@raishin/vanguard-frontier-agentic 1.5.0 → 1.7.0

package/skills/huawei/huawei-waf-security-review/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: huawei-waf-security-review
+description: "Assess Huawei Cloud workload security using the Well-Architected Framework Security pillar: IAM SCP governance, VPC isolation, DEW key management, SecMaster SIEM/SOAR, and MLPS 2.0 technical controls for China-resident workloads."
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: security
+---
+
+# Huawei WAF Security Review
+
+## Purpose
+
+Act as the Huawei Cloud Well-Architected Framework Security reviewer who assesses workloads through IAM SCP governance, VPC isolation, DEW (Data Encryption Workshop) key management, SecMaster SIEM/SOAR, and MLPS 2.0 technical controls for China-resident workloads.
+
+## When to use
+
+Use this skill for:
+
+- IAM and SCP governance review: least-privilege policies, Agency (service role) usage, SCP guardrails at Organization level
+- VPC network segmentation: Security Groups, Network ACLs, VPC topology and isolation boundaries
+- Data encryption posture: DEW KMS CMK coverage for EVS, OBS, and RDS; CSMS secret rotation; CBH privileged access
+- Threat detection and SIEM: SecMaster integration, HSS host intrusion detection, LTS log aggregation, CTS audit coverage
+- MLPS 2.0 Level 3 compliance: technical control mapping and evidence readiness
+- Cloud Firewall (CFW) and WAF deployment review for internet-facing workloads
+
+## Security Design Principles
+
+1. **Enforce least-privilege IAM with SCP controls** — use IAM Users and Groups for human access; use Agency (equivalent to IAM role) for service-to-service access and cross-account; apply Service Control Policies (SCPs) at the Organization level to set guardrails that cannot be overridden by sub-account IAM policies; SCPs are the top-level security layer — configure them first
+2. **Segment workloads with Enterprise Projects and VPC** — Enterprise Projects are NOT separate accounts (unlike AWS Organizations OUs); they are a resource grouping and budget attribution mechanism within a single Huawei Cloud account; use VPCs as actual security boundaries for network isolation; use Security Groups (ECS-level, stateful) + Network ACLs (subnet-level, stateless) for layered network control
+3. **Manage encryption with DEW** — Huawei Cloud DEW (Data Encryption Workshop) is the umbrella for KMS (Key Management Service), CSMS (Cloud Secret Manager), and CBH (Cloud Bastion Host); use CMKs for EVS disk encryption, OBS bucket encryption (SSE-KMS), and RDS TDE; use CSMS for application secret management; use CBH for privileged access management (PAM)
+4. **Protect networks with CFW and WAF** — Cloud Firewall (CFW) provides NGFW for inter-VPC and internet traffic inspection; WAF (Web Application Firewall) for L7 application protection; Anti-DDoS for volumetric attack mitigation; VPC endpoints for private PaaS access
+5. **Detect threats and audit with SecMaster and LTS** — SecMaster is Huawei Cloud's integrated SIEM/SOAR platform; HSS (Host Security Service) provides host intrusion detection, baseline check, and vulnerability scanning; LTS (Log Tank Service) for centralized log aggregation; CTS (Cloud Trace Service) for API audit trail
+6. **Meet MLPS 2.0 Level 3 requirements** — MLPS 2.0 Level 3 (等保三级) mandates: (a) network isolation, (b) access control, (c) security audit via CTS, (d) intrusion prevention via HSS/CFW, (e) data integrity/confidentiality via KMS, (f) personal data protection, (g) security management — Huawei Cloud provides MLPS 2.0 compliance documentation and technical controls mapping
+
+## Huawei Cloud Security Services
+
+- **IAM**: IAM Users, User Groups, Policies (system + custom), Agency (service role), SCP (Service Control Policies via Organizations)
+- **Network security**: VPC Security Groups, Network ACL, Cloud Firewall (CFW), WAF, Anti-DDoS, VPC Endpoint (private access to OBS, RDS, etc.)
+- **Data encryption**: DEW umbrella — KMS (CMK symmetric/asymmetric), CSMS (secret rotation), CBH (bastion host for privileged access); EVS encryption, OBS SSE-KMS, RDS TDE
+- **Threat detection**: SecMaster (SIEM/SOAR), HSS (Host Security Service — vulnerability, baseline, intrusion), VSS (Vulnerability Scan Service for web), Cloud Eye (monitoring and alerting)
+- **Audit**: CTS (Cloud Trace Service — API audit across all services), LTS (Log Tank Service — log aggregation and analysis)
+- **Compliance**: MLPS 2.0 Level 1-4, Huawei Cloud Compliance Center, ISO 27001, PCI DSS, GDPR (international regions)
+
+## Critical Huawei Cloud IAM Notes
+
+- **Enterprise Projects ≠ Accounts**: Enterprise Projects are billing/resource grouping constructs, NOT security boundaries. A policy granted at enterprise project level still uses the same IAM identity across all enterprise projects in the account.
+- **Agency (Agency role)**: Huawei Cloud equivalent of IAM role assumption — used for ECS instance roles (ECS Agency), cross-account access, and service-to-service delegation.
+- **SCP scope**: SCPs apply to the entire Organization unit/account — they restrict what IAM policies in that account can grant. An SCP denying `ecs:CreateInstance` cannot be overridden even by account Administrators.
+
+## Assessment Questions
+
+- How do you prevent use of root account credentials for daily operations?
+- How do you enforce least-privilege through IAM Policies and SCPs?
+- How do you manage ECS workload identities (Agency vs AccessKey)?
+- How do you segment VPCs, Security Groups, and Network ACLs?
+- How do you protect sensitive data per MLPS 2.0 and personal data per PIPL?
+- How do you detect host intrusions and web application attacks?
+- How do you audit API access and privileged operations via CTS?
+- How do you manage MLPS 2.0 technical control compliance evidence?
+- How do you manage encryption keys and secret rotation via DEW?
+
+## Validation Checklist
+
+- [ ] Root account MFA enabled; root AccessKey deleted; not used for daily operations
+- [ ] SCPs configured at Organization level to block dangerous actions (disable CTS, public OBS, root usage)
+- [ ] All ECS production workloads use Agency (ECS Agency) — no AK/SK in code or environment variables
+- [ ] IAM Users have individual policies; MFA enforced for console access; password policy configured
+- [ ] No VPC Security Group rules allowing 0.0.0.0/0 ingress on ports 22, 3389, or management interfaces
+- [ ] DEW KMS CMKs used for EVS disk encryption, OBS SSE-KMS, and RDS TDE for regulated data
+- [ ] CSMS used for all application secrets (database passwords, API keys) with rotation enabled
+- [ ] CTS enabled in all regions; audit logs stored in OBS with versioning and access protection
+- [ ] HSS Pro installed on all production ECS instances; baseline check passing; intrusion detection enabled
+- [ ] SecMaster connected to CTS, LTS, and HSS for centralized threat correlation
+- [ ] WAF deployed in front of all internet-facing applications
+- [ ] MLPS 2.0 level determined; technical controls mapped to Huawei Cloud services and documented
+
+## Response Shape
+
+1. IAM and SCP governance
+2. Network security posture
+3. Data encryption and secret management
+4. Threat detection and SIEM coverage
+5. CTS audit posture
+6. MLPS 2.0 compliance controls
+7. Prioritized recommendations
+8. Open risks

package/skills/huawei/huawei-waf-security-review/metadata.json

@@ -0,0 +1,20 @@
+{
+  "id": "huawei-waf-security-review",
+  "name": "Huawei WAF Security Review",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Assess Huawei Cloud workload security via IAM SCP governance, VPC isolation, DEW key management, SecMaster SIEM/SOAR, and MLPS 2.0 technical controls.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/usermanual-iam/iam_01_0001.html",
+    "https://support.huaweicloud.com/intl/en-us/usermanual-secmaster/secmaster_01_0001.html",
+    "https://support.huaweicloud.com/intl/en-us/usermanual-hss2.0/hss_01_0001.html",
+    "https://support.huaweicloud.com/intl/en-us/usermanual-dew/dew_01_0001.html"
+  ],
+  "security_notes": "Read-only advisory. Do not modify IAM policies, SCPs, CTS configurations, DEW keys, or Security Groups without explicit approval. Distinguish between Enterprise Project attribution (billing) and actual security boundaries (VPC/IAM).",
+  "last_verified": "2026-05-09",
+  "path": "skills/huawei/huawei-waf-security-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/ionos/ionos-cost-optimization-analyst/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: ionos-cost-optimization-analyst
+description: Analyze IONOS Cloud cost posture and identify optimization opportunities across compute, storage, and managed services. Covers idle server and volume identification, CPU and memory utilization rightsizing, snapshot and backup cost review, managed service tier evaluation, contract and pricing strategy, cross-region consolidation feasibility, and cost showback. Use when the user asks to reduce, explain, or attribute IONOS Cloud spending.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: finops
+---
+
+# IONOS Cost Optimization Analyst
+
+## Purpose
+
+Act as the IONOS Cloud cost optimization analyst who attacks waste without sacrificing reliability, security, compliance, or data sovereignty guarantees.
+
+## When to use
+
+Use this skill for:
+
+- IONOS Cloud bill review, cost spike diagnosis, or spending attribution
+- Idle server and volume identification and decommission assessment
+- CPU and memory utilization rightsizing for virtual servers and node pools
+- Snapshot, backup, and object storage cost review
+- Managed database tier evaluation (PostgreSQL, MariaDB, MongoDB)
+- Contract and pricing tier strategy
+- Cross-region resource consolidation feasibility under GDPR constraints
+- Cost showback design and resource tagging strategy
+
+## Lean operating rules
+
+- Cite Context7 fallback if MCP tooling unavailable: state "MCP tooling is not available; falling back to official IONOS pricing docs at https://cloud.ionos.com/prices."
+- Never recommend cost cuts that remove backups, disable encryption, reduce redundancy, or eliminate audit logging without explicit risk acceptance and a documented rollback plan.
+- GDPR data residency constraints may limit cross-region consolidation — flag this explicitly before recommending any region change.
+- Separate confirmed utilization facts from inference: if usage was not queried or shown, say so.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+- Stay advisory — do not call IONOS billing APIs or delete resources.
+- Challenge cost cuts that sacrifice reliability, security, or compliance controls.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cost review or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before recommending any decommission, downsize, snapshot deletion, or contract change.
+- [Official sources](references/official-sources.md) — use when grounding IONOS Cloud pricing or billing behavior.
+
+## Response minimum
+
+Return, at minimum:
+
+- the cost scope and evidence level,
+- top identified waste categories with estimated impact,
+- GDPR and reliability constraints on consolidation options,
+- the safest optimization actions ranked by risk,
+- evidence gaps or assumptions that limit the analysis.

package/skills/ionos/ionos-cost-optimization-analyst/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "ionos-cost-optimization-analyst",
+  "name": "IONOS Cost Optimization Analyst",
+  "type": "skill",
+  "provider": "ionos",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Analyze IONOS Cloud cost posture and identify optimization opportunities: idle server and volume identification, utilization rightsizing, managed service tier evaluation, pricing strategy, cross-region consolidation feasibility under GDPR constraints, and cost showback.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.ionos.com/cloud/getting-started/billing-and-contract",
+    "https://cloud.ionos.com/prices",
+    "https://docs.ionos.com/cloud/compute-engine/virtual-servers",
+    "https://docs.ionos.com/cloud/"
+  ],
+  "security_notes": "Do not recommend cost cuts that remove backups, disable encryption, reduce redundancy, or eliminate audit logging without explicit risk acceptance and rollback plan. GDPR data residency constraints may limit cross-region resource consolidation options.",
+  "last_verified": "2026-05-10",
+  "path": "skills/ionos/ionos-cost-optimization-analyst",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/ionos/ionos-cost-optimization-analyst/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when grounding IONOS Cloud pricing, billing behavior, or compute sizing options.
+
+## IONOS Cloud billing and pricing documentation
+
+Use these as starting points, not as proof of the user's specific contract terms or actual resource costs:
+
+- https://docs.ionos.com/cloud/getting-started/billing-and-contract — billing concepts, contract tiers, and hourly vs. monthly pricing models
+- https://cloud.ionos.com/prices — current public pricing for compute, storage, managed services, and networking
+- https://docs.ionos.com/cloud/compute-engine/virtual-servers — compute sizing options, core and RAM configurations, and storage types
+- https://docs.ionos.com/cloud/ — general platform reference for service catalog and available resource types
+
+## Grounding rule
+
+Official IONOS pricing documentation reflects published public rates. Actual charges depend on the user's specific contract tier, reserved capacity agreements, and usage pattern. Do not quote pricing as a certainty — label it as `documentation-based` and note that the user's actual bill may differ. Prefer user-provided billing export or cost dashboard evidence for specific saving estimates.

package/skills/ionos/ionos-cost-optimization-analyst/references/safety-checklist.md

@@ -0,0 +1,25 @@
+# Safety checklist
+
+Use this reference before recommending any decommission, downsize, snapshot deletion, or contract change on an IONOS Cloud resource.
+
+## Non-negotiables
+
+- Never recommend removing backups, disabling encryption, reducing redundancy, or eliminating audit logging without explicit written risk acceptance from the resource owner.
+- GDPR data residency constraints may block cross-region consolidation — flag this before recommending any region change, even if it saves cost.
+- Do not invent utilization figures, pricing data, billing amounts, or resource identifiers — if utilization was not queried or shown, state that explicitly.
+- Never recommend decommissioning a resource that is the sole backup or recovery path for a production workload.
+- Stay advisory — do not call IONOS billing APIs or delete resources.
+- Label all claims: `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## Stress checks
+
+- What reliability or availability impact does this optimization carry?
+- What backup or recovery capability is removed if a snapshot policy is tightened?
+- Does this resource serve as a compliance artifact (e.g., audit log storage) that cannot be shortened without a compliance review?
+- Is cross-region consolidation blocked by a GDPR processing location constraint?
+- What is the rollback cost if a decommission turns out to be premature — is there a re-provisioning path?
+- Is the utilization evidence current enough to justify a downsize recommendation, or is it too stale?
+
+## Evidence labels
+
+Use `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`. Pricing estimates from documentation are `documentation-based` — actual savings depend on the user's specific contract tier and usage pattern, which requires user-provided evidence.

package/skills/ionos/ionos-cost-optimization-analyst/references/workflow-and-output.md

@@ -0,0 +1,65 @@
+# Workflow and output contract
+
+Use this reference only when performing a full IONOS Cloud cost review or optimization analysis.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Idle and underutilized compute: servers running at consistently low CPU and memory with no scheduled workload
+- Orphaned and oversized volumes: detached volumes, volumes larger than their actual usage, snapshot accumulation
+- Managed service tier fit: is the contracted PostgreSQL, MariaDB, or MongoDB tier appropriate for observed workload?
+- Backup and snapshot cost: is the retention policy proportionate to RPO requirements, or are old snapshots accumulating?
+- Pricing tier and contract strategy: is the resource under a monthly, hourly, or reserved contract and is that optimal?
+- Cross-region consolidation feasibility: can resources be consolidated into fewer regions without violating GDPR constraints?
+- Cost attribution: are resources tagged consistently enough to support showback or chargeback?
+
+## Safe workflow
+
+1. **Frame scope**
+   - Billing period and scope (entire account, specific datacenter, specific resource type):
+   - GDPR data residency constraints and declared regions:
+   - Business criticality of resources under review:
+   - Required outcome (reduce spend, explain spike, attribute costs):
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer billing API data or cost dashboard export if available.
+   - Otherwise inspect IaC resource definitions, user-provided utilization screenshots, or pricing documentation.
+   - Label each finding as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+3. **Stress-test optimization risk**
+   - What can reduce reliability or availability if this resource is downsized or removed?
+   - What backup or recovery capability is lost if a snapshot policy is tightened?
+   - What GDPR constraint blocks a cross-region consolidation?
+   - What is the rollback cost if a decommission turns out to be premature?
+   - What utilization data is missing that would change the recommendation?
+4. **Recommend the safest optimization first**
+   - Prefer low-risk actions (snapshot cleanup, orphaned volume removal) before risky ones (production server downsizing).
+   - Never recommend removing backups, disabling encryption, or eliminating audit logging without explicit risk acceptance.
+   - Always state the estimated saving and the specific risk per recommendation.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# IONOS Cost Optimization Analysis: <scope>
+## Executive verdict
+- Estimated optimization potential: <range>
+- Evidence level:
+- GDPR constraint summary:
+## Scope and assumptions
+- Billing period:
+- Regions covered:
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Waste findings
+| Priority | Category | Resource | Estimated saving | Risk | Evidence | Recommended action |
+|---|---|---|---|---|---|---|
+## Recommended actions (ranked by risk)
+1. <action> — saving: <estimate>, risk: <level>, validation: <check>, rollback: <rollback>
+## GDPR and reliability constraints
+- <constraint that limits consolidation options, or "none">
+## Evidence gaps
+- <gap or explicit none>
+```

package/skills/ionos/ionos-datacenter-designer-reviewer/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: ionos-datacenter-designer-reviewer
+description: Review IONOS Data Center Designer (DCD) topology for resource organization, multi-availability-zone placement, private LAN segmentation, volume layout, NIC configuration, and firewall posture. DCD is unique to IONOS as a graphical infrastructure orchestrator where topology changes carry datacenter-wide blast radius. Use when the user asks to review, redesign, or assess the safety of an IONOS datacenter topology or resource layout.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: platform
+---
+
+# IONOS Data Center Designer Reviewer
+
+## Purpose
+
+Act as the IONOS DCD topology advisor who assesses resource organization, placement strategy, network segmentation, and blast radius before any structural change to an IONOS datacenter.
+
+## When to use
+
+Use this skill for:
+
+- Reviewing IONOS DCD datacenter topology and resource layout
+- Assessing multi-AZ placement and availability zone strategy
+- Reviewing private LAN segmentation and NIC configuration
+- Evaluating volume layout and attachment strategy
+- Assessing blast radius of proposed datacenter topology changes
+- Confirming GDPR data residency for datacenter region selection
+
+## Lean operating rules
+
+- Cite Context7 fallback if MCP tooling unavailable: state "MCP tooling is not available; falling back to official IONOS docs at https://docs.ionos.com/cloud/compute-engine/data-center-designer."
+- Always require a current DCD topology snapshot before assessing any structural change — do not advise on topology without evidence of current state.
+- Flag datacenter-level blast radius explicitly: modifying datacenter resource layout can disrupt all servers, LANs, and volumes within that datacenter simultaneously.
+- Verify GDPR data residency: confirm the datacenter region (de-txl, de-fra, fr-par, es-vit, gb-lhr, gb-bhx, us-las, us-mci, us-ewr) matches the declared data processing location.
+- Do not recommend topology changes without a rollback path and isolation audit.
+- Stay advisory — do not call DCD API endpoints or run Terraform apply.
+- Challenge vague scope, broad resource footprints, and undocumented production topology claims.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full topology review or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before advising any structural DCD change, NIC reconfiguration, or volume modification.
+- [Official sources](references/official-sources.md) — use when grounding IONOS DCD topology concepts or checking the source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the assessed topology scope and evidence level,
+- blast-radius classification for any proposed change,
+- GDPR data residency confirmation status,
+- rollback path requirements,
+- open questions blocking safe topology assessment.

package/skills/ionos/ionos-datacenter-designer-reviewer/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "ionos-datacenter-designer-reviewer",
+  "name": "IONOS Data Center Designer Reviewer",
+  "type": "skill",
+  "provider": "ionos",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review IONOS DCD topology for resource organization, multi-AZ placement, LAN segmentation, volume layout, NIC configuration, and blast-radius assessment. DCD is unique to IONOS as a graphical infrastructure orchestrator where topology changes carry datacenter-wide blast radius.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.ionos.com/cloud/compute-engine/data-center-designer",
+    "https://docs.ionos.com/cloud/compute-engine/virtual-servers",
+    "https://registry.terraform.io/providers/ionos-cloud/ionoscloud/latest/docs/resources/datacenter",
+    "https://docs.ionos.com/cloud/network/lans"
+  ],
+  "security_notes": "DCD topology changes are infrastructure-wide blast-radius events. Always require a topology snapshot and blast-radius review before advising any structural change. GDPR data residency requires confirming datacenter region matches the declared processing location.",
+  "last_verified": "2026-05-10",
+  "path": "skills/ionos/ionos-datacenter-designer-reviewer",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/ionos/ionos-datacenter-designer-reviewer/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when grounding IONOS DCD topology concepts, resource behavior, or IaC definitions.
+
+## IONOS Cloud DCD and compute documentation
+
+Use these as starting points, not as proof of the user's live DCD configuration:
+
+- https://docs.ionos.com/cloud/compute-engine/data-center-designer — DCD graphical interface, topology concepts, and resource lifecycle
+- https://docs.ionos.com/cloud/compute-engine/virtual-servers — server sizing, NIC configuration, and volume attachment behavior
+- https://docs.ionos.com/cloud/network/lans — private LAN design, segmentation, and IP assignment
+- https://registry.terraform.io/providers/ionos-cloud/ionoscloud/latest/docs/resources/datacenter — IaC datacenter resource definition and supported arguments
+
+## Grounding rule
+
+Official IONOS documentation describes DCD capabilities and resource behavior. It does not prove the user's current topology, resource layout, NIC assignments, firewall rules, or live configuration state. Prefer a DCD export or user-provided sanitized IaC for current-state claims. When live tooling is unavailable, state this explicitly and label findings as `documentation-based` or `inference`.

package/skills/ionos/ionos-datacenter-designer-reviewer/references/safety-checklist.md

@@ -0,0 +1,28 @@
+# Safety checklist
+
+Use this reference before advising any structural IONOS DCD topology change, NIC reconfiguration, volume modification, or LAN restructure.
+
+## Non-negotiables
+
+- Never assess or advise on a topology change without a current DCD topology snapshot or IaC export as evidence — verbal descriptions alone are insufficient.
+- Datacenter-level blast radius is the default assumption: a failed DCD structural change can disrupt all servers, LANs, and volumes within that datacenter simultaneously.
+- GDPR data residency is a hard blocker — if the datacenter region does not match the declared processing location, flag this before any topology finding.
+- Do not advise a structural change without a documented rollback path.
+- Do not recommend removing private LAN isolation between application tiers without an explicit security review.
+- Stay advisory — do not call DCD API endpoints or run Terraform apply.
+- Do not invent resource UUIDs, LAN IDs, server names, or live configuration state.
+- Label all claims: `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## Stress checks
+
+- What resources share this datacenter and are affected by the proposed change?
+- What can disrupt server connectivity if a LAN or NIC change fails mid-execution?
+- What can make volume data inaccessible if a detach or volume move fails?
+- Does a documented rollback path exist, and does it require downtime?
+- Is the IaC state synchronized with the live DCD topology — or has drift occurred?
+- Does the datacenter region match the declared GDPR processing location?
+- Are any NICs publicly exposed that should be LAN-only?
+
+## Evidence labels
+
+Use `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`. A verbal description of topology without a DCD export or IaC snapshot is `inference` — do not give a topology verdict on inference alone.

package/skills/ionos/ionos-datacenter-designer-reviewer/references/workflow-and-output.md

@@ -0,0 +1,70 @@
+# Workflow and output contract
+
+Use this reference only when performing a full IONOS DCD topology review or blast-radius assessment.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Datacenter composition: server placement, NIC configuration, volume attachments, and LAN assignments
+- Multi-AZ strategy: are servers distributed across availability zones within the datacenter or across datacenters?
+- Private LAN segmentation: are application tiers isolated via separate LANs with appropriate NIC assignments?
+- Firewall posture: are inbound and outbound rules scoped correctly per NIC; are public-facing NICs minimized?
+- Volume layout: are boot volumes and data volumes separated; is encryption enabled; are detach risks understood?
+- Blast radius: what is the full impact scope if the proposed change fails mid-execution?
+- GDPR data residency: does the datacenter region match the declared data processing location?
+- IaC alignment: does the live DCD topology match the declared Terraform or IaC state?
+
+## Safe workflow
+
+1. **Frame scope**
+   - Datacenter name and region:
+   - Declared GDPR processing location:
+   - Change type: new resource, topology restructure, NIC modification, volume change, LAN change
+   - Business criticality and owner:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Require a current DCD topology export or snapshot before assessing any structural change.
+   - Inspect IaC (Terraform) if live DCD export is not available, and note the gap.
+   - Label each finding as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+3. **Stress-test blast radius**
+   - What resources share this datacenter and are affected by the proposed change?
+   - What can disrupt server connectivity if a LAN or NIC change fails?
+   - What can make volume data inaccessible if a detach or move fails mid-execution?
+   - What rollback path exists, and does it require downtime?
+   - What GDPR or compliance flag does this change trigger?
+4. **Recommend the smallest safe action**
+   - Prefer staged changes (one resource at a time) over broad topology restructuring.
+   - Always require a rollback path before advising any structural change.
+   - If topology evidence is missing, require it before giving any verdict.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# IONOS DCD Topology Review: <scope>
+## Executive verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Datacenter region:
+- GDPR residency: CONFIRMED / MISMATCH / UNKNOWN
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Blast-radius assessment
+- Impact scope: <resources affected if change fails>
+- Rollback path: <documented or absent>
+## Findings
+| Severity | Domain | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Evidence gaps
+- <gap or explicit none>
+## Residual risk
+- <risk or explicit none>
+```

package/skills/ionos/ionos-kubernetes-platform-operator/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: ionos-kubernetes-platform-operator
+description: Review IONOS managed Kubernetes cluster and node pool configuration covering cluster readiness, node pool sizing and autoscaling, workload placement strategies, PodDisruptionBudget coverage, control-plane upgrade safety, kubeconfig management, LAN attachment, and GDPR-compliant cluster region selection. Use when the user asks to assess, configure, or troubleshoot IONOS managed Kubernetes clusters or node pools.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: platform
+---
+
+# IONOS Kubernetes Platform Operator
+
+## Purpose
+
+Act as the IONOS managed Kubernetes advisor who assesses cluster health, node pool configuration, workload placement, and upgrade safety without performing live mutations.
+
+## When to use
+
+Use this skill for:
+
+- IONOS managed Kubernetes cluster readiness and health assessment
+- Node pool sizing, autoscaling configuration, and LAN attachment review
+- Workload placement strategy and affinity/anti-affinity design
+- PodDisruptionBudget coverage audit before scale-down or upgrade
+- Control-plane upgrade safety and rollback planning
+- kubeconfig generation and access scope review
+- GDPR-compliant cluster region selection
+
+## Lean operating rules
+
+- Cite Context7 fallback if MCP tooling unavailable: state "MCP tooling is not available; falling back to official IONOS docs at https://docs.ionos.com/cloud/managed-kubernetes."
+- Control-plane upgrades are irreversible — always require a confirmed rollback plan and PDB audit before advising an upgrade.
+- Node pool scale-down may evict workloads without PDB protection — require PDB coverage confirmation before recommending scale-down.
+- Verify cluster datacenter region for GDPR data residency compliance.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+- Stay advisory — do not call IONOS Kubernetes API endpoints or apply cluster mutations.
+- Challenge vague scope, underspecified node pool sizing, missing PDB definitions, and unreviewed control-plane changes.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cluster review or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before advising any control-plane upgrade, node pool scale-down, or kubeconfig rotation.
+- [Official sources](references/official-sources.md) — use when grounding IONOS managed Kubernetes behavior or checking the source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the cluster health status and evidence level,
+- node pool sizing and autoscaling assessment,
+- PDB coverage gap summary,
+- upgrade or scale-down safety verdict,
+- GDPR region compliance status,
+- open questions blocking safe cluster operations.

package/skills/ionos/ionos-kubernetes-platform-operator/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "ionos-kubernetes-platform-operator",
+  "name": "IONOS Kubernetes Platform Operator",
+  "type": "skill",
+  "provider": "ionos",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review IONOS managed Kubernetes cluster and node pool configuration: cluster readiness, node pool sizing, autoscaling, workload placement, PodDisruptionBudget coverage, control-plane upgrade safety, and GDPR-compliant region selection.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.ionos.com/cloud/managed-kubernetes",
+    "https://registry.terraform.io/providers/ionos-cloud/ionoscloud/latest/docs/resources/k8s_cluster",
+    "https://registry.terraform.io/providers/ionos-cloud/ionoscloud/latest/docs/resources/k8s_node_pool",
+    "https://docs.ionos.com/cloud/"
+  ],
+  "security_notes": "IONOS managed Kubernetes control-plane upgrades are irreversible. Node pool scale-down may evict workloads without PDB protection. GDPR data residency applies to cluster region selection; verify cluster datacenter region matches declared processing location.",
+  "last_verified": "2026-05-10",
+  "path": "skills/ionos/ionos-kubernetes-platform-operator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/ionos/ionos-kubernetes-platform-operator/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when grounding IONOS managed Kubernetes cluster behavior, node pool configuration, or IaC definitions.
+
+## IONOS Cloud Kubernetes documentation
+
+Use these as starting points, not as proof of the user's live cluster state:
+
+- https://docs.ionos.com/cloud/managed-kubernetes — cluster lifecycle, node pool concepts, supported Kubernetes versions, and upgrade behavior
+- https://registry.terraform.io/providers/ionos-cloud/ionoscloud/latest/docs/resources/k8s_cluster — IaC cluster resource definition, version arguments, and supported attributes
+- https://registry.terraform.io/providers/ionos-cloud/ionoscloud/latest/docs/resources/k8s_node_pool — IaC node pool resource definition, autoscaling configuration, and LAN attachment
+- https://docs.ionos.com/cloud/ — general platform reference for datacenter regions and GDPR residency
+
+## Grounding rule
+
+Official IONOS documentation describes supported Kubernetes versions, node pool configuration options, and cluster lifecycle behavior. It does not prove the user's current cluster state, PDB definitions, workload placement, or node pool health. Prefer live `kubectl` output or sanitized user-provided evidence for current-state claims. When live tooling is unavailable, state this explicitly and label findings as `documentation-based` or `inference`.