DevOps & Security skills
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
experimental-ci-only-validator
Checks if a Chromium test suite is barred by `ci_only = True` configuration on coverage trybots, which prevents the test suite from running automatically on Gerrit CQ runs and can cause underreported code coverage.
experimental-code-coverage-build-invoker
Triggers LUCI try jobs to generate code coverage data. Supports Mode 1 (standard git cl try for source CLs) and Mode 2 (led for custom builds).
experimental-code-coverage-installer
Verifies and initializes the Chromium development environment and dependencies required for running code coverage tools and services.
experimental-code-coverage-verification-prep
Prepares a Gerrit CL for code coverage verification try jobs. Adds dummy comments to trigger builds, optimizes builder configs by isolating test suites, and commits all changes.
azdo-build-investigator
Investigate CI failures for dotnet/maui PRs and the nightly/official signed build — build errors, Helix test logs, and binlog analysis. Use when asked about failing checks, CI status, test failures, 'why is CI red', 'build failed', 'what's failing on PR', 'is this PR ready to merge', Helix failures, device test failures, or 'nightly is broken', 'nightly build failing', 'inflight feed stale', 'dogfood feed stopped updating', 'official build failed'.
dependency-flow
MAUI-specific dependency flow rules, channel conventions, and feed lookup workflows. Use when asked about darc, BAR, Maestro, feeds for .NET MAUI, build promotion, asset lookup, channel mappings, or dependency flow for dotnet/maui. Wraps the maestro-cli skill and maestro MCP tools with MAUI-specific guardrails.
release-readiness
Assesses ship-readiness for .NET MAUI release branches — Servicing Releases (SR) and Previews. Surveys CI pipelines, computes what's actually NEW in the branch (commits + source PRs with revert detection), and cross-references open `regressed-in-*` issues against branch contents to identify port candidates, rejected backports, and unresolved regressions. Supports both in-flight and pre-cut (candidate) modes for SR and Preview branches.
triage-dependabot-alerts
Triage Dependabot dependency vulnerability alerts for the Activepieces repo — pull open alerts, dedupe to distinct (package, advisory), confirm the vulnerable package + API is actually used, and propose version-bump fixes proven non-breaking (build + tests) before any PR. Use when the user asks to triage Dependabot alerts, work the dependency-vulnerability backlog, or bump vulnerable dependencies. For human-reported vulnerabilities, use the triage-security-advisories skill instead.
triage-image-cves
Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity. Lists the 3 most-recent published tags and lets the user pick which to scan, validates each finding is real and reachable, and proves candidate fixes in an isolated git worktree (rebuild image + re-scan + tests + container smoke-run + codebase diff) before proposing anything — fixes are NEVER auto-applied; the user decides per finding. Use when the user asks to grype-scan the image, triage container/image vulnerabilities, or check a shipped Docker image for CVEs.