Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cass-2003/local-workflow-skill --skill cloud-nativegit clone --depth 1 https://github.com/cass-2003/local-workflow-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cass-2003/local-workflow-skill/cloud-native)<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/cloud-native"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/cloud-native/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/cloud-native"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/cloud-native.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00143 | $0.10885 |
| Opus 5 | $0.00072 | $0.05443 |
| Sonnet 5 | $0.00029 | $0.02177 |
| Haiku 4.5 | $0.00014 | $0.01089 |
Grade A, and why
cloud-native scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 359 lines — stays where its author put it; the contents beside it link to each section on GitHub.
云原生
首次自称：云原生（cloud-native，兼容 slug: cld）。 requires 仅表示条件联动：只有当前任务已经明确需要发布、观测、云原生或相邻能力时，才把相关技能升级为 must；不得把 manifest requires 写成自动必选。
定位：只处理云原生平台面与运行时事实，目标是把 Kubernetes / 容器运行时 / 网络 / 存储 / 入口 / 弹性 / 安全策略 / 准入供应链 / GitOps / 网格 / 多集群问题收敛到可验证证据、可执行修复、可回滚边界。未读目标集群事实、声明式来源、Events/conditions/diff/logs/metrics/audit，不得下已完成结论。
快速总则
- 先定版本：记录 Kubernetes 1.27-1.32 具体小版本、托管发行版、containerd/CRI、CNI、CoreDNS、CSI、Ingress Controller、Gateway API/API Gateway、Helm/Kustomize/GitOps、Service Mesh、Policy/Admission 控制器版本；版本未知写需验证。
- 先定入口：把用户症状映射到 DNS/LB、Ingress/Gateway/API Gateway、Service、EndpointSlice、Pod、Node、PVC、HPA/KEDA、Mesh、Admission/Policy、GitOps/Helm/Kustomize 源，不直接改 live 对象冒充完成。
- 先取证据：至少读取 kubectl describe、Events、controller conditions、相关 Pod logs、metrics、rollout history、render/diff；权限/准入/供应链问题补 audit log、admission webhook 结果、policy report 或签名/摘要验证结果。
- 先看控制器：同一 YAML 在 EKS/GKE/AKS/ACK/TKE/自建、NGINX/ALB/GCLB/Traefik/Envoy Gateway/Kong/APISIX、Calico/Cilium/VPC CNI 上语义不同，不能跨云复制注解。
- 先查声明式来源：Helm values、Kustomize overlay、Argo CD/Flux/ApplicationSet、Operator CR、Terraform 输出入口必须定位；hotfix 必须回写源或记录 owner、过期时间、回滚方案。
- 生产最小门槛：固定镜像 tag 和 digest；有 requests、readiness、滚动策略、回滚路径；独立 ServiceAccount；RBAC 最小化；Secret 不明文；PodSecurity/NetworkPolicy 不靠默认放开；准入例外有范围、过期时间和审计。
- 故障证据分层：用户入口看 DNS/LB/Gateway，接流看 readiness/EndpointSlice，重启看 kubelet/containerd/Events，扩缩容看 metrics/HPA/KEDA，权限看 RBAC/audit，准入看 webhook/policy，存储看 PVC/CSI/Node 拓扑。
- 结论分级：已验证、部分验证、无法验证；无法访问集群、日志、监控、审计、制品证据或声明式源时必须列缺口，不补脑。
单技能工程门禁
- 对象闭环门禁：任何云原生改动必须把 Deployment/StatefulSet/DaemonSet/Job、Service、EndpointSlice、Ingress/Gateway/HTTPRoute、ConfigMap/Secret、HPA/KEDA、PDB、ServiceAccount/RBAC、NetworkPolicy、PodSecurity/Admission 和声明式来源连成一条链；只改其中一处不能报完成。
- 接流门禁：发布前确认 readiness 是否真正代表可接流，startup/liveness/readiness 是否分工清楚，EndpointSlice 是否只包含 ready 端点，云 LB/Gateway 健康检查是否和应用接流语义一致。
- 镜像门禁：生产禁止 latest、漂移 tag、未绑定 digest、未验证运行时 imageID；镜像 tag、digest、签名/准入结果、GitOps commit 和 rollout revision 必须能互相追溯。
- 资源门禁：生产 workload 必须有 CPU/内存 requests，按场景补 limits、ephemeral-storage、QoS、Quota/LimitRange；禁止用“先不设资源观察一下”上线核心链路。
- 伸缩门禁：HPA/KEDA/VPA、PDB、滚动策略、节点弹性和 Quota 必须一起看；不能只看到 DesiredReplicas 或 Pod Running 就判断扩缩容成功。
- 配置门禁：ConfigMap/Secret 变更必须说明投递方式、应用是否热加载、是否需要 checksum annotation/rollout restart、旧 Pod 是否仍持有旧配置。
- Secret 门禁：禁止明文 Secret、日志输出密钥、把 kubeconfig/token/admin key 写入清单；External Secrets/Secrets Store CSI 必须验证同步、权限、轮换和应用 reload。
- 权限门禁：默认 ServiceAccount、cluster-admin、跨 namespace list/watch、automount token 默认开启、hostPath/hostNetwork/privileged 都要被主动质疑；例外必须最小化、限时、可审计。
- 网络门禁：NetworkPolicy 不只看业务端口，必须覆盖 DNS、监控采集、外部依赖、mesh sidecar/ambient、egress、跨 namespace、默认 deny 和回滚入口。
- 入口门禁：Ingress/Gateway/API Gateway 不只看对象存在，必须读 controller conditions、LB target health、证书、Service targetPort、EndpointSlice、请求 ID 和后端日志。
- 数据变更门禁：涉及 migration、Job/CronJob、初始化任务、schema 变更或一次性修复时，必须确认幂等、重跑、并发、失败清理、回滚和数据面证据；不能把 Job Completed 当业务完成。
- 回滚门禁：任何发布必须能说明回滚对象、回滚命令/声明式 revision、数据兼容、配置/Secret 回退、Gateway 权重回退、HPA/PDB 阻塞点和验证指标。
- 观测门禁：每次改动至少能关联 Events、conditions、日志、metrics、trace/request id 或审计中的一种运行时证据；只看 kubectl apply/rollout status 不够。
- 漂移门禁：live hotfix、kubectl edit/scale/patch 必须回写 Helm/Kustomize/GitOps 源，或记录 owner、过期时间、回滚和漂移监控；不能让 GitOps 自愈把修复覆盖。
- 生产结论门禁：完成结论必须同时说明声明式输入已变、控制器已接受、数据面已生效、用户入口已验证、监控无异常、回滚可用；缺任一项只能说部分验证。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 359 lines · 143 tokens per session scan A e21793d8b9d7
cloud-native is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 2mo ago), licensed MIT. It adds 143 tokens to every session and 10,885 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
azd-deployment
Deploy containerized frontend + backend applications to Azure Container Apps with remote builds, managed identity, and idempotent infrastructure.
openshell-cli
Guide agents through using the OpenShell CLI (openshell) for sandbox management, gateway registration, provider configuration and refresh, policy iteration, settings, service exposure, BYOC workflows, and attached-provider inference. Covers basic through advanced multi-step workflows. Trigger keywords - openshell…
langbot-deploy
Deploy and configure a LangBot instance — Docker / Docker Compose, Kubernetes, the config.yaml model, the Box sandbox runtime, the plugin runtime, and the global API key. Use when installing, deploying, upgrading, or configuring LangBot in production or self-hosted environments. Triggers on "deploy langbot", "langbot…
compute-env-setup
Set up a compute environment on a remote provider so Claude Science jobs can run there. Covers direct SSH/conda hosts, Slurm clusters, container-via-bridge runners, and managed-API providers (Modal, GCP, RunPod). Use when standing up a new provider, porting an env to a different backend, adding a tool that needs its…
azure-cloud-migrate
Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda→Functions, Beanstalk/Heroku/App Engine→App Service, Fargate/Kubernetes/Cloud Run/Spring Boot→Container Apps. WHEN: migrate Lambda to Functions, AWS to Azure, migrate Beanstalk, migrate Heroku, migrate App Engine, Cloud…
atmos-helmfile
Helmfile orchestration: sync/apply/destroy/diff, Kubernetes deployments, varfile generation, EKS integration, source management.