "id": "azure-keyvault-certificate-issuer-review",
+  "name": "Azure Key Vault Certificate Issuer Review",
+  "type": "skill",
+  "provider": "azure",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Review Azure Key Vault certificate issuer configurations for cert-manager, covering certificate policy alignment, Managed Identity authorization scope, exportability posture, private endpoint connectivity, integrated CA credential scoping, and cert-manager vs Key Vault auto-rotation race conditions.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates",
+    "https://learn.microsoft.com/en-us/azure/key-vault/certificates/certificate-scenarios",
+    "https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security",
+    "https://learn.microsoft.com/en-us/azure/key-vault/general/network-security"
+  ],
+  "security_notes": "Key Vault Contributor role assigned to cert-manager allows deletion of the Key Vault, management policy changes, and purge of soft-deleted certs — a full management plane compromise. Use Key Vault Certificate Officer (data plane RBAC) instead. Exportable certificates allow private key extraction from Key Vault; use non-exportable certs for cluster-internal mTLS.",
+  "last_verified": "2026-05-02",
+  "path": "skills/azure/azure-keyvault-certificate-issuer-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}