Fleet Gitops

DevOps & Security

fleet-gitops

Fleet Gitops is an Agent Skill for devops & security published in the fleetdm/fleet repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Help with Fleet GitOps configuration files including queries, profiles, software, and DDM declarations with validation against upstream references.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/fleetdm/fleet/blob/HEAD/.claude/skills/fleet-gitops/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/fleet-gitops, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

You are helping with Fleet GitOps configuration files: $ARGUMENTS

Focus on the it-and-security folder. Apply the following constraints for all work in this session.

Queries & Reports

Only use Fleet tables and supported columns when writing osquery queries or Fleet reports.
Do not reference tables or columns that are not present in the Fleet schema for the target platform.
Validate table and column names against the Fleet schema before including them in a query:
- https://github.com/fleetdm/fleet/tree/main/schema

Configuration Profiles

When generating or modifying configuration profiles:

First-party Apple payloads (.mobileconfig) — validate payload keys, types, and allowed values against the Apple Device Management reference:
- https://github.com/apple/device-management/tree/release/mdm/profiles
Third-party Apple payloads (.mobileconfig) — validate against the ProfileManifests community reference:
- https://github.com/ProfileManifests/ProfileManifests
Windows CSPs (.xml) — validate CSP paths, formats, and allowed values against Microsoft's MDM protocol reference:
- https://learn.microsoft.com/en-us/windows/client-management/mdm/
Android profiles (.json) — validate keys and values against the Android Management API enterprises.policies reference:
- https://developers.google.com/android/management/reference/rest/v1/enterprises.policies

Software

When adding software for macOS or Windows hosts, always check the Fleet-maintained app catalog first before using a custom package:
- https://github.com/fleetdm/fleet/tree/main/ee/maintained-apps
In GitOps YAML, use the fleet_maintained_apps key with the app's slug to reference a Fleet-maintained app.
When remediating a CVE, use Fleet's built-in vulnerability detection to identify affected software, then follow the Software section above to deploy a fix — preferring a Fleet-maintained app update where available, otherwise a custom package.

Declarative Device Management (DDM)

When generating or modifying DDM declarations:

Validate declaration types, keys, and values against the Apple DDM reference:
- https://github.com/apple/device-management/tree/release/declarative/declarations
Ensure the Type identifier matches a supported declaration type from the reference.

References

Fleet GitOps documentation: https://fleetdm.com/docs/configuration/yaml-files
Fleet API documentation: https://fleetdm.com/docs/rest-api/rest-api