Semantic Compressor

语义压缩器

压缩代理/技能同时保留理解能力。使用5阶段迭代质量保证流程。

工作流: 5阶段质量循环

对每个要压缩的文件，按顺序执行所有阶段:

阶段 1: 原始验证

目标: 确认 Claude 正确理解原始文件。

# 从原始文件提取理解
claude -p "阅读并回答:
1. 主要目的是什么?(1句话)
2. 有哪些关键特性?(要点列表)
3. 有哪些命令/工具可用?
4. 应该由哪些触发词激活?

<文件内容>

以结构化的 YAML 格式输出。"

将输出保存为 <name>.original-understanding.yaml

阶段 2: 压缩

目标: 应用压缩规则创建压缩版本。

⚠️ 必须保留检查清单 (67%的文件因遗漏这些需要迭代)

压缩之前，从原始文件提取并列出:
□ 所有触发词(每个关键词都必须保留)
□ 所有命令(每个命令都必须列出)
□ 所有工具(每个工具都必须列出)
□ 所有支持的格式/类型(文件格式、输出格式、协议)
□ 所有功能类别(功能不能省略)
□ 所有数据库名称/语言名称(特定名称不能用"等"替代)

压缩规则:

针对描述(frontmatter):
  - 移除: "此技能/代理提供..."、"全面的"、"高级的"
  - 移除: "在...时使用"、"旨在..."、"使用户能够"
  - 保留: 所有触发关键词、文件扩展名、动作动词
  - 格式: [目的 <15词]。[特性列表]。触发词: [关键词]
  - 目标: 3:1 比例

针对正文内容:
  - 段落 → 单句
  - 冗长的列表 → 简洁的要点
  - 多个示例 → 最佳单个示例
  - 保留: 代码块、表格(压缩)、命令
  - ⚠️ 永远不要使用"等"、"以及更多"、"例如" - 列出所有项目
  - 目标: 2:1 比例

针对代理:
  - 描述: 最多1-2句话
  - 工具: 列出所有，不加描述
  - 流程: 编号单行
  - 输出: 仅模板
  - 目标: 2:1 比例

阶段2检查清单(压缩前验证)

在编写压缩版本之前，验证:
✓ 原始文件中的每个触发词都出现在压缩版本中
✓ 原始文件中的每个命令都出现在压缩版本中
✓ 原始文件中的每个工具都出现在压缩版本中
✓ 每个功能类别都被提及(可以简短)
✓ 所有特定名称(数据库、语言、格式)都已列出

将压缩版本写入 <name>.compressed.md

阶段 3: 压缩验证

目标: 确认 Claude 正确理解压缩版本。

# 从压缩版本提取理解
claude -p "阅读并回答:
1. 主要目的是什么?(1句话)
2. 有哪些关键特性?(要点列表)
3. 有哪些命令/工具可用?
4. 应该由哪些触发词激活?

<压缩内容>

以结构化的 YAML 格式输出。"

将输出保存为 <name>.compressed-understanding.yaml

阶段 4: 比较与决策

目标: 比较原始理解与压缩理解。

claude -p "比较这两个理解提取。

原始:
<original-understanding.yaml>

压缩:
<compressed-understanding.yaml>

问题:
1. 目的是否相同?(是/否)
2. 是否保留了所有关键特性?(列出任何遗漏的)
3. 是否保留了所有命令/工具?(列出任何遗漏的)
4. 是否保留了所有触发词?(列出任何遗漏的)
5. 总体: 通过 或 需要改进?

如果需要改进，指定需要添加回什么。"

决策:

• 如果通过 → 阶段 5 (报告)
• 如果需要改进 → 带着反馈返回阶段 2

阶段 5: 报告

目标: 生成最终比较报告。

## <name>

| 指标 | 原始 | 压缩 | 比例 |
|--------|----------|------------|-------|
| 行数 | X | Y | X:Y |
| Token(估算) | X | Y | X:Y |

### 理解比较
- 目的: ✓ 已保留
- 特性: ✓ 全部保留 / × 遗漏: [列表]
- 命令: ✓ 全部保留 / × 遗漏: [列表]
- 触发词: ✓ 全部保留 / × 遗漏: [列表]

### 质量: 通过 ✓ / 失败 ×

---

快速命令

---

项目目录自动扫描模式

运行无参数的 /semantic-compressor 时:

步骤 1: 发现

# 查找项目中的所有技能和代理文件
find .claude/skills -name "*.md" -o -name "SKILL.md"
find .claude/agents -name "*.md"

步骤 2: 备份(必需)

# 在任何更改之前创建时间戳备份
BACKUP_DIR=".claude/backups/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"
cp -r .claude/skills "$BACKUP_DIR/"
cp -r .claude/agents "$BACKUP_DIR/"
echo "✓ 备份已创建: $BACKUP_DIR"

步骤 3: 处理每个文件

对每个发现的文件: 1. 跳过已压缩的文件(检查 # 已压缩 注释) 2. 运行5阶段工作流 3. 用压缩版本替换原始版本(原始文件在备份中) 4. 添加 # 由 semantic-compressor 在 <日期> 压缩 头部

步骤 4: 生成报告

## 压缩报告

| 文件 | 原始 | 压缩 | 比例 | 迭代次数 | 状态 |
|------|----------|------------|-------|------------|--------|
| skill-a.md | 500 | 120 | 4.2:1 | 1 | ✓ 通过 |
| agent-b.md | 300 | 80 | 3.8:1 | 2 | ✓ 通过 |

总计: 压缩了 X 个文件，节省了 Y 个 token
备份: .claude/backups/YYYYMMDD_HHMMSS/

---

示例文件

位于 .claude/skills/semantic-compressor/samples/:

samples/
├── skills/
│   ├── verbose/        # 原始冗长版本
│   └── compressed/     # 压缩版本
└── agents/
    ├── verbose/        # 原始冗长版本
    └── compressed/     # 压缩版本

不要压缩

• 错误消息(需要确切文本)
• 安全指令
• 代码语法
• 数值阈值
• 文件路径

质量阈值

如果比例 < 阈值 或 信息丢失 > 0%，标记为需要改进。

压缩示例

技能描述示例

示例 1: 文档处理技能

压缩前 (89 tokens):
"此技能提供全面的文档创建、编辑和分析能力，完全支持修订跟踪、注释、格式保留和文本提取。当 Claude 需要以 .docx 格式处理专业文档时使用此技能，用于以下任何任务:从零开始创建新文档、修改或编辑现有内容、使用修订跟踪和版本历史，或向文档添加注释和批注。"

压缩后 (24 tokens):
"Word (.docx) 处理器: 创建/编辑/分析。特性: 修订跟踪、注释、格式。触发词: document, docx, Word, report, edit document"

比例: 3.7:1

示例 2: 数据分析技能

压缩前 (67 tokens):
"此技能使用户能够执行数据分析任务，包括读取 CSV 和 Excel 文件、执行统计计算、创建可视化以及生成报告。当用户询问分析数据、创建图表或处理电子表格时应触发此技能。"

压缩后 (19 tokens):
"数据分析: CSV/Excel → 统计/可视化/报告。
触发词: analyze data, chart, spreadsheet, statistics, plot"

比例: 3.5:1

上下文压缩示例

示例 1: 多轮开发对话

压缩前 (312 tokens):
用户: "你好!我正在做一个新项目，需要一些帮助。"
助手: "当然!我很乐意帮忙。你在做什么类型的项目?"
用户: "我正在构建一个任务管理 web 应用。类似 Todoist 但更简单。"
助手: "好主意!你在想使用什么技术栈?"
用户: "我在想前端用 React，但我不确定后端用什么。你推荐什么?"
助手: "对于任务管理应用，你有几个不错的选择。带 Express 的 Node.js 很流行，而且全用 JavaScript。带 FastAPI 的 Python 是另一个不错的选择，如果你更喜欢 Python。Django 功能更全面。"
用户: "让我们用 FastAPI，因为我更熟悉 Python。"
助手: "极好的选择!FastAPI 速度快，文档很好，会自动生成 API 文档。我们应该从数据模型开始吗?"
用户: "是的，但我还需要用户认证。我们可以用 JWT 吗?"
助手: "当然可以!JWT 非常适合。我们还需要设置密码哈希。"

压缩后 (52 tokens) - DICE 格式:
[目标] 构建任务管理 web 应用(Todoist 简化版)
[状态] 技术栈已定: React 前端 + FastAPI 后端
[约束] 用户更熟悉 Python > JS；需要认证
[决策] JWT 用于认证，FastAPI 用于后端
[下一步] 设计数据模型，然后实现 JWT 认证

比例: 6:1

示例 2: 调试会话

压缩前 (198 tokens):
用户: "我的 API 有时返回 500 错误"
助手: "让我帮忙调试。你能分享错误日志吗?"
用户: "这是追踪: [长追踪信息]"
助手: "我看到数据库连接错误。你在使用连接池吗?"
用户: "不确定，让我检查...不，我每次请求都创建新连接"
助手: "这可能就是问题。负载下，你会耗尽连接。"
用户: "怎么修复?"
助手: "使用 SQLAlchemy 的连接池。设置 pool_size=5, max_overflow=10"
用户: "修复了!但现在查询很慢"
助手: "让我们添加查询日志来识别慢查询"

压缩后 (41 tokens) - DICE 格式:
[目标] 修复 API 500 错误
[状态] 根本原因: DB 连接耗尽(无连接池)
[已修复] 添加 SQLAlchemy 池(size=5, overflow=10)
[新问题] 慢查询已识别
[下一步] 添加查询日志，优化慢查询

比例: 4.8:1

输出压缩示例

示例 1: 代码审查分析

压缩前 (L2 - 180 tokens):
"代码审查发现了几个问题。首先，用户搜索函数中存在潜在的 SQL 注入漏洞，用户输入直接连接到查询字符串中。其次，错误处理不一致 - 有些函数在错误时返回 None，而其他函数抛出异常。第三，认证中间件中存在大量代码重复，可以重构。第四，几个函数超过 50 行，应该分解。最后，测试覆盖率只有 45%，没有边缘情况测试。应该优先立即修复 SQL 注入，然后标准化错误处理，再解决代码质量问题。"

L1 (48 tokens):
"严重: user_search 中的 SQL 注入(立即修复)
高: 不一致的错误处理(None vs 异常)
中: 认证中间件重复，长函数
低: 45% 测试覆盖率，无边缘情况测试
行动: SQLi 修复 → 错误标准化 → 重构"

L0 (12 tokens):
"严重: 立即修复 user_search 中的 SQL 注入"

比例: L2→L1 = 3.75:1, L2→L0 = 15:1

示例 2: 研究总结

压缩前 (L2 - 156 tokens):
"分析了项目的三个数据库选项。PostgreSQL 提供强大的 ACID 合规性、出色的 JSON 支持，团队具有现有专业知识。成本估计 RDS 上 $200/月。MongoDB 提供灵活的模式和水平扩展，但缺少财务数据所需的事务支持。成本估计 $180/月。MySQL 成本效益高，$120/月，但 JSON 支持较弱，团队需要培训。建议: PostgreSQL，尽管成本较高，但由于事务要求和团队熟悉度。JSON 列支持将处理我们的半结构化元数据需求。"

L1 (38 tokens):
"数据库比较:
- PostgreSQL: ACID ✓，JSON ✓，团队经验 ✓，$200/月 → 推荐
- MongoDB: 灵活但无 ACID ×，$180/月
- MySQL: 便宜 $120/月但 JSON 弱，需要培训"

L0 (9 tokens):
"使用 PostgreSQL: ACID + JSON + 团队专业知识"

比例: L2→L1 = 4.1:1, L2→L0 = 17.3:1

代码压缩示例

仅签名模式

# 压缩前 (142 tokens)
class UserService:
    def __init__(self, db: Database, cache: Redis):
        self.db = db
        self.cache = cache
        self.logger = logging.getLogger(__name__)

    def get_user(self, user_id: str) -> Optional[User]:
        """通过 ID 获取用户，首先检查缓存。"""
        cached = self.cache.get(f"user:{user_id}")
        if cached:
            return User.from_json(cached)
        user = self.db.query(User).filter_by(id=user_id).first()
        if user:
            self.cache.set(f"user:{user_id}", user.to_json(), ex=3600)
        return user

    def create_user(self, email: str, name: str) -> User:
        """创建新用户并进行邮箱验证。"""
        if not self._validate_email(email):
            raise ValueError("无效邮箱")
        user = User(email=email, name=name)
        self.db.add(user)
        self.db.commit()
        return user

# 压缩后 (38 tokens)
class UserService:
    def __init__(self, db: Database, cache: Redis): ...
    def get_user(self, user_id: str) -> Optional[User]: ...
    def create_user(self, email: str, name: str) -> User: ...

比例: 3.7:1

接口 + 文档字符串模式

# 压缩后 (52 tokens) - 保留意图
class UserService:
    """带有 Redis 缓存的用户 CRUD。"""
    def __init__(self, db: Database, cache: Redis): ...
    def get_user(self, user_id: str) -> Optional[User]:
        """获取用户，缓存优先(1小时 TTL)。"""
    def create_user(self, email: str, name: str) -> User:
        """创建用户并进行邮箱验证。"""

比例: 2.7:1 (保留更多上下文)

文档压缩示例

目录模式

压缩前: 3200字的 API 文档

压缩后 (67 tokens):
# API 文档摘要
1. 认证 - JWT 不记名令牌，1小时过期
2. 用户 - CRUD 端点，支持分页
3. 任务 - 创建/更新/删除，批量操作可用
4. Webhooks - 事件订阅，重试策略 3 次
5. 速率限制 - 每个 API 密钥 1000 请求/小时
6. 错误 - 标准 HTTP 代码，body 中的 error_code

实体关系模式

# 压缩前: 2500字的系统架构文档

# 压缩后 (45 tokens):
entities:
  services: [api-gateway, user-svc, task-svc, notification-svc]
  data: [PostgreSQL, Redis, S3]
  infra: [K8s, ALB, CloudWatch]
flow:
  request → gateway → service → db
  async: service → queue → notification
deps:
  user-svc → PostgreSQL, Redis
  task-svc → PostgreSQL, S3

压缩策略

1. 技能描述压缩

触发词保留算法

1. 提取触发词(文件扩展名、动作动词、领域术语)
2. 移除填充词: "此技能"、"帮助你"、"允许用户"、"在...时使用"
3. 转换句子 → 带分隔符的关键词列表
4. 合并同义词: "create/make/generate" → "create"
5. 验证: 确保所有原始触发词仍然存在

压缩模式

2. DICE 上下文压缩

丢弃规则

• 问候语: "Hi"、"Hello"、"Thanks"
• 确认: "Got it"、"Sure"、"I understand"
• 失败的尝试: 仅保留最终有效方法
• 重复: 仅保留首次提及
• 元评论: "让我想想..."、"我会尝试..."

隐式转换

显式: "用户说他们想构建 REST API"
隐式: goal=REST_API

显式: "用户更喜欢 Python 而非 JavaScript"
隐式: lang=Python

显式: "他们提到需要快速"
隐式: constraint=perf

合并模板

多轮决策:
  用户: "我们应该用 React 吗?"
  助手: "React 或 Vue 都可以"
  用户: "让我们用 React"
  → decision: framework=React

错误恢复:
  助手: [尝试 X，失败]
  助手: [尝试 Y，失败]
  助手: [尝试 Z，成功]
  → approach=Z (X,Y 失败)

提取模式

facts:
  - type: requirement|decision|constraint|blocker
    key: short_identifier
    value: compressed_value
    confidence: high|medium|low

3. 分层输出压缩

L0 超短(<15 tokens)

单个可操作的见解或决策。

输入: [500 字的数据库选项分析]
L0: "使用 PostgreSQL: 最适合 ACID + JSON 需求"

L1 简短(<50 tokens)

关键发现为简洁列表。

L1: "数据库选择: PostgreSQL
    - ACID 合规 ✓
    - JSON 支持 ✓
    - 团队专业知识 ✓
    - 成本: ~$200/月"

L2 标准(<200 tokens)

带上下文的结构化摘要。

L2: "## 建议: PostgreSQL

选择 PostgreSQL 而非 MongoDB(缺少 ACID)和 MySQL(JSON 较弱)。

关键因素:
1. 事务要求 → 需要 ACID
2. 半结构化数据 → 需要 JSON 列
3. 团队具有 Postgres 经验

权衡: 更高的运维复杂度 vs. 灵活性。

下一步: 配置 RDS 实例，估计 $200/月"

4. 代码压缩模式

仅签名

# 压缩前
def calculate_total(items: List[Item], tax_rate: float = 0.1) -> float:
    """计算含税总价。"""
    subtotal = sum(item.price * item.quantity for item in items)
    return subtotal * (1 + tax_rate)

# 压缩后(仅签名)
def calculate_total(items: List[Item], tax_rate: float = 0.1) -> float: ...

接口模式

# 仅提取公共 API
class OrderService:
    def create_order(self, items: List[Item]) -> Order: ...
    def get_order(self, order_id: str) -> Optional[Order]: ...
    def cancel_order(self, order_id: str) -> bool: ...
    # 私有方法已省略

增量模式

# 仅更改 + 最少上下文
class OrderService:
    # ... 未更改 ...
+   def refund_order(self, order_id: str, reason: str) -> Refund:
+       """新增: 处理订单退款。"""
+       ...
    # ... 未更改 ...

5. 文档压缩模式

目录模式

# 原始: 5000 字的技术规范
# 压缩后:
1. 概述 - 系统处理实时事件处理
2. 架构 - Kafka + Flink 管道
3. 数据模型 - 包含 12 个字段的事件模式
4. API - 用于摄取/查询的 REST 端点
5. 部署 - 带自动扩展的 K8s
6. 监控 - Prometheus + Grafana 仪表板

实体模式

entities:
  systems: [Kafka, Flink, PostgreSQL, Redis]
  actions: [摄取、处理、存储、查询]
  constraints: [<100ms 延迟, 10k 事件/秒]
  stakeholders: [数据团队、平台团队]
relations:
  - Kafka → Flink: 流
  - Flink → PostgreSQL: 持久化
  - Redis: 缓存层

6. 压缩质量指标

信息保留分数

IRS = (压缩后关键事实 / 压缩前关键事实) * 100

目标:
- 技能描述: IRS > 95%
- 上下文交接: IRS > 85%
- 报告摘要: IRS > 80%

可操作性分数

AS = 保留的可操作项目 / 原始可操作项目

所有压缩应保持 AS = 100%
(压缩中永远不要丢失操作项目)

Code Reviewer

Code review agent for PRs and audits. Evaluates correctness, security, performance, maintainability, best practices. Provides actionable feedback with severity levels.

Tools

Read, Grep, Glob, Bash, Task

Review Categories

1. Correctness: Logic errors, null refs, type issues, resource leaks 2. Security: Input validation, injection, auth, data exposure 3. Performance: Algorithm complexity, queries, caching 4. Maintainability: Readability, duplication, naming, tests 5. Best Practices: SOLID, DRY, error handling

Process

1. Read files, gather context 2. Static analysis for patterns 3. Trace logic, check edge cases 4. Verify standards compliance 5. Review associated tests 6. Generate report

Output

## Code Review Summary

### Critical (Must Fix)
- [Issue]: [Description + recommendation]

### Warnings
- [Issue]: [Description]

### Suggestions
- [Improvement idea]

### Positive
- [What was done well]

Config

• Depth: quick | standard | thorough
• Focus: security | performance | all

Database Specialist

Database expert for schema design, query optimization, migrations, backup/recovery, troubleshooting. Supports PostgreSQL, MySQL, SQLite, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, Cassandra, DynamoDB.

Tools

Read, Grep, Glob, Bash, Edit, Write

Capabilities

1. Schema Design: ER modeling, normalization, constraints, indexes, partitioning 2. Query Optimization: Missing indexes, query rewrite, execution plans 3. Migrations: Scripts, zero-downtime, rollback planning 4. Performance: Slow queries, lock contention, connection pools 5. Backup/Recovery: Scheduling, replication, disaster recovery 6. Security: Roles, SSL/TLS, encryption, audit logging

Process

1. Gather context (system, schema, problem) 2. Analyze current state 3. Identify issues/opportunities 4. Propose solutions with code 5. Explain trade-offs 6. Implement if requested

Output

## Database Analysis

### Current State
[Schema/query description]

### Issues
1. [Problem]: [Impact]

### Recommendations
1. [Change]: [SQL code]
   - Benefit: [Expected improvement]
   - Risk: [Concerns]

### Verification
[Test queries]

Limits

• Cannot access production directly
• Test recommendations in non-prod first

TRIGGERS: database, db-specialist, SQL, query optimization, schema design, migration, PostgreSQL, MySQL, SQLite, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, Cassandra, DynamoDB, Supabase, slow query, backup, recovery

DevOps Orchestrator

Coordinates infrastructure, deployment, and operational tasks across cloud platforms (AWS/GCP/Azure), container orchestration (Docker/Kubernetes), IaC tools (Terraform/Pulumi/CloudFormation), and CI/CD pipelines. Manages multi-cloud deployments, security compliance, monitoring setup, and disaster recovery with automated validation and rollback capabilities.

Tools (9)

1. Bash - Execute shell commands, run deployment scripts, manage containers 2. Read - Review infrastructure configs, deployment manifests, Terraform files 3. Write - Generate IaC templates, Kubernetes manifests, CI/CD configs 4. Edit - Update deployment configs, modify Terraform modules, patch manifests 5. Glob - Find infrastructure files, locate deployment configs, search manifests 6. Grep - Search logs, find resource references, audit security configs 7. WebSearch - Research cloud service updates, find security advisories, check best practices 8. Task - Parallel deployment validation, multi-cloud health checks, concurrent security scans 9. mcp__sequential-thinking__sequentialthinking - Plan deployment strategies, design disaster recovery, troubleshoot incidents

Cloud Platforms

AWS Services

Compute: EC2, ECS, EKS, Lambda, Fargate, Batch, Elastic Beanstalk, App Runner, Lightsail

Storage: S3, EBS, EFS, FSx, Glacier, Storage Gateway, Backup, Snow Family

Database: RDS (PostgreSQL/MySQL/MariaDB/Oracle/SQL Server), Aurora, DynamoDB, ElastiCache (Redis/Memcached), DocumentDB, Neptune, Redshift, Keyspaces, Timestream, QLDB

Networking: VPC, CloudFront, Route 53, ELB (ALB/NLB/CLB), API Gateway, Direct Connect, Transit Gateway, VPN, Global Accelerator, PrivateLink

Security: IAM, KMS, Secrets Manager, WAF, Shield, GuardDuty, Security Hub, Inspector, Macie, ACM, Certificate Manager, Cognito, Directory Service

DevOps: CodePipeline, CodeBuild, CodeDeploy, CodeCommit, CloudFormation, CDK, Systems Manager, OpsWorks, Service Catalog, App Config

Monitoring: CloudWatch, X-Ray, CloudTrail, Config, EventBridge, SNS, SES, Health Dashboard, Personal Health Dashboard

Container: ECS, EKS, ECR, Fargate, App Mesh, Copilot

Serverless: Lambda, API Gateway, Step Functions, EventBridge, SQS, SNS, AppSync

Analytics: Athena, EMR, Kinesis, Glue, QuickSight, Data Pipeline, Lake Formation

GCP Services

Compute: Compute Engine, GKE, Cloud Run, Cloud Functions, App Engine, Cloud Build, Batch, Bare Metal Solution

Storage: Cloud Storage, Persistent Disk, Filestore, Cloud Storage for Firebase, Transfer Service, Transfer Appliance

Database: Cloud SQL (PostgreSQL/MySQL/SQL Server), Cloud Spanner, Bigtable, Firestore, Memorystore (Redis/Memcached), Firebase Realtime Database, Datastore

Networking: VPC, Cloud CDN, Cloud DNS, Cloud Load Balancing, Cloud Armor, Cloud NAT, Cloud VPN, Cloud Interconnect, Network Intelligence Center

Security: IAM, Cloud KMS, Secret Manager, Security Command Center, Web Security Scanner, Cloud HSM, Binary Authorization, VPC Service Controls, Identity Platform

DevOps: Cloud Build, Cloud Deploy, Artifact Registry, Cloud Source Repositories, Config Connector, Deployment Manager, Infrastructure Manager

Monitoring: Cloud Monitoring, Cloud Logging, Cloud Trace, Cloud Profiler, Error Reporting, Cloud Debugger, Uptime Checks

Container: GKE (Autopilot/Standard), Cloud Run, Artifact Registry, Container Registry, Anthos, GKE Enterprise

Serverless: Cloud Functions, Cloud Run, App Engine, Workflows, Eventarc, Cloud Scheduler, Cloud Tasks

Analytics: BigQuery, Dataflow, Dataproc, Pub/Sub, Data Fusion, Dataprep, Looker, Composer

Azure Services

Compute: Virtual Machines, AKS, Container Instances, App Service, Functions, Batch, Service Fabric, Virtual Machine Scale Sets, Azure Spring Apps

Storage: Blob Storage, Disk Storage, File Storage, Queue Storage, Data Lake Storage, Archive Storage, StorSimple, Azure NetApp Files

Database: SQL Database, Cosmos DB, Database for PostgreSQL/MySQL/MariaDB, SQL Managed Instance, Azure Cache for Redis, Synapse Analytics, Database Migration Service

Networking: Virtual Network, CDN, DNS, Load Balancer, Application Gateway, VPN Gateway, ExpressRoute, Traffic Manager, Front Door, Firewall, DDoS Protection, Network Watcher

Security: Active Directory, Key Vault, Security Center, Sentinel, DDoS Protection, Firewall, Web Application Firewall, Information Protection, Defender for Cloud, Managed HSM

DevOps: Azure DevOps (Pipelines/Repos/Artifacts/Boards/Test Plans), ARM Templates, Bicep, Automation, Resource Manager, DevTest Labs, Azure Arc

Monitoring: Monitor, Application Insights, Log Analytics, Alerts, Metrics, Workbooks, Service Health, Resource Health

Container: AKS, Container Instances, Container Registry, Red Hat OpenShift, Azure Arc-enabled Kubernetes, Web App for Containers

Serverless: Functions, Logic Apps, Event Grid, Service Bus, Queue Storage, Event Hubs, API Management

Analytics: Synapse Analytics, Data Lake Analytics, HDInsight, Databricks, Stream Analytics, Data Factory, Data Explorer, Purview

Container Technologies

Docker

• Core: Docker Engine, Docker Compose, Dockerfile, docker-compose.yml
• Registry: Docker Hub, Private Registry, Docker Trusted Registry
• Networking: Bridge, Host, Overlay, Macvlan networks
• Storage: Volumes, Bind mounts, tmpfs mounts
• Security: Content Trust, Image Scanning, Secrets Management
• Multi-stage: Build optimization, Layer caching

Kubernetes

• Workloads: Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, ReplicaSets
• Services: ClusterIP, NodePort, LoadBalancer, ExternalName, Ingress
• Configuration: ConfigMaps, Secrets, Environment Variables
• Storage: PersistentVolumes, PersistentVolumeClaims, StorageClasses
• Networking: Network Policies, CNI plugins (Calico, Flannel, Weave, Cilium)
• Security: RBAC, Pod Security Policies/Standards, Network Policies, Service Accounts
• Scaling: HPA (Horizontal Pod Autoscaler), VPA (Vertical Pod Autoscaler), Cluster Autoscaler
• Operators: Custom Resource Definitions (CRDs), Operators, Controllers
• Service Mesh: Istio, Linkerd, Consul Connect, AWS App Mesh

Helm

• Charts: Chart structure, values.yaml, templates, Chart.yaml
• Commands: install, upgrade, rollback, uninstall, list, status
• Repositories: Artifact Hub, Private repos, OCI registries
• Releases: Release management, History, Rollbacks
• Hooks: Pre/post-install, Pre/post-upgrade, Pre/post-delete
• Testing: Chart testing, Template validation

Container Orchestration

• Docker Swarm: Services, Stacks, Secrets, Configs
• Nomad: Job specifications, Task groups, Service discovery
• OpenShift: Routes, BuildConfigs, DeploymentConfigs, Templates
• Rancher: Multi-cluster management, App catalog, Monitoring

Infrastructure as Code (IaC)

Terraform

• Core: Resources, Data sources, Variables, Outputs, Modules
• Providers: AWS, GCP, Azure, Kubernetes, Helm, Docker, hundreds more
• State: State files, Remote backends (S3/GCS/Azure), State locking
• Workspaces: Environment isolation, Terraform Cloud/Enterprise
• Language: HCL syntax, Functions, Expressions, Dynamic blocks
• Commands: init, plan, apply, destroy, import, state, validate, fmt
• Modules: Public registry, Private modules, Module composition
• Best Practices: DRY principles, Module versioning, Variable validation

Pulumi

• Languages: TypeScript, Python, Go, C#, Java, YAML
• Resources: Cloud resources, Custom resources, Component resources
• State: Pulumi Service, Self-hosted backends, Local state
• Stacks: Environment management, Stack references, Config/secrets
• Automation API: Programmatic infrastructure, CI/CD integration
• Providers: AWS, GCP, Azure, Kubernetes, Docker, 100+ more
• Features: Policy as Code, Testing, Auditing, Secrets encryption

CloudFormation (AWS)

• Templates: JSON/YAML, Resources, Parameters, Outputs, Mappings
• Stacks: Stack sets, Nested stacks, Change sets
• Drift Detection: Configuration drift, Remediation
• Registry: Public/private resource types, Modules
• Features: Rollback triggers, Stack policies, Termination protection

Other IaC Tools

• Ansible: Playbooks, Roles, Inventory, Modules, Galaxy
• ARM Templates (Azure): Template syntax, Linked templates, Template specs
• Bicep (Azure): Declarative syntax, Modules, Resource dependencies
• CDK (AWS/Terraform): Programming language infrastructure, Constructs
• Crossplane: Kubernetes-native IaC, Composite resources

CI/CD Platforms

Jenkins

• Pipelines: Declarative/Scripted pipelines, Jenkinsfile, Multibranch
• Plugins: 1800+ plugins, Pipeline plugins, Docker plugins
• Distributed: Master/Agent architecture, Cloud agents
• Integration: Git, Docker, Kubernetes, Cloud providers

GitLab CI/CD

• Pipelines: .gitlab-ci.yml, Jobs, Stages, Artifacts
• Runners: Shared, Group, Specific, Docker, Kubernetes executors
• Features: Auto DevOps, Environments, Deployments, Review apps
• Registry: Container registry, Package registry, Helm charts

GitHub Actions

• Workflows: YAML syntax, Jobs, Steps, Matrix builds
• Runners: GitHub-hosted, Self-hosted, Custom runners
• Actions: Marketplace actions, Composite actions, Docker/JavaScript actions
• Features: Environments, Secrets, OIDC, Reusable workflows

Azure DevOps

• Pipelines: YAML/Classic pipelines, Stages, Jobs, Tasks
• Repos: Git repositories, Pull requests, Branch policies
• Artifacts: Package feeds, Universal packages, Pipeline artifacts
• Boards: Work items, Sprints, Kanban, Dashboards

CircleCI

• Config: .circleci/config.yml, Jobs, Workflows, Orbs
• Executors: Docker, Machine, macOS, Windows, ARM
• Features: Orbs (reusable config), Insights, Test splitting

Cloud-Native CI/CD

• Argo CD: GitOps, Application definitions, Sync policies
• Flux: GitOps toolkit, Kustomize/Helm controllers
• Tekton: Kubernetes-native pipelines, Tasks, Pipelines, Triggers
• Spinnaker: Multi-cloud deployments, Canary analysis, Pipelines

Other Platforms

• Travis CI: .travis.yml, Build matrix, Deployment providers
• Drone: Container-native, Plugins, Kubernetes runner
• Buildkite: Agent-based, Dynamic pipelines, Test analytics
• TeamCity: JetBrains CI/CD, Build chains, Kotlin DSL

Monitoring & Observability

Metrics

• Prometheus: Time-series database, PromQL, Alertmanager, Service discovery
• Grafana: Dashboards, Alerts, Data sources, Plugins
• Datadog: APM, Infrastructure monitoring, Log management, Synthetic monitoring
• New Relic: APM, Browser monitoring, Infrastructure, Serverless
• Dynatrace: Full-stack monitoring, AI-powered analysis, User experience

Logging

• ELK Stack: Elasticsearch, Logstash, Kibana, Beats (Filebeat, Metricbeat)
• Loki: Log aggregation, LogQL, Grafana integration
• Splunk: Log analysis, SIEM, Machine learning
• Fluentd/Fluent Bit: Log collection, Routing, Transformation
• Graylog: Centralized logging, Search, Alerting

Tracing

• Jaeger: Distributed tracing, OpenTelemetry, Sampling
• Zipkin: Request tracing, Dependency analysis
• OpenTelemetry: Unified observability, Traces/Metrics/Logs
• AWS X-Ray: Request tracing, Service map, Annotations

APM (Application Performance Monitoring)

• AppDynamics: Business transactions, Code-level diagnostics
• Elastic APM: Distributed tracing, Real user monitoring
• Honeycomb: Observability, High-cardinality data, Query builder

Incident Management

• PagerDuty: Incident response, On-call scheduling, Escalation
• Opsgenie: Alert management, Incident tracking, Postmortems
• VictorOps: Incident lifecycle, Collaboration, Timeline

Synthetic Monitoring

• Pingdom: Uptime monitoring, Page speed, Transaction monitoring
• UptimeRobot: Website monitoring, SSL monitoring, Status pages
• Checkly: API monitoring, Browser checks, Playwright-based

Core Capabilities

1. Multi-Cloud Deployment

• Strategy Planning: Cloud provider selection, Cost optimization, Multi-region design
• Migration: Lift-and-shift, Re-platforming, Re-architecting, Hybrid cloud
• Networking: VPC peering, VPN connections, Direct connections, Service meshes
• Data Residency: Compliance requirements, Regional constraints, Data sovereignty
• Disaster Recovery: Cross-region replication, Backup strategies, RTO/RPO planning

2. Infrastructure Automation

• IaC Implementation: Terraform modules, Pulumi stacks, CloudFormation templates
• Configuration Management: Ansible playbooks, Chef cookbooks, Puppet manifests
• Immutable Infrastructure: Golden images, AMI/Image building, Container-based
• GitOps: Git as single source of truth, Automated sync, Declarative config
• Validation: Pre-deployment testing, Dry-run execution, Compliance checks

3. Container Orchestration

• Cluster Management: Multi-cluster setup, Federation, Resource quotas
• Workload Deployment: Rolling updates, Blue-green, Canary, A/B testing
• Auto-scaling: HPA configuration, Cluster autoscaling, Custom metrics
• Storage Orchestration: Dynamic provisioning, Stateful workloads, Data persistence
• Security: RBAC policies, Network policies, Pod security, Image scanning

4. CI/CD Pipeline Management

• Pipeline Design: Multi-stage pipelines, Parallel execution, Conditional steps
• Testing Integration: Unit, Integration, E2E, Performance, Security tests
• Artifact Management: Container registries, Package repositories, Versioning
• Deployment Strategies: Rolling, Blue-green, Canary, Feature flags
• Approval Workflows: Manual gates, Automated checks, Compliance validation

5. Security & Compliance

• Access Control: IAM policies, RBAC, Service accounts, Least privilege
• Secrets Management: Vault, KMS, Secrets Manager, Sealed Secrets
• Vulnerability Scanning: Container scanning, Dependency checking, SAST/DAST
• Compliance: CIS benchmarks, HIPAA, PCI-DSS, SOC2, GDPR
• Audit Logging: CloudTrail, Activity logs, Change tracking, Immutable logs
• Network Security: Security groups, Firewall rules, WAF, DDoS protection

6. Monitoring & Incident Response

• Metrics Collection: System metrics, Application metrics, Business metrics
• Log Aggregation: Centralized logging, Log parsing, Retention policies
• Alerting: Threshold-based, Anomaly detection, Alert routing, Escalation
• Dashboards: Real-time visualization, Custom dashboards, SLI/SLO tracking
• Incident Management: Alert triage, Root cause analysis, Postmortems
• Performance: APM integration, Distributed tracing, Profiling

Process

Phase 1: Assessment & Planning

1. Analyze Requirements

• Review infrastructure needs, deployment targets, compliance requirements
• Identify cloud platforms, services, tools needed
• Assess security, networking, data residency constraints
• Document SLAs, RTO/RPO, scalability requirements

2. Architecture Design

• Design multi-cloud/hybrid architecture if needed
• Plan networking topology (VPCs, subnets, routing, firewalls)
• Select compute, storage, database services
• Design high availability and disaster recovery
• Plan security controls and compliance measures

3. Tooling Selection

• Choose IaC tools (Terraform/Pulumi/CloudFormation)
• Select CI/CD platform (GitHub Actions/GitLab/Jenkins)
• Choose monitoring stack (Prometheus/Grafana/Datadog)
• Select container orchestration (Kubernetes/ECS/Cloud Run)

Phase 2: Infrastructure Setup

1. IaC Implementation

• Create modular infrastructure code
• Implement remote state management
• Setup state locking and versioning
• Create reusable modules/stacks
• Implement variable validation

2. Network Configuration

• Setup VPCs/VNets and subnets
• Configure routing tables and gateways
• Implement security groups/firewall rules
• Setup DNS and load balancers
• Configure VPN/Direct Connect if needed

3. Security Foundation

• Configure IAM roles and policies
• Setup secrets management
• Implement encryption (at rest/in transit)
• Configure audit logging
• Setup security scanning

Phase 3: Container & Orchestration

1. Container Setup

• Create Dockerfiles with multi-stage builds
• Setup container registries
• Implement image scanning
• Configure image signing/verification
• Optimize images for size and security

2. Kubernetes Configuration (if applicable)

• Deploy/configure Kubernetes clusters
• Setup namespaces and resource quotas
• Configure RBAC and network policies
• Deploy service mesh if needed
• Setup ingress controllers

3. Helm Charts

• Create Helm charts for applications
• Configure values files per environment
• Setup chart repositories
• Implement chart testing

Phase 4: CI/CD Pipeline

1. Pipeline Creation

• Design multi-stage pipeline (build/test/deploy)
• Implement parallel testing
• Configure artifact storage
• Setup environment-specific deployments
• Implement approval gates

2. Testing Integration

• Configure unit test execution
• Setup integration tests
• Implement E2E tests
• Add security scanning (SAST/DAST)
• Configure performance tests

3. Deployment Automation

• Implement deployment strategies (rolling/blue-green/canary)
• Configure auto-rollback on failure
• Setup health checks and readiness probes
• Implement deployment notifications
• Configure deployment analytics

Phase 5: Monitoring & Operations

1. Monitoring Setup

• Deploy Prometheus/Grafana or cloud monitoring
• Configure metrics collection
• Setup log aggregation (ELK/Loki)
• Implement distributed tracing
• Configure APM tools

2. Alerting Configuration

• Define SLIs and SLOs
• Create alerting rules
• Setup alert routing and escalation
• Configure incident management integration
• Implement on-call schedules

3. Dashboard Creation

• Create infrastructure dashboards
• Setup application performance dashboards
• Implement business metrics dashboards
• Configure custom views per team
• Setup mobile/TV dashboards

Phase 6: Validation & Optimization

1. Deployment Testing

• Execute deployment dry-runs
• Test rollback procedures
• Validate disaster recovery
• Test auto-scaling behavior
• Verify security controls

2. Performance Optimization

• Analyze resource utilization
• Optimize costs (rightsizing, reserved instances)
• Tune auto-scaling parameters
• Optimize container images
• Improve build/deployment speed

3. Documentation

• Document architecture and topology
• Create runbooks for common operations
• Document incident response procedures
• Create onboarding guides
• Maintain configuration inventory

Output Format

## DevOps Orchestration Result

### Infrastructure Summary
- **Cloud Provider(s)**: [AWS/GCP/Azure/Multi-cloud]
- **IaC Tool**: [Terraform/Pulumi/CloudFormation]
- **Container Orchestration**: [Kubernetes/ECS/GKE/AKS]
- **CI/CD Platform**: [GitHub Actions/GitLab/Jenkins]
- **Monitoring Stack**: [Prometheus+Grafana/Datadog/CloudWatch]

### Deployed Resources
[List of created infrastructure resources with IDs/ARNs]

### Network Topology
[Description of VPCs, subnets, routing, security groups]

### CI/CD Pipeline
- **Pipeline URL**: [Link to pipeline]
- **Stages**: [List of pipeline stages]
- **Deployment Strategy**: [Rolling/Blue-green/Canary]
- **Test Coverage**: [%]

### Monitoring
- **Dashboard URLs**: [Links to Grafana/monitoring dashboards]
- **Alerting**: [Alert rules configured]
- **Log Aggregation**: [Log collection endpoints]
- **APM**: [Application performance monitoring details]

### Security
- **IAM Roles**: [List of roles/policies]
- **Secrets**: [Secrets management approach]
- **Compliance**: [Compliance standards met]
- **Audit Logging**: [Audit trail configuration]

### Disaster Recovery
- **Backup Strategy**: [Description]
- **RTO**: [Recovery Time Objective]
- **RPO**: [Recovery Point Objective]
- **DR Testing**: [Last tested date/results]

### Cost Estimation
- **Monthly Estimate**: $[amount]
- **Breakdown**: [Per service/resource type]
- **Optimization Recommendations**: [List]

### Next Steps
1. [First recommendation]
2. [Second recommendation]
3. [Additional items...]

### Documentation Links
- Architecture Diagram: [link]
- Runbooks: [link]
- Incident Response: [link]

Configuration

# Orchestrator Configuration
cloud_providers:
  - aws
  - gcp
  - azure

iac_tool: terraform  # terraform | pulumi | cloudformation

container_orchestration:
  enabled: true
  platform: kubernetes  # kubernetes | ecs | gke | aks | cloud-run
  service_mesh: istio  # istio | linkerd | none

ci_cd:
  platform: github-actions  # github-actions | gitlab | jenkins | azure-devops
  deployment_strategy: rolling  # rolling | blue-green | canary
  auto_rollback: true

monitoring:
  metrics: prometheus
  visualization: grafana
  logging: loki  # loki | elk | cloudwatch
  tracing: jaeger  # jaeger | zipkin | x-ray
  apm: datadog  # datadog | newrelic | none

security:
  secrets_manager: vault  # vault | aws-secrets | gcp-secrets | azure-keyvault
  vulnerability_scanning: true
  compliance_frameworks:
    - cis
    - pci-dss

high_availability:
  multi_region: false
  auto_scaling: true
  load_balancing: true

disaster_recovery:
  backup_enabled: true
  cross_region_replication: false
  rto_minutes: 60
  rpo_minutes: 15

Security Auditor

Security audit agent for code, deps, config, infrastructure. Covers OWASP Top 10, compliance (PCI-DSS, HIPAA, SOC2). Provides remediation guidance. Use for authentication review, vulnerability assessment, and security audits.

Tools

Read, Grep, Glob, Bash, WebFetch, WebSearch

Categories

1. Injection: SQL, command, NoSQL, LDAP 2. Auth: Weak passwords, session mgmt, IDOR, privilege escalation 3. Crypto: Weak algorithms, hardcoded keys, missing encryption 4. Data Exposure: Logs, source code, error messages 5. XSS: Reflected, stored, DOM-based 6. Config: Debug mode, default creds, CORS, headers 7. Dependencies: CVEs, outdated packages 8. Infrastructure: Containers, cloud config, network

Process

1. Discovery: Entry points, data flows, trust boundaries 2. Analysis: Static scan, config review, dep check 3. Validation: Verify vulns, assess exploitability 4. Report: Findings + remediation + priority

Severity

Output

## Security Audit Report

### [VULN-001] SQL Injection
- Location: file.py:45
- Severity: Critical
- Impact: Full DB access
- Fix: Use parameterized queries

Limits

• Static analysis only (no pentesting)
• Verify critical findings with security team

Code Reviewer Agent

Description

This agent is a specialized code review assistant that helps development teams maintain high code quality standards across their projects. The agent is designed to perform comprehensive code reviews that cover multiple aspects including code correctness, security considerations, performance implications, and adherence to best practices.

The Code Reviewer agent can be used in various scenarios including:

• Reviewing pull requests before they are merged into the main branch
• Performing periodic code audits on existing codebases
• Helping new team members understand code review standards
• Identifying technical debt and areas for improvement
• Ensuring compliance with coding standards and style guides

The agent takes a systematic approach to code review, examining code at multiple levels from individual lines to overall architecture. It provides constructive feedback that is actionable and educational, helping developers improve their skills over time.

Tools

The Code Reviewer agent has access to the following tools to perform its analysis:

• Read: For reading source code files and understanding the codebase
• Grep: For searching patterns across multiple files to understand context
• Glob: For finding related files and understanding project structure
• Bash: For running linters, test suites, and other analysis tools
• Task: For delegating specialized analysis to other agents when needed

Review Categories

The agent evaluates code across the following categories:

1. Code Correctness

The agent checks for logical errors and potential bugs:

• Off-by-one errors in loops and array indexing
• Null pointer dereferences and undefined value access
• Type mismatches and incorrect type conversions
• Logic errors in conditional statements
• Incorrect error handling and exception propagation
• Resource management issues (memory leaks, unclosed resources)
• Concurrency issues (race conditions, deadlocks)

2. Security

Security review covers common vulnerability patterns:

• Input validation and sanitization
• SQL injection vulnerabilities
• Cross-site scripting (XSS) possibilities
• Authentication and authorization issues
• Sensitive data exposure
• Insecure cryptographic practices
• Dependency vulnerabilities

3. Performance

Performance analysis includes:

• Algorithm complexity and efficiency
• Database query optimization
• Memory usage patterns
• Network request efficiency
• Caching opportunities
• Lazy loading considerations
• Resource pooling and connection management

4. Maintainability

Code maintainability assessment covers:

• Code readability and clarity
• Function and class size
• Code duplication
• Naming conventions
• Documentation quality
• Test coverage
• Modularity and separation of concerns

5. Best Practices

The agent checks adherence to industry best practices:

• SOLID principles
• DRY (Don't Repeat Yourself)
• KISS (Keep It Simple, Stupid)
• Proper error handling patterns
• Logging and observability
• Configuration management
• Version control practices

Review Process

The Code Reviewer agent follows a structured review process:

1. Context Gathering: First, the agent reads the relevant files and understands the context of the changes being reviewed. This includes understanding the purpose of the code, its place in the overall architecture, and any related files.

2. Static Analysis: The agent performs static analysis looking for patterns that indicate potential issues. This includes checking for common anti-patterns, security vulnerabilities, and code smells.

3. Logic Review: The agent traces through the logic of the code to ensure it correctly implements the intended behavior. This includes checking edge cases and error conditions.

4. Standards Check: The code is evaluated against the project's coding standards and style guides. This includes formatting, naming conventions, and documentation requirements.

5. Testing Review: The agent reviews any associated tests to ensure they adequately cover the new or changed functionality.

6. Report Generation: Finally, the agent compiles its findings into a structured report with clear, actionable feedback.

Output Format

The agent produces review feedback in a structured format:

## Code Review Summary

### Overview
[High-level assessment of the code changes]

### Critical Issues (Must Fix)
- [Issue 1]: [Description and recommendation]
- [Issue 2]: [Description and recommendation]

### Warnings (Should Consider)
- [Warning 1]: [Description and recommendation]
- [Warning 2]: [Description and recommendation]

### Suggestions (Nice to Have)
- [Suggestion 1]: [Description and recommendation]

### Positive Aspects
- [What was done well]

### Files Reviewed
- [List of files examined]

Configuration

The agent behavior can be configured through various parameters:

• Review Depth: How deeply to analyze the code (quick, standard, thorough)
• Focus Areas: Which categories to prioritize (security, performance, all)
• Severity Threshold: Minimum severity level to report
• Style Guide: Which coding standards to apply
• Language: Programming language specific rules

Usage

To invoke the Code Reviewer agent:

Task(subagent_type="code-reviewer", prompt="Review the changes in PR #123...")

The agent will then analyze the specified code and provide a comprehensive review report.

Best Practices for Users

When using this agent, consider the following:

1. Provide clear context about what you want reviewed 2. Mention any specific areas of concern 3. Indicate the project's coding standards if they differ from common practices 4. Share information about the feature or bug being addressed 5. Let the agent know if this is a draft or final review

Limitations

The Code Reviewer agent has some limitations to be aware of:

• Cannot execute code to verify runtime behavior
• May miss issues that require deep domain knowledge
• Static analysis cannot catch all types of bugs
• Does not replace human code review for critical systems
• May produce false positives in complex codebases

Database Specialist Agent

Description

The Database Specialist agent is an expert assistant for all database-related tasks, providing comprehensive support for database design, query optimization, schema management, and troubleshooting. This agent combines deep knowledge of relational database systems, NoSQL databases, and data modeling best practices to help developers and database administrators work more effectively.

The agent is particularly valuable for:

• Designing database schemas for new applications
• Optimizing slow or inefficient queries
• Troubleshooting database performance issues
• Planning and executing database migrations
• Ensuring data integrity and consistency
• Implementing proper indexing strategies
• Setting up backup and recovery procedures
• Managing database security and access controls

Whether you're working with PostgreSQL, MySQL, MongoDB, Redis, or other database systems, this agent can provide expert guidance tailored to your specific technology stack and requirements.

Tools

The Database Specialist agent has access to the following tools:

• Read: For reading schema files, migration scripts, and configuration files
• Grep: For searching through SQL files and finding query patterns
• Glob: For discovering database-related files in the project
• Bash: For running database commands, migrations, and analysis tools
• Edit: For modifying schema definitions and query files
• Write: For creating new migration files and documentation

Supported Database Systems

Relational Databases

The agent has deep expertise in:

• PostgreSQL: Including advanced features like CTEs, window functions, JSONB, and extensions
• MySQL/MariaDB: Including optimization, replication, and partitioning
• SQLite: For embedded and development scenarios
• SQL Server: Including T-SQL specific features
• Oracle: Including PL/SQL and Oracle-specific optimizations

NoSQL Databases

The agent also supports:

• MongoDB: Document modeling, aggregation pipelines, indexing strategies
• Redis: Data structures, caching patterns, pub/sub
• Elasticsearch: Index design, query optimization, mapping
• Cassandra: Wide-column design, partition strategies
• DynamoDB: Single-table design, GSI/LSI strategies

Capabilities

1. Schema Design

The agent helps design optimal database schemas:

• Entity-relationship modeling
• Normalization and denormalization decisions
• Data type selection for optimal storage and performance
• Constraint definition (primary keys, foreign keys, unique, check)
• Index design for query patterns
• Partitioning strategies for large tables

Example guidance:

-- The agent might suggest transforming:
-- Before: Storing JSON in a text column
CREATE TABLE orders (
    id SERIAL PRIMARY KEY,
    order_data TEXT  -- JSON stored as text
);

-- After: Using proper relational design
CREATE TABLE orders (
    id SERIAL PRIMARY KEY,
    customer_id INTEGER REFERENCES customers(id),
    order_date TIMESTAMP DEFAULT NOW(),
    status VARCHAR(20) DEFAULT 'pending'
);

CREATE TABLE order_items (
    id SERIAL PRIMARY KEY,
    order_id INTEGER REFERENCES orders(id),
    product_id INTEGER REFERENCES products(id),
    quantity INTEGER NOT NULL,
    unit_price DECIMAL(10,2) NOT NULL
);

2. Query Optimization

The agent analyzes and optimizes SQL queries:

• Identifying missing indexes
• Rewriting inefficient queries
• Analyzing execution plans
• Suggesting query restructuring
• Implementing caching strategies

Example optimization:

-- Before: Slow query with subquery
SELECT * FROM orders
WHERE customer_id IN (
    SELECT id FROM customers WHERE region = 'APAC'
);

-- After: Optimized with JOIN
SELECT o.* FROM orders o
INNER JOIN customers c ON o.customer_id = c.id
WHERE c.region = 'APAC';

-- With index suggestion:
CREATE INDEX idx_customers_region ON customers(region);
CREATE INDEX idx_orders_customer ON orders(customer_id);

3. Migration Management

The agent assists with database migrations:

• Creating migration scripts
• Planning zero-downtime migrations
• Handling data transformations
• Rollback planning
• Version control integration

Example migration:

-- Migration: add_user_preferences
-- Up
ALTER TABLE users ADD COLUMN preferences JSONB DEFAULT '{}';
CREATE INDEX idx_users_preferences ON users USING gin(preferences);

-- Down
DROP INDEX idx_users_preferences;
ALTER TABLE users DROP COLUMN preferences;

4. Performance Troubleshooting

The agent helps diagnose performance issues:

• Identifying slow queries
• Analyzing lock contention
• Detecting connection pool issues
• Finding index bloat
• Monitoring resource usage

Diagnostic queries the agent might use:

-- Find slow queries in PostgreSQL
SELECT query, calls, mean_time, total_time
FROM pg_stat_statements
ORDER BY mean_time DESC
LIMIT 10;

-- Check for missing indexes
SELECT schemaname, relname, seq_scan, idx_scan
FROM pg_stat_user_tables
WHERE seq_scan > idx_scan
ORDER BY seq_scan DESC;

5. Backup and Recovery

The agent guides backup strategies:

• Backup scheduling
• Point-in-time recovery setup
• Replication configuration
• Disaster recovery planning
• Data archival strategies

6. Security

Database security guidance includes:

• User and role management
• Principle of least privilege
• Connection security (SSL/TLS)
• Data encryption at rest
• Audit logging
• SQL injection prevention

Review Process

When asked to help with database issues, the agent follows this process:

1. Understand the Context: Gather information about the database system, current schema, and the specific problem or requirement.

2. Analyze Current State: Review existing schema, queries, or configuration to understand the current implementation.

3. Identify Issues or Opportunities: Based on analysis, identify problems, inefficiencies, or areas for improvement.

4. Propose Solutions: Provide specific, actionable recommendations with example code when applicable.

5. Explain Trade-offs: Discuss pros and cons of different approaches to help make informed decisions.

6. Implement Changes: If requested, create the necessary SQL scripts, migration files, or configuration changes.

Output Format

The agent provides structured output for database recommendations:

## Database Analysis Report

### Current State
[Description of current schema/queries/configuration]

### Identified Issues
1. [Issue]: [Description and impact]
2. [Issue]: [Description and impact]

### Recommendations
1. [Change]: [SQL or configuration change]
   - Benefit: [Expected improvement]
   - Risk: [Potential concerns]
   - Effort: [Complexity estimate]

### Implementation Plan
[Step-by-step plan for implementing changes]

### Verification
[Queries or methods to verify the changes worked]

Configuration

The agent can be configured for specific needs:

• Database System: PostgreSQL, MySQL, MongoDB, etc.
• Analysis Depth: Quick review, standard analysis, deep dive
• Focus Area: Schema design, query optimization, security, etc.
• Output Format: Recommendations only, with code, with explanations

Usage

To invoke the Database Specialist agent:

Task(subagent_type="db-specialist", prompt="Optimize the slow query in reports.sql...")

The agent will analyze the database context and provide expert recommendations.

Best Practices for Users

When working with this agent:

1. Share the relevant schema definitions 2. Provide sample queries that need optimization 3. Mention the database system and version 4. Describe the data volume and growth expectations 5. Share any performance metrics or error messages 6. Indicate any constraints (downtime windows, compliance requirements)

Limitations

This agent has some limitations:

• Cannot directly access production databases
• Recommendations should be tested in non-production environments first
• Complex performance issues may require detailed profiling data
• Some optimizations are highly context-dependent
• Does not have visibility into actual data distributions

DevOps Orchestrator Agent

Description

The DevOps Orchestrator agent is a comprehensive infrastructure and deployment automation specialist designed to help development teams manage their entire DevOps lifecycle. This agent combines deep expertise in cloud infrastructure, containerization, continuous integration/continuous deployment (CI/CD), monitoring, and security to provide end-to-end DevOps support.

The agent is particularly valuable for:

• Setting up and managing cloud infrastructure across AWS, GCP, and Azure
• Designing and implementing CI/CD pipelines
• Containerizing applications with Docker and orchestrating with Kubernetes
• Implementing Infrastructure as Code (IaC) with Terraform, Pulumi, and CloudFormation
• Setting up comprehensive monitoring and alerting systems
• Implementing security best practices and compliance requirements
• Managing secrets and configuration across environments
• Troubleshooting production issues and performing root cause analysis
• Optimizing costs and performance across cloud resources
• Implementing disaster recovery and high availability solutions

Whether you're building a new microservices architecture, migrating legacy applications to the cloud, or optimizing existing infrastructure, this agent provides expert-level guidance tailored to your specific technology stack and requirements.

The DevOps Orchestrator takes a holistic approach to infrastructure management, considering not just the technical aspects but also team workflows, security requirements, compliance needs, and cost optimization. It can help you implement GitOps practices, set up proper branching strategies, and establish deployment workflows that ensure reliability and speed.

Tools

The DevOps Orchestrator agent has access to the following tools to perform its operations:

• Read: For reading configuration files, manifests, scripts, and documentation
• Write: For creating new configuration files, scripts, and infrastructure code
• Edit: For modifying existing configurations and fixing issues
• Grep: For searching patterns across infrastructure code and logs
• Glob: For discovering configuration files and resources
• Bash: For executing infrastructure commands, deployments, and diagnostics
• WebFetch: For retrieving documentation and checking service status
• WebSearch: For researching best practices and troubleshooting issues
• Task: For delegating specialized tasks to other agents

Supported Platforms and Technologies

Cloud Providers

The agent has comprehensive expertise in major cloud platforms:

Amazon Web Services (AWS)

Core services the agent can manage:

Compute

• EC2 (Elastic Compute Cloud) - Virtual servers
• Lambda - Serverless functions
• ECS (Elastic Container Service) - Docker container orchestration
• EKS (Elastic Kubernetes Service) - Managed Kubernetes
• Fargate - Serverless containers
• Elastic Beanstalk - PaaS deployment
• Batch - Batch computing workloads
• Lightsail - Simple virtual private servers

Storage

• S3 (Simple Storage Service) - Object storage
• EBS (Elastic Block Store) - Block storage for EC2
• EFS (Elastic File System) - Managed file storage
• FSx - Managed file systems (Windows, Lustre)
• Glacier - Archive storage
• Storage Gateway - Hybrid storage

Database

• RDS (Relational Database Service) - Managed databases
• Aurora - MySQL/PostgreSQL compatible
• DynamoDB - NoSQL database
• ElastiCache - Redis/Memcached
• DocumentDB - MongoDB compatible
• Neptune - Graph database
• Timestream - Time series database
• QLDB - Quantum ledger database
• Keyspaces - Cassandra compatible

Networking

• VPC (Virtual Private Cloud) - Network isolation
• Route 53 - DNS management
• CloudFront - CDN
• API Gateway - REST/WebSocket APIs
• ELB/ALB/NLB - Load balancers
• Direct Connect - Dedicated network connection
• Transit Gateway - Network hub
• PrivateLink - Private connectivity

Security

• IAM (Identity and Access Management)
• KMS (Key Management Service)
• Secrets Manager
• Certificate Manager
• WAF (Web Application Firewall)
• Shield - DDoS protection
• GuardDuty - Threat detection
• Security Hub - Security posture
• Macie - Data security
• Inspector - Vulnerability management

DevOps

• CodePipeline - CI/CD pipelines
• CodeBuild - Build service
• CodeDeploy - Deployment automation
• CodeCommit - Git repositories
• CodeArtifact - Package management
• CloudFormation - Infrastructure as Code
• CDK - Cloud Development Kit
• Systems Manager - Operations management

Monitoring

• CloudWatch - Metrics and logs
• X-Ray - Distributed tracing
• CloudTrail - API auditing
• Config - Resource configuration tracking

Google Cloud Platform (GCP)

Compute

• Compute Engine - Virtual machines
• Cloud Functions - Serverless functions
• Cloud Run - Serverless containers
• GKE (Google Kubernetes Engine) - Managed Kubernetes
• App Engine - PaaS platform
• Anthos - Hybrid/multi-cloud platform

Storage

• Cloud Storage - Object storage
• Persistent Disk - Block storage
• Filestore - Managed NFS
• Archive Storage - Cold storage

Database

• Cloud SQL - Managed MySQL/PostgreSQL/SQL Server
• Cloud Spanner - Globally distributed database
• Firestore - NoSQL document database
• Bigtable - Wide-column database
• Memorystore - Redis/Memcached

Networking

• VPC - Virtual networks
• Cloud DNS - DNS management
• Cloud CDN - Content delivery
• Cloud Load Balancing - Global load balancing
• Cloud Armor - DDoS and WAF
• Cloud NAT - Network address translation
• Cloud Interconnect - Dedicated connectivity

Security

• Cloud IAM - Identity management
• Cloud KMS - Key management
• Secret Manager - Secrets storage
• Security Command Center - Security analytics
• Binary Authorization - Deploy-time security

DevOps

• Cloud Build - CI/CD service
• Cloud Deploy - Continuous delivery
• Artifact Registry - Container/package registry
• Cloud Source Repositories - Git hosting
• Deployment Manager - Infrastructure as Code

Monitoring

• Cloud Monitoring - Metrics
• Cloud Logging - Log management
• Cloud Trace - Distributed tracing
• Cloud Profiler - Application profiling
• Error Reporting - Error tracking

Microsoft Azure

Compute

• Virtual Machines - IaaS compute
• Azure Functions - Serverless functions
• Container Instances - Serverless containers
• AKS (Azure Kubernetes Service) - Managed Kubernetes
• App Service - PaaS platform
• Batch - Batch computing

Storage

• Blob Storage - Object storage
• Disk Storage - Block storage
• Files - Managed file shares
• Archive Storage - Cold storage
• Data Lake Storage - Big data storage

Database

• Azure SQL Database - Managed SQL Server
• Cosmos DB - Multi-model database
• Database for MySQL/PostgreSQL - Managed databases
• Cache for Redis - Managed cache
• Table Storage - NoSQL key-value

Networking

• Virtual Network - Network isolation
• Azure DNS - DNS management
• Azure CDN - Content delivery
• Load Balancer - Load balancing
• Application Gateway - Layer 7 load balancer
• Front Door - Global HTTP load balancer
• ExpressRoute - Dedicated connectivity
• VPN Gateway - VPN connections

Security

• Azure AD - Identity management
• Key Vault - Secrets and keys
• Security Center - Security management
• Sentinel - SIEM
• DDoS Protection - DDoS mitigation
• Firewall - Network firewall

DevOps

• Azure DevOps - CI/CD platform
• GitHub Actions - GitHub integration
• Azure Pipelines - Build/release pipelines
• Azure Repos - Git repositories
• Azure Artifacts - Package feeds
• ARM Templates - Infrastructure as Code
• Bicep - DSL for ARM

Monitoring

• Azure Monitor - Unified monitoring
• Application Insights - APM
• Log Analytics - Log management
• Network Watcher - Network monitoring

Container Technologies

Docker

The agent provides comprehensive Docker support:

Image Management

# Multi-stage build example
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM node:18-alpine AS runner
WORKDIR /app
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001
COPY --from=builder --chown=nextjs:nodejs /app/.next ./.next
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json
USER nextjs
EXPOSE 3000
CMD ["npm", "start"]

Docker Compose

version: '3.8'
services:
  web:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - NODE_ENV=production
    ports:
      - "3000:3000"
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - REDIS_URL=${REDIS_URL}
    depends_on:
      - db
      - redis
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  db:
    image: postgres:15-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=${DB_USER}
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_DB=${DB_NAME}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  postgres_data:
  redis_data:

networks:
  default:
    driver: bridge

Best Practices

• Use multi-stage builds to minimize image size
• Run containers as non-root users
• Use .dockerignore to exclude unnecessary files
• Pin base image versions for reproducibility
• Implement health checks for container orchestration
• Use build arguments for environment-specific configurations
• Layer caching optimization for faster builds
• Security scanning with Trivy, Snyk, or Docker Scout

Kubernetes

The agent provides comprehensive Kubernetes expertise:

Core Resources

Deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  labels:
    app: web-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: web-app
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9090"
    spec:
      serviceAccountName: web-app
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
      - name: web-app
        image: myregistry/web-app:v1.2.3
        imagePullPolicy: Always
        ports:
        - containerPort: 3000
          protocol: TCP
        env:
        - name: NODE_ENV
          value: production
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: url
        resources:
          limits:
            cpu: "500m"
            memory: "512Mi"
          requests:
            cpu: "250m"
            memory: "256Mi"
        livenessProbe:
          httpGet:
            path: /health/live
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
        volumeMounts:
        - name: config
          mountPath: /app/config
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: web-app-config
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: web-app
              topologyKey: kubernetes.io/hostname
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway
        labelSelector:
          matchLabels:
            app: web-app

Service:

apiVersion: v1
kind: Service
metadata:
  name: web-app
  labels:
    app: web-app
spec:
  type: ClusterIP
  ports:
  - port: 80
    targetPort: 3000
    protocol: TCP
  selector:
    app: web-app

Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-app
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - app.example.com
    secretName: web-app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-app
            port:
              number: 80

HorizontalPodAutoscaler:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web-app
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web-app
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
      - type: Percent
        value: 100
        periodSeconds: 15
      - type: Pods
        value: 4
        periodSeconds: 15
      selectPolicy: Max

PodDisruptionBudget:

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web-app
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web-app

NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-app
spec:
  podSelector:
    matchLabels:
      app: web-app
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    - podSelector:
        matchLabels:
          app: monitoring
    ports:
    - protocol: TCP
      port: 3000
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - podSelector:
        matchLabels:
          app: redis
    ports:
    - protocol: TCP
      port: 6379
  - to:
    - namespaceSelector: {}
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53

Helm Charts

# Chart.yaml
apiVersion: v2
name: web-app
description: A Helm chart for web application
type: application
version: 1.0.0
appVersion: "1.2.3"
dependencies:
  - name: postgresql
    version: "12.1.0"
    repository: "https://charts.bitnami.com/bitnami"
    condition: postgresql.enabled
  - name: redis
    version: "17.3.0"
    repository: "https://charts.bitnami.com/bitnami"
    condition: redis.enabled

# values.yaml
replicaCount: 3

image:
  repository: myregistry/web-app
  pullPolicy: Always
  tag: ""

serviceAccount:
  create: true
  annotations: {}
  name: ""

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  fsGroup: 1000

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: app.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: web-app-tls
      hosts:
        - app.example.com

resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 250m
    memory: 256Mi

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

postgresql:
  enabled: true
  auth:
    database: webapp
    existingSecret: db-credentials

redis:
  enabled: true
  architecture: standalone
  auth:
    existingSecret: redis-credentials

Operators and CRDs

• Prometheus Operator for monitoring
• Cert-Manager for TLS certificates
• External Secrets Operator for secrets management
• Argo CD for GitOps deployments
• Istio for service mesh
• Crossplane for cloud resources

Infrastructure as Code

Terraform

The agent provides comprehensive Terraform expertise:

AWS Infrastructure Example

# providers.tf
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.23"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 2.11"
    }
  }

  backend "s3" {
    bucket         = "terraform-state-bucket"
    key            = "infrastructure/terraform.tfstate"
    region         = "us-west-2"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Environment = var.environment
      Project     = var.project_name
      ManagedBy   = "terraform"
    }
  }
}

# variables.tf
variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "us-west-2"
}

variable "environment" {
  description = "Environment name"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "project_name" {
  description = "Project name"
  type        = string
}

variable "vpc_cidr" {
  description = "VPC CIDR block"
  type        = string
  default     = "10.0.0.0/16"
}

variable "availability_zones" {
  description = "Availability zones"
  type        = list(string)
  default     = ["us-west-2a", "us-west-2b", "us-west-2c"]
}

# vpc.tf
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "${var.project_name}-${var.environment}-vpc"
  cidr = var.vpc_cidr

  azs             = var.availability_zones
  private_subnets = [for i, az in var.availability_zones : cidrsubnet(var.vpc_cidr, 4, i)]
  public_subnets  = [for i, az in var.availability_zones : cidrsubnet(var.vpc_cidr, 4, i + 3)]
  database_subnets = [for i, az in var.availability_zones : cidrsubnet(var.vpc_cidr, 4, i + 6)]

  enable_nat_gateway     = true
  single_nat_gateway     = var.environment != "prod"
  enable_vpn_gateway     = false
  enable_dns_hostnames   = true
  enable_dns_support     = true

  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_cloudwatch_iam_role  = true

  public_subnet_tags = {
    "kubernetes.io/role/elb" = 1
  }

  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = 1
  }
}

# eks.tf
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 19.0"

  cluster_name    = "${var.project_name}-${var.environment}"
  cluster_version = "1.28"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  cluster_endpoint_public_access  = true
  cluster_endpoint_private_access = true

  cluster_addons = {
    coredns = {
      most_recent = true
    }
    kube-proxy = {
      most_recent = true
    }
    vpc-cni = {
      most_recent              = true
      before_compute           = true
      service_account_role_arn = module.vpc_cni_irsa.iam_role_arn
      configuration_values = jsonencode({
        env = {
          ENABLE_PREFIX_DELEGATION = "true"
          WARM_PREFIX_TARGET       = "1"
        }
      })
    }
    aws-ebs-csi-driver = {
      most_recent              = true
      service_account_role_arn = module.ebs_csi_irsa.iam_role_arn
    }
  }

  eks_managed_node_groups = {
    general = {
      desired_size = 3
      min_size     = 2
      max_size     = 10

      instance_types = ["m5.large"]
      capacity_type  = "ON_DEMAND"

      labels = {
        role = "general"
      }

      update_config = {
        max_unavailable_percentage = 33
      }
    }

    spot = {
      desired_size = 2
      min_size     = 0
      max_size     = 10

      instance_types = ["m5.large", "m5a.large", "m5n.large"]
      capacity_type  = "SPOT"

      labels = {
        role = "spot"
      }

      taints = [
        {
          key    = "spot"
          value  = "true"
          effect = "NO_SCHEDULE"
        }
      ]
    }
  }

  manage_aws_auth_configmap = true

  aws_auth_roles = [
    {
      rolearn  = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/Admin"
      username = "admin"
      groups   = ["system:masters"]
    },
  ]
}

# rds.tf
module "rds" {
  source  = "terraform-aws-modules/rds/aws"
  version = "~> 6.0"

  identifier = "${var.project_name}-${var.environment}-db"

  engine               = "postgres"
  engine_version       = "15.4"
  family               = "postgres15"
  major_engine_version = "15"
  instance_class       = var.environment == "prod" ? "db.r5.large" : "db.t3.medium"

  allocated_storage     = 20
  max_allocated_storage = 100

  db_name  = "webapp"
  username = "admin"
  port     = 5432

  multi_az               = var.environment == "prod"
  db_subnet_group_name   = module.vpc.database_subnet_group_name
  vpc_security_group_ids = [module.security_group_rds.security_group_id]

  maintenance_window              = "Mon:00:00-Mon:03:00"
  backup_window                   = "03:00-06:00"
  backup_retention_period         = var.environment == "prod" ? 30 : 7
  skip_final_snapshot             = var.environment != "prod"
  deletion_protection             = var.environment == "prod"
  performance_insights_enabled    = true
  create_cloudwatch_log_group     = true
  enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]

  parameters = [
    {
      name  = "log_connections"
      value = "1"
    },
    {
      name  = "log_disconnections"
      value = "1"
    }
  ]
}

# elasticache.tf
module "elasticache" {
  source  = "cloudposse/elasticache-redis/aws"
  version = "~> 0.52"

  name                       = "${var.project_name}-${var.environment}"
  availability_zones         = var.availability_zones
  vpc_id                     = module.vpc.vpc_id
  subnets                    = module.vpc.private_subnets
  cluster_size               = var.environment == "prod" ? 3 : 1
  instance_type              = var.environment == "prod" ? "cache.r5.large" : "cache.t3.micro"
  apply_immediately          = true
  automatic_failover_enabled = var.environment == "prod"
  engine_version             = "7.0"
  family                     = "redis7"
  at_rest_encryption_enabled = true
  transit_encryption_enabled = true

  parameter = [
    {
      name  = "maxmemory-policy"
      value = "allkeys-lru"
    }
  ]

  security_group_rules = [
    {
      type                     = "ingress"
      from_port                = 6379
      to_port                  = 6379
      protocol                 = "tcp"
      source_security_group_id = module.eks.node_security_group_id
    }
  ]
}

# outputs.tf
output "vpc_id" {
  description = "VPC ID"
  value       = module.vpc.vpc_id
}

output "eks_cluster_endpoint" {
  description = "EKS cluster endpoint"
  value       = module.eks.cluster_endpoint
}

output "eks_cluster_name" {
  description = "EKS cluster name"
  value       = module.eks.cluster_name
}

output "rds_endpoint" {
  description = "RDS endpoint"
  value       = module.rds.db_instance_endpoint
}

output "redis_endpoint" {
  description = "Redis endpoint"
  value       = module.elasticache.endpoint
}

Pulumi

// index.ts
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";

const config = new pulumi.Config();
const environment = config.require("environment");
const projectName = config.require("projectName");

// VPC
const vpc = new aws.ec2.Vpc("main", {
    cidrBlock: "10.0.0.0/16",
    enableDnsHostnames: true,
    enableDnsSupport: true,
    tags: {
        Name: `${projectName}-${environment}-vpc`,
        Environment: environment,
    },
});

// Subnets
const publicSubnets = [];
const privateSubnets = [];
const azs = ["us-west-2a", "us-west-2b", "us-west-2c"];

for (let i = 0; i < azs.length; i++) {
    publicSubnets.push(new aws.ec2.Subnet(`public-${i}`, {
        vpcId: vpc.id,
        cidrBlock: `10.0.${i}.0/24`,
        availabilityZone: azs[i],
        mapPublicIpOnLaunch: true,
        tags: {
            Name: `${projectName}-public-${azs[i]}`,
            "kubernetes.io/role/elb": "1",
        },
    }));

    privateSubnets.push(new aws.ec2.Subnet(`private-${i}`, {
        vpcId: vpc.id,
        cidrBlock: `10.0.${i + 10}.0/24`,
        availabilityZone: azs[i],
        tags: {
            Name: `${projectName}-private-${azs[i]}`,
            "kubernetes.io/role/internal-elb": "1",
        },
    }));
}

// EKS Cluster
const cluster = new eks.Cluster("eks", {
    vpcId: vpc.id,
    subnetIds: privateSubnets.map(s => s.id),
    instanceType: "m5.large",
    desiredCapacity: 3,
    minSize: 2,
    maxSize: 10,
    storageClasses: "gp3",
    deployDashboard: false,
});

export const kubeconfig = cluster.kubeconfig;
export const clusterName = cluster.eksCluster.name;

CI/CD Pipelines

GitHub Actions

# .github/workflows/ci-cd.yaml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run linting
        run: npm run lint

      - name: Run tests
        run: npm run test:coverage

      - name: Upload coverage
        uses: codecov/codecov-action@v3
        with:
          files: ./coverage/lcov.info
          fail_ci_if_error: true

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Snyk security scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

  build:
    needs: [test, security-scan]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha,prefix=
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ github.sha }}
            BUILD_DATE=${{ github.event.head_commit.timestamp }}

      - name: Scan built image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: 'table'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

  deploy-staging:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/develop'
    environment: staging

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2

      - name: Update kubeconfig
        run: aws eks update-kubeconfig --name staging-cluster --region us-west-2

      - name: Deploy to staging
        run: |
          helm upgrade --install web-app ./helm/web-app \
            --namespace staging \
            --set image.tag=${{ github.sha }} \
            --set environment=staging \
            --wait --timeout 5m

      - name: Run smoke tests
        run: |
          kubectl run smoke-test --rm -i --restart=Never \
            --image=curlimages/curl -- \
            curl -sf http://web-app.staging.svc.cluster.local/health

  deploy-production:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment: production

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2

      - name: Update kubeconfig
        run: aws eks update-kubeconfig --name production-cluster --region us-west-2

      - name: Deploy to production
        run: |
          helm upgrade --install web-app ./helm/web-app \
            --namespace production \
            --set image.tag=${{ github.sha }} \
            --set environment=production \
            --set replicaCount=5 \
            --wait --timeout 10m

      - name: Notify deployment
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "Production deployment completed",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Production Deployment* :rocket:\nVersion: `${{ github.sha }}`\nBy: ${{ github.actor }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

GitLab CI

# .gitlab-ci.yml
stages:
  - test
  - security
  - build
  - deploy

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

.node_template: &node_template
  image: node:20-alpine
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - node_modules/

test:
  <<: *node_template
  stage: test
  script:
    - npm ci
    - npm run lint
    - npm run test:coverage
  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
      junit: junit.xml

security-scan:
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy fs --exit-code 1 --severity HIGH,CRITICAL .
  allow_failure: true

build:
  stage: build
  image: docker:24
  services:
    - docker:24-dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build -t $IMAGE_TAG .
    - docker push $IMAGE_TAG

deploy-staging:
  stage: deploy
  image: bitnami/kubectl:latest
  environment:
    name: staging
    url: https://staging.example.com
  script:
    - kubectl set image deployment/web-app web-app=$IMAGE_TAG -n staging
  only:
    - develop

deploy-production:
  stage: deploy
  image: bitnami/kubectl:latest
  environment:
    name: production
    url: https://www.example.com
  script:
    - kubectl set image deployment/web-app web-app=$IMAGE_TAG -n production
  when: manual
  only:
    - main

Monitoring and Observability

Prometheus and Grafana

# prometheus-values.yaml
prometheus:
  prometheusSpec:
    retention: 30d
    retentionSize: 50GB
    storageSpec:
      volumeClaimTemplate:
        spec:
          storageClassName: gp3
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 100Gi

    serviceMonitorSelector: {}
    serviceMonitorNamespaceSelector: {}
    podMonitorSelector: {}
    podMonitorNamespaceSelector: {}

    additionalScrapeConfigs:
      - job_name: 'kubernetes-pods'
        kubernetes_sd_configs:
          - role: pod
        relabel_configs:
          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
            action: keep
            regex: true

alertmanager:
  config:
    global:
      resolve_timeout: 5m
      slack_api_url: 'https://hooks.slack.com/services/xxx'

    route:
      group_by: ['alertname', 'namespace']
      group_wait: 30s
      group_interval: 5m
      repeat_interval: 4h
      receiver: 'slack-notifications'
      routes:
        - match:
            severity: critical
          receiver: 'pagerduty-critical'

    receivers:
      - name: 'slack-notifications'
        slack_configs:
          - channel: '#alerts'
            send_resolved: true
            title: '{{ .Status | toUpper }}: {{ .CommonLabels.alertname }}'
            text: '{{ range .Alerts }}{{ .Annotations.description }}{{ end }}'

      - name: 'pagerduty-critical'
        pagerduty_configs:
          - service_key: 'xxx'
            severity: '{{ .CommonLabels.severity }}'

grafana:
  adminPassword: ${GRAFANA_ADMIN_PASSWORD}

  dashboardProviders:
    dashboardproviders.yaml:
      apiVersion: 1
      providers:
        - name: 'default'
          orgId: 1
          folder: ''
          type: file
          disableDeletion: false
          editable: true
          options:
            path: /var/lib/grafana/dashboards/default

  dashboards:
    default:
      kubernetes-cluster:
        gnetId: 7249
        revision: 1
        datasource: Prometheus
      kubernetes-pods:
        gnetId: 6417
        revision: 1
        datasource: Prometheus
      node-exporter:
        gnetId: 1860
        revision: 27
        datasource: Prometheus

Datadog

# datadog-values.yaml
datadog:
  apiKey: ${DD_API_KEY}
  appKey: ${DD_APP_KEY}
  site: datadoghq.com

  clusterName: production-cluster

  logs:
    enabled: true
    containerCollectAll: true

  apm:
    enabled: true
    portEnabled: true

  processAgent:
    enabled: true
    processCollection: true

  networkMonitoring:
    enabled: true

  securityAgent:
    compliance:
      enabled: true
    runtime:
      enabled: true

agents:
  containers:
    agent:
      resources:
        requests:
          cpu: 200m
          memory: 256Mi
        limits:
          cpu: 500m
          memory: 512Mi

Security Best Practices

Secrets Management

# External Secrets Operator configuration
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secrets-manager
  namespace: default
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-west-2
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-sa

---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: default
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: SecretStore
  target:
    name: database-credentials
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: production/database
        property: username
    - secretKey: password
      remoteRef:
        key: production/database
        property: password

Pod Security Standards

# PodSecurityPolicy (deprecated) / Pod Security Standards
apiVersion: v1
kind: Namespace
metadata:
  name: secure-namespace
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

---
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: cache
      mountPath: /app/.cache
  volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir: {}

Capabilities

1. Infrastructure Provisioning

The agent can provision and manage infrastructure across all major cloud providers:

• Create VPCs with proper network segmentation
• Set up compute resources (VMs, containers, serverless)
• Configure databases with high availability
• Set up load balancers and CDNs
• Implement network security (firewalls, WAF)
• Configure DNS and domain management

2. Container Orchestration

Comprehensive Kubernetes management:

• Cluster provisioning (EKS, GKE, AKS)
• Workload deployment and scaling
• Service mesh implementation (Istio, Linkerd)
• Ingress and load balancing
• Storage provisioning
• RBAC and security policies

3. CI/CD Pipeline Design

End-to-end pipeline implementation:

• Source code integration (GitHub, GitLab, Bitbucket)
• Build automation with caching
• Automated testing integration
• Security scanning (SAST, DAST, SCA)
• Artifact management
• Deployment strategies (rolling, blue-green, canary)

4. Monitoring and Observability

Complete observability stack:

• Metrics collection and visualization
• Log aggregation and analysis
• Distributed tracing
• Custom dashboards
• Alerting and notification
• SLO/SLI tracking

5. Security Implementation

Security at every layer:

• Identity and access management
• Secrets management
• Network security policies
• Vulnerability scanning
• Compliance automation
• Audit logging

6. Cost Optimization

Cloud cost management:

• Resource right-sizing
• Reserved instance planning
• Spot instance utilization
• Unused resource identification
• Budget alerts
• Cost allocation tagging

Process

The DevOps Orchestrator follows a systematic approach:

1. Assess Current State: Understand existing infrastructure, tools, and processes 2. Define Requirements: Gather security, compliance, and performance requirements 3. Design Architecture: Create infrastructure architecture with diagrams 4. Plan Implementation: Break down into phases with clear milestones 5. Implement Changes: Execute using Infrastructure as Code 6. Validate and Test: Verify security, performance, and reliability 7. Document: Create runbooks and documentation 8. Monitor and Optimize: Set up monitoring and continuous improvement

Output Format

The agent provides structured output for DevOps recommendations:

## Infrastructure Analysis Report

### Executive Summary
[High-level assessment and recommendations]

### Current State Assessment
- Infrastructure overview
- Security posture
- Performance metrics
- Cost analysis

### Recommendations

#### High Priority
1. [Recommendation]: [Description]
   - Impact: [Expected improvement]
   - Effort: [Implementation complexity]
   - Timeline: [Estimated duration]

#### Medium Priority
[...]

### Implementation Plan

#### Phase 1: Foundation (Week 1-2)
- [ ] Task 1
- [ ] Task 2

#### Phase 2: Core Infrastructure (Week 3-4)
[...]

### Risk Assessment
| Risk | Likelihood | Impact | Mitigation |
|------|------------|--------|------------|
| [Risk] | High/Medium/Low | High/Medium/Low | [Strategy] |

### Success Metrics
- [Metric 1]: [Target value]
- [Metric 2]: [Target value]

Configuration

The agent behavior can be configured:

• Cloud Provider: AWS, GCP, Azure, multi-cloud
• Environment: Development, staging, production
• Compliance Framework: SOC2, PCI-DSS, HIPAA, GDPR
• Cost Optimization Level: Aggressive, balanced, performance-first
• Security Level: Standard, enhanced, paranoid

Usage

To invoke the DevOps Orchestrator agent:

Task(subagent_type="devops-orchestrator", prompt="Set up a production-ready Kubernetes cluster on AWS with monitoring and CI/CD...")

Best Practices for Users

When working with this agent:

1. Provide clear requirements for security and compliance 2. Share existing infrastructure documentation 3. Specify budget constraints if any 4. Mention preferred tools and technologies 5. Indicate timeline and resource constraints 6. Share any past incidents or lessons learned

Limitations

• Cannot directly access cloud provider consoles
• Recommendations should be reviewed before implementation
• Complex migrations may require additional human expertise
• Compliance verification may need external auditors
• Cost estimates are approximate
• Some cloud-specific features may have limited support

Security Auditor Agent

Description

The Security Auditor agent is a specialized security expert designed to help development teams identify and remediate security vulnerabilities in their applications. This agent conducts comprehensive security assessments covering application code, dependencies, infrastructure configurations, and deployment practices.

The agent is trained on common vulnerability patterns, security best practices, and compliance requirements. It can identify issues across the OWASP Top 10 categories and provides actionable remediation guidance. Whether you're preparing for a security audit, responding to a vulnerability report, or building security into your development process, this agent provides expert-level security analysis.

The Security Auditor agent is particularly useful for:

• Pre-deployment security reviews of new features
• Periodic security audits of existing applications
• Vulnerability assessment and remediation planning
• Security code review during pull requests
• Compliance verification (PCI-DSS, HIPAA, SOC2, etc.)
• Incident response and root cause analysis
• Security architecture review
• Dependency vulnerability assessment

Tools

The Security Auditor agent has access to:

• Read: For analyzing source code, configuration files, and documentation
• Grep: For searching code patterns that indicate vulnerabilities
• Glob: For discovering files that commonly contain security issues
• Bash: For running security scanning tools and checking configurations
• WebFetch: For checking CVE databases and security advisories
• WebSearch: For researching specific vulnerabilities and mitigations

Security Categories

1. Injection Vulnerabilities

The agent detects various injection attack vectors:

SQL Injection

• String concatenation in SQL queries
• Dynamic query construction without parameterization
• ORM misuse allowing raw queries

# Vulnerable pattern the agent would flag:
query = f"SELECT * FROM users WHERE id = {user_input}"

# Recommended fix:
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_input,))

Command Injection

• Shell command construction with user input
• Unsafe subprocess calls
• Eval/exec with untrusted data

NoSQL Injection

• Unvalidated query operators
• JSON injection in document databases

LDAP Injection

• Dynamic LDAP filter construction

2. Authentication and Authorization

The agent reviews authentication implementations:

Authentication Issues

• Weak password policies
• Insecure credential storage
• Missing brute force protection
• Improper session management
• Missing multi-factor authentication for sensitive operations

Authorization Issues

• Missing access control checks
• Insecure direct object references (IDOR)
• Privilege escalation vulnerabilities
• Role-based access control bypasses
• Missing function-level access control

3. Cryptography

Cryptographic implementation review:

• Weak or deprecated algorithms (MD5, SHA1, DES)
• Hardcoded encryption keys
• Insecure random number generation
• Missing encryption for sensitive data
• Improper certificate validation
• Weak key lengths

# Patterns the agent would flag:
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()  # Weak!

# Recommended:
import bcrypt
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

4. Sensitive Data Exposure

The agent identifies data exposure risks:

• Sensitive data in logs
• Credentials in source code
• API keys in client-side code
• PII in error messages
• Sensitive data in URLs
• Missing encryption in transit
• Improper data retention

5. Cross-Site Scripting (XSS)

XSS vulnerability detection:

• Reflected XSS in user input echoing
• Stored XSS in database content
• DOM-based XSS in JavaScript
• Missing output encoding
• Unsafe innerHTML usage

// Vulnerable pattern:
element.innerHTML = userInput;

// Safe alternative:
element.textContent = userInput;

6. Security Misconfiguration

Configuration security review:

• Debug mode in production
• Default credentials
• Unnecessary services exposed
• Missing security headers
• Permissive CORS policies
• Directory listing enabled
• Verbose error messages

7. Dependency Vulnerabilities

Third-party component analysis:

• Known CVEs in dependencies
• Outdated packages with security fixes
• Abandoned or unmaintained libraries
• License compliance issues
• Transitive dependency risks

8. Infrastructure Security

Deployment and infrastructure review:

• Container security issues
• Cloud configuration mistakes
• Network exposure
• Missing firewall rules
• Insecure storage configurations
• Logging and monitoring gaps

Audit Process

The Security Auditor follows a systematic approach:

Phase 1: Discovery

• Identify application entry points
• Map data flows and trust boundaries
• Catalog sensitive data handling
• Review architecture documentation

Phase 2: Analysis

• Static code analysis for vulnerability patterns
• Configuration review
• Dependency scanning
• Access control mapping

Phase 3: Validation

• Verify identified vulnerabilities
• Assess exploitability
• Determine impact severity
• Check for false positives

Phase 4: Reporting

• Document findings with evidence
• Provide remediation guidance
• Prioritize by risk level
• Suggest verification steps

Severity Classification

Findings are classified by severity:

Output Format

The agent produces detailed security reports:

## Security Audit Report

### Executive Summary
[High-level findings and risk assessment]

### Critical Findings
#### [VULN-001] SQL Injection in User Search
- **Location**: src/api/users.py:45
- **Severity**: Critical
- **CVSS**: 9.8
- **Description**: User input is directly concatenated into SQL query
- **Impact**: Full database access, data breach
- **Remediation**: Use parameterized queries
- **Code Fix**:

Before

query = f"SELECT * FROM users WHERE name LIKE '%{search}%'"

After

query = "SELECT * FROM users WHERE name LIKE %s" cursor.execute(query, (f"%{search}%",))

- **Verification**: Test with `' OR '1'='1` input

### High Findings
[Similar format for high severity issues]

### Medium Findings
[...]

### Recommendations
[Security hardening suggestions]

### Compliance Checklist
[Relevant compliance requirements and status]

Configuration

The agent can be configured for specific audits:

• Scope: Full audit, specific components, or targeted review
• Framework: OWASP Top 10, SANS 25, custom checklist
• Compliance: PCI-DSS, HIPAA, SOC2, GDPR requirements
• Depth: Quick scan, standard review, deep analysis
• Focus: Web app, API, mobile, infrastructure

Usage

To invoke the Security Auditor agent:

Task(subagent_type="security-auditor", prompt="Audit the authentication module for vulnerabilities...")

The agent will conduct a thorough security analysis and provide detailed findings.

Integration

The agent integrates with security tools:

• Static analysis tools (Semgrep, CodeQL, Bandit)
• Dependency scanners (Snyk, npm audit, Safety)
• Secret scanners (TruffleHog, git-secrets)
• Container scanners (Trivy, Clair)

Best Practices for Users

When requesting a security audit:

1. Define the scope clearly (what to audit, what to exclude) 2. Provide context about the application's purpose 3. Share any existing security documentation 4. Mention known sensitive data handling 5. Indicate compliance requirements 6. Share previous audit findings if available

Limitations

The Security Auditor agent has limitations:

• Cannot perform dynamic testing or penetration testing
• Static analysis may have false positives
• Cannot assess physical security
• May miss business logic vulnerabilities
• Requires human verification for critical findings
• Cannot access external systems for validation

Disclaimer

This agent provides security guidance but does not guarantee complete security coverage. Findings should be verified by qualified security professionals. Critical systems should undergo professional penetration testing in addition to code review.

API Tester Skill

API testing, validation, and debugging.

Protocols

• REST APIs: All HTTP methods and RESTful conventions
• GraphQL: Query and mutation support with variables
• WebSockets: Connection testing and message exchange
• gRPC: Protocol buffer-based service testing (beta)

Authentication

API Key

{
  "auth": {
    "type": "api-key",
    "key": "X-API-Key",
    "value": "your-api-key-here",
    "location": "header"
  }
}

Bearer Token

{
  "auth": {
    "type": "bearer",
    "token": "your-jwt-token-here"
  }
}

OAuth 2.0

{
  "auth": {
    "type": "oauth2",
    "grant_type": "client_credentials",
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
    "token_url": "https://auth.example.com/token"
  }
}

Basic Auth

{
  "auth": {
    "type": "basic",
    "username": "user",
    "password": "pass"
  }
}

Features

HTTP Requests

HTTP Methods: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS

Request Bodies: JSON, XML, form-data, raw

GET Request

GET https://api.example.com/users/123
Headers:
  Accept: application/json
  X-API-Key: your-key

POST Request

POST https://api.example.com/users
Headers:
  Content-Type: application/json
Body:
  {
    "name": "John Doe",
    "email": "john@example.com"
  }

Response Validation

Validate against JSON Schema or custom validators:

validation:
  status: 200
  headers:
    content-type: application/json
  body:
    type: object
    required:
      - id
      - name
    properties:
      id:
        type: integer
      name:
        type: string

Environment Management

environments:
  development:
    base_url: http://localhost:3000
    api_key: dev-key-123

  staging:
    base_url: https://staging.api.example.com
    api_key: staging-key-456

  production:
    base_url: https://api.example.com
    api_key: prod-key-789

Collection Management

collection: User API Tests
tests:
  - name: List all users
    request:
      method: GET
      url: /users
    assertions:
      - status == 200
      - body.length > 0

  - name: Get single user
    request:
      method: GET
      url: /users/{{user_id}}
    assertions:
      - status == 200
      - body.id == user_id

  - name: Create user
    request:
      method: POST
      url: /users
      body:
        name: Test User
        email: test@example.com
    assertions:
      - status == 201
      - body.id exists

Commands

# GET request
/api-tester get https://api.example.com/users

# POST request with JSON body
/api-tester post https://api.example.com/users --body '{"name":"John"}'

# Run test collection
/api-tester run collection.yaml --env staging

# Validate response against schema
/api-tester validate response.json --schema user.schema.json

# Test with authentication
/api-tester get https://api.example.com/protected --auth bearer:token123

# Chain requests (use output from one as input to another)
/api-tester chain create-and-get.yaml

# Load testing
/api-tester load https://api.example.com/users --requests 100 --concurrency 10

# Generate API documentation from tests
/api-tester docs collection.yaml --output api-docs.md

Assertions

Performance Metrics

Response Metrics:
  Total Time: 245ms
  DNS Lookup: 12ms
  TCP Connect: 23ms
  TLS Handshake: 89ms
  Time to First Byte: 156ms
  Content Download: 34ms
  Response Size: 1.2KB

Mock Server

mock:
  port: 8080
  routes:
    - method: GET
      path: /users
      response:
        status: 200
        body:
          - id: 1
            name: Mock User

    - method: POST
      path: /users
      response:
        status: 201
        body:
          id: "{{random.uuid}}"
          created: true

Error Handling

• Connection Errors: Clear messages when target API is unreachable
• Timeout Errors: Configurable timeouts with informative messages
• SSL/TLS Errors: Options to skip certificate validation for testing
• Authentication Errors: Detailed feedback on auth failures

Best Practices

1. Environment Variables: Never hardcode sensitive values like API keys 2. Version Control: Keep test collections in version control 3. Edge Cases: Test error conditions, not just happy paths 4. Documentation: Use clear test names and descriptions 5. Response Times: Set reasonable time assertions to catch performance regressions

Limitations

• WebSocket support limited to basic connection testing
• OAuth 2.0 authorization code flow requires manual browser interaction
• File upload testing has 10MB limit per file
• GraphQL subscriptions not supported

Code Analyzer Skill

Static analysis for multiple languages with security scanning and quality metrics.

Supported Languages

Analysis Types

Syntax and Style Analysis

• Indentation, formatting
• Naming violations
• Unused variables, imports
• Dead code
• Line length
• Missing docs

Bug Detection

• Null pointer dereferences
• Type mismatches
• Array bounds violations
• Resource leaks (unclosed files, connections)
• Race conditions
• Unreachable code

Security Analysis (OWASP Top 10)

• Injection: SQL injection, command injection, XSS
• Authentication: Weak password handling, session management
• Sensitive data: Hardcoded credentials, logging sensitive data
• XXE vulnerabilities
• Access control: Missing authorization checks
• Misconfigurations: Debug mode enabled, default credentials
• Dependencies: Known vulnerable libraries

Complexity Analysis

• Cyclomatic Complexity
• Cognitive Complexity
• Halstead Metrics
• Lines of Code
• Depth of Inheritance

Dependency Analysis

• Outdated packages
• CVE vulnerabilities
• License compatibility
• Unused dependencies
• Circular dependencies

Commands

# Analyze file
/code-analyzer analyze src/main.py

# Analyze directory
/code-analyzer analyze ./src --recursive

# Security scan
/code-analyzer security ./src

# Complexity report
/code-analyzer complexity ./src --output report.html

# Check dependencies
/code-analyzer deps ./package.json

Profiles

/code-analyzer analyze ./src --profile quick      # Fast, essential only
/code-analyzer analyze ./src --profile standard   # Balanced
/code-analyzer analyze ./src --profile strict     # Comprehensive
/code-analyzer analyze ./src --profile security   # Security-focused

Output Formats

# Console (default)
/code-analyzer analyze ./src

# JSON
/code-analyzer analyze ./src --format json > report.json

# HTML
/code-analyzer analyze ./src --format html --output report.html

# SARIF (GitHub)
/code-analyzer analyze ./src --format sarif > results.sarif

Severity Levels

Configuration

.code-analyzer.yaml:

profile: standard

languages:
  python:
    enabled: true
    rules:
      - no-print-statements: warn
      - type-annotations-required: error
    ignore:
      - tests/**
      - migrations/**

  javascript:
    enabled: true
    rules:
      - no-console: warn
      - prefer-const: error
    extensions:
      - .js
      - .jsx
      - .mjs

security:
  scan_dependencies: true
  check_secrets: true
  owasp_top_10: true

complexity:
  max_cyclomatic: 10
  max_cognitive: 15
  max_line_length: 120
  max_function_lines: 50

output:
  format: html
  include_source: true
  severity_threshold: warn

Integration

Git Hooks (.git/hooks/pre-commit):

#!/bin/bash
/code-analyzer analyze --staged --severity error

GitHub Actions:

name: Code Analysis
on: [push, pull_request]
jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: /code-analyzer analyze ./src --format sarif --output results.sarif
      - uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif

IDE Integration:

• VS Code: Code Analyzer extension
• IntelliJ: External tool
• Vim/Neovim: ALE or coc.nvim

Custom Rules

# custom-rules.yaml
rules:
  - id: no-api-keys-in-code
    pattern: |
      api_key\s*=\s*["'][a-zA-Z0-9]+["']
    message: "Do not hardcode API keys"
    severity: error
    languages: [python, javascript]

  - id: require-error-handling
    pattern: |
      fetch\([^)]+\)(?!\s*\.\s*catch)
    message: "fetch() calls must have error handling"
    severity: warning
    languages: [javascript, typescript]

Performance

Optimizations: Incremental analysis, parallel processing, caching, memory-efficient streaming.

Typical speeds:

• Small (< 10K LOC): < 5 seconds
• Medium (10K-100K LOC): < 30 seconds
• Large (> 100K LOC): < 2 minutes

Limitations

• Binary files not analyzed
• Generated code may cause false positives
• Some language features may not be fully supported
• Custom frameworks may require custom rules
• Analysis accuracy varies by language

Document Processor

Create, edit, analyze, convert documents. Supports .docx/.pdf/.txt/.rtf/.md with tables and images.

Formats

Commands

/doc-processor create --type docx --template report
/doc-processor edit <file> --track-changes
/doc-processor extract <file> --format text
/doc-processor convert <file> --to pdf

Features

• Create: Blank, template-based, or from conversion
• Edit: Text, formatting, headings, tables, track changes, comments
• Analyze: Text extraction, structure, word count, search
• Convert: docx↔pdf, md→docx/pdf, any→txt

Limits

• Complex PDF layouts may not convert perfectly
• Max file size: 50MB
• Encrypted files require password

Full-Stack Generator

Generate complete web apps with frontend, backend, database, auth, testing, CI/CD.

Supported Stacks

Frontend

Backend

Database

PostgreSQL, MySQL, MongoDB, SQLite, SQL Server, Oracle, Cassandra

Commands

# Interactive wizard
/full-stack-generator

# Quick init with defaults (Next.js + NestJS + PostgreSQL)
/full-stack-generator init <name>

# Frontend only
/full-stack-generator frontend <react|vue|nextjs|nuxt|angular|sveltekit>
  --typescript --styling <tailwind|css-modules> --state <redux|zustand|pinia>

# Backend only
/full-stack-generator backend <express|fastify|nestjs|fastapi|django|gin|fiber|actix>
  --database <postgresql|mysql|mongodb> --orm <prisma|typeorm> --auth <jwt|oauth2>

# Add components
/full-stack-generator frontend add-component <Name> [--with-tests] [--with-stories]
/full-stack-generator frontend add-page <Name> [--protected] [--layout <name>]
/full-stack-generator backend add-module <name> [--with-crud] [--with-events]
/full-stack-generator backend add-endpoint <path> [--methods GET,POST] [--auth]

# Database
/full-stack-generator database init
/full-stack-generator database add-model <Name> --fields "name:string,price:decimal"
/full-stack-generator database migrate [--seed] [--fresh]

# Testing
/full-stack-generator test setup
/full-stack-generator test add <unit|integration|e2e> <Name>

# DevOps
/full-stack-generator devops docker
/full-stack-generator devops ci <github|gitlab|jenkins|circleci>
/full-stack-generator devops deploy <aws|gcp|azure|vercel|railway|fly>

Generation Phases

Config (.fullstack.yaml)

project:
  name: my-app

frontend:
  framework: nextjs
  typescript: true
  styling: tailwind
  state: zustand
  api: tanstack-query
  testing: { unit: jest, e2e: playwright }

backend:
  framework: nestjs
  typescript: true
  database: { orm: prisma, type: postgresql }
  auth: { strategy: jwt, providers: [local, google, github] }
  caching: redis
  queue: bull
  logging: { level: info, format: json }
  security: { helmet: true, cors: true, rate_limit: true }

models:
  User: { fields: [id:uuid, email:string, password:string, role:enum] }
  Product: { fields: [id:uuid, name:string, price:decimal, stock:int] }
  Order: { fields: [id:uuid, userId:uuid, status:enum, total:decimal] }

devops:
  docker: true
  ci: github-actions
  deploy: { target: aws, region: us-east-1 }

Directory Structure

project/
├── frontend/
│   ├── src/
│   │   ├── app/           # Pages/routes
│   │   ├── components/    # UI, forms, layouts, features
│   │   ├── hooks/         # Custom hooks
│   │   ├── stores/        # State management
│   │   ├── lib/           # Utils, API client
│   │   └── types/         # TypeScript types
│   └── tests/
├── backend/
│   ├── src/
│   │   ├── modules/       # auth, users, products, orders
│   │   ├── common/        # decorators, guards, filters
│   │   ├── config/        # app, database, jwt config
│   │   └── database/      # prisma schema, migrations
│   └── test/
├── docker-compose.yml
└── .github/workflows/

Features

• Clean architecture (separation of concerns, DI)
• TypeScript strict mode
• JWT + OAuth2 (Google, GitHub)
• Prisma migrations + seeding
• Redis caching + Bull queues
• Swagger/OpenAPI docs
• Jest + Playwright testing
• Docker multi-stage builds
• GitHub Actions CI/CD
• AWS/GCP/Vercel deployment

Troubleshooting