[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-kickstart-safeguard-checklist":3,"mdc-w3b6nd-key":37,"related-repo-azure-kickstart-safeguard-checklist":1356,"related-org-azure-kickstart-safeguard-checklist":1453},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":35,"mdContent":36},"kickstart-safeguard-checklist","validate Kubernetes manifests against safeguard rules","AKS deployment safeguard rules checklist for validating Kubernetes manifests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"QA","qa",{"name":21,"slug":22,"type":16},"Deployment","deployment",{"name":24,"slug":25,"type":16},"Kubernetes","kubernetes",65,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fvscode-aks-tools","2026-07-12T08:18:13.433328",null,74,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":34},[],"Visual Studio Code extension for Azure Kubernetes Service","https:\u002F\u002Fgithub.com\u002FAzure\u002Fvscode-aks-tools\u002Ftree\u002FHEAD\u002Fskills\u002Fkickstart-safeguard-checklist","---\nname: kickstart-safeguard-checklist\ndescription: \"AKS deployment safeguard rules checklist for validating Kubernetes manifests.\"\ndisable-model-invocation: true\n---\n\n# AKS Deployment Safeguard Checklist\n\nThis skill provides a comprehensive checklist for validating generated Kubernetes manifests against AKS security and deployment best practices. Use this during the Review phase to ensure all generated configurations comply with organizational policies.\n\n## Safeguard Rules\n\n### Rule: no-privileged\n- **Severity**: HIGH\n- **Description**: Containers must not run in privileged mode.\n- **Check**: Verify that `spec.containers[*].securityContext.privileged` is not set to `true`\n- [ ] Pass \u002F Fail\n\n### Rule: require-limits\n- **Severity**: MEDIUM\n- **Description**: All containers must declare resource limits (CPU and memory).\n- **Check**: Verify that `spec.containers[*].resources.limits` is defined for all containers\n- [ ] Pass \u002F Fail\n\n### Rule: no-hostpath\n- **Severity**: HIGH\n- **Description**: Pods must not use hostPath volumes.\n- **Check**: Verify that `spec.volumes[*].hostPath` is null or not present\n- [ ] Pass \u002F Fail\n\n### Rule: no-latest-tag\n- **Severity**: HIGH\n- **Description**: Container images must not use the ':latest' tag.\n- **Check**: Verify that `spec.containers[*].image` does not end with `:latest`\n- [ ] Pass \u002F Fail\n\n### Rule: no-privilege-escalation\n- **Severity**: HIGH\n- **Description**: Containers must not allow privilege escalation.\n- **Check**: Verify that `spec.containers[*].securityContext.allowPrivilegeEscalation` is not set to `true`\n- [ ] Pass \u002F Fail\n\n### Rule: no-dangerous-capabilities\n- **Severity**: HIGH\n- **Description**: Containers must not add dangerous capabilities (SYS_ADMIN, NET_ADMIN, ALL, etc.).\n- **Check**: Verify that `spec.containers[*].securityContext.capabilities.add` does not contain any of: `SYS_ADMIN`, `NET_ADMIN`, `ALL`, `SYS_PTRACE`, `SYS_MODULE`, `DAC_READ_SEARCH`\n- [ ] Pass \u002F Fail\n\n### Rule: run-as-non-root\n- **Severity**: MEDIUM\n- **Description**: Containers must run as a non-root user.\n- **Check**: Verify that `spec.securityContext.runAsNonRoot` is set to `true`\n- [ ] Pass \u002F Fail\n\n### Rule: no-host-network\n- **Severity**: HIGH\n- **Description**: Pods must not use host networking.\n- **Check**: Verify that `spec.hostNetwork` is not set to `true`\n- [ ] Pass \u002F Fail\n\n### Rule: no-host-pid\n- **Severity**: HIGH\n- **Description**: Pods must not share the host PID namespace.\n- **Check**: Verify that `spec.hostPID` is not set to `true`\n- [ ] Pass \u002F Fail\n\n### Rule: read-only-root-filesystem\n- **Severity**: MEDIUM\n- **Description**: readOnlyRootFilesystem should be true where the application permits.\n- **Check**: Verify `spec.containers[*].securityContext.readOnlyRootFilesystem` is `true` (use tmpfs for writable paths)\n- [ ] Pass \u002F Fail\n\n### Rule: gateway-api-for-ingress\n- **Severity**: HIGH\n- **Description**: Use Gateway API (HTTPRoute) for ingress, not the legacy Ingress resource.\n- **Check**: Verify no `kind: Ingress` resources exist; all ingress uses `kind: HTTPRoute` with `gateway.networking.k8s.io\u002Fv1` API\n- [ ] Pass \u002F Fail\n\n### Rule: workload-identity-required\n- **Severity**: HIGH\n- **Description**: Azure access must use Workload Identity, not stored credentials.\n- **Check**: Verify pods use `azure.workload.identity\u002Fuse: \"true\"` label and ServiceAccount with `azure.workload.identity\u002Fclient-id` annotation. No Azure connection strings or keys in env vars or secrets.\n- [ ] Pass \u002F Fail\n\n### Rule: acr-with-acrpull\n- **Severity**: HIGH\n- **Description**: Container images must be pulled from ACR with AcrPull role binding.\n- **Check**: Verify images reference an ACR registry (`*.azurecr.io`). No `imagePullSecrets` with static credentials.\n- [ ] Pass \u002F Fail\n\n### Rule: resource-quotas-production\n- **Severity**: MEDIUM\n- **Description**: Production-tier deployments must define ResourceQuota in the namespace.\n- **Check**: Verify a `kind: ResourceQuota` exists in the namespace for production deployments\n- [ ] Pass \u002F Fail (N\u002FA for non-production)\n\n### Rule: network-policies-production\n- **Severity**: MEDIUM\n- **Description**: Production-tier deployments must define NetworkPolicy for pod-to-pod traffic.\n- **Check**: Verify a `kind: NetworkPolicy` exists restricting ingress\u002Fegress for production deployments\n- [ ] Pass \u002F Fail (N\u002FA for non-production)\n\n### Rule: pod-disruption-budget-production\n- **Severity**: MEDIUM\n- **Description**: Production-tier deployments must define PodDisruptionBudget for high availability.\n- **Check**: Verify a `kind: PodDisruptionBudget` exists with appropriate `minAvailable` or `maxUnavailable` for production deployments\n- [ ] Pass \u002F Fail (N\u002FA for non-production)\n\n## Automated Validation\n\nWhen possible, use the `runCommands` tool to validate manifests programmatically:\n\n```bash\n# Dry-run validation against K8s API schemas\nkubectl apply --dry-run=client -f k8s\u002F\n\n# Validate with kubeconform (if installed)\nkubeconform -strict -summary k8s\u002F*.yaml\n```\n\n## Review Instructions\n\nWhen reviewing manifests, use this checklist to validate each safeguard rule:\n\n1. **For each rule above**, examine the relevant manifest sections\n2. **Mark the status** for each rule as:\n   - ✓ **PASS** — The manifest complies with this rule\n   - ✗ **FAIL** — The manifest violates this rule\n   - ⊘ **N\u002FA** — This rule does not apply to the manifest (e.g., a Deployment that has no volumes cannot violate the hostPath rule)\n3. **Report results** in a summary table showing rule ID, status, and any notes\n4. **Block on failures**: Any FAIL on a **HIGH-severity** rule must be fixed before the manifest proceeds to deployment\n5. **Address medium-severity failures**: MEDIUM-severity FAILs should be resolved or explicitly justified before proceeding\n\n## Example Review Output\n\n```\n| Rule ID | Severity | Status | Notes |\n|---------|----------|--------|-------|\n| no-privileged | HIGH | ✓ PASS | securityContext.privileged is false |\n| require-limits | MEDIUM | ✓ PASS | All containers have CPU\u002Fmemory limits |\n| no-hostpath | HIGH | ✓ PASS | No hostPath volumes defined |\n| no-latest-tag | HIGH | ✓ PASS | Image uses pinned tag v1.2.3 |\n| ... | ... | ... | ... |\n```\n\n## How to Use This Skill\n\n1. **When validating K8s manifests**, reference this checklist to ensure compliance\n2. **Review the generated YAML** against each rule listed above\n3. **Document any violations** and remediate before proceeding\n4. **Use the severity levels** to prioritize fixes (HIGH first, then MEDIUM)\n\n---\n\n*Last updated: Safeguards from `packages\u002Fpack-aks-automatic\u002Fsrc\u002Fsafeguards.json`*\n",{"data":38,"body":40},{"name":4,"description":6,"disable-model-invocation":39},true,{"type":41,"children":42},"root",[43,52,58,65,72,137,143,189,195,240,246,297,303,352,358,445,451,501,507,556,562,611,617,670,676,738,744,798,804,858,864,911,917,962,968,1029,1035,1048,1155,1161,1166,1266,1272,1282,1288,1331,1335,1350],{"type":44,"tag":45,"props":46,"children":48},"element","h1",{"id":47},"aks-deployment-safeguard-checklist",[49],{"type":50,"value":51},"text","AKS Deployment Safeguard Checklist",{"type":44,"tag":53,"props":54,"children":55},"p",{},[56],{"type":50,"value":57},"This skill provides a comprehensive checklist for validating generated Kubernetes manifests against AKS security and deployment best practices. Use this during the Review phase to ensure all generated configurations comply with organizational policies.",{"type":44,"tag":59,"props":60,"children":62},"h2",{"id":61},"safeguard-rules",[63],{"type":50,"value":64},"Safeguard Rules",{"type":44,"tag":66,"props":67,"children":69},"h3",{"id":68},"rule-no-privileged",[70],{"type":50,"value":71},"Rule: no-privileged",{"type":44,"tag":73,"props":74,"children":77},"ul",{"className":75},[76],"contains-task-list",[78,90,100,125],{"type":44,"tag":79,"props":80,"children":81},"li",{},[82,88],{"type":44,"tag":83,"props":84,"children":85},"strong",{},[86],{"type":50,"value":87},"Severity",{"type":50,"value":89},": HIGH",{"type":44,"tag":79,"props":91,"children":92},{},[93,98],{"type":44,"tag":83,"props":94,"children":95},{},[96],{"type":50,"value":97},"Description",{"type":50,"value":99},": Containers must not run in privileged mode.",{"type":44,"tag":79,"props":101,"children":102},{},[103,108,110,117,119],{"type":44,"tag":83,"props":104,"children":105},{},[106],{"type":50,"value":107},"Check",{"type":50,"value":109},": Verify that ",{"type":44,"tag":111,"props":112,"children":114},"code",{"className":113},[],[115],{"type":50,"value":116},"spec.containers[*].securityContext.privileged",{"type":50,"value":118}," is not set to ",{"type":44,"tag":111,"props":120,"children":122},{"className":121},[],[123],{"type":50,"value":124},"true",{"type":44,"tag":79,"props":126,"children":129},{"className":127},[128],"task-list-item",[130,135],{"type":44,"tag":131,"props":132,"children":134},"input",{"disabled":39,"type":133},"checkbox",[],{"type":50,"value":136}," Pass \u002F Fail",{"type":44,"tag":66,"props":138,"children":140},{"id":139},"rule-require-limits",[141],{"type":50,"value":142},"Rule: require-limits",{"type":44,"tag":73,"props":144,"children":146},{"className":145},[76],[147,156,165,181],{"type":44,"tag":79,"props":148,"children":149},{},[150,154],{"type":44,"tag":83,"props":151,"children":152},{},[153],{"type":50,"value":87},{"type":50,"value":155},": MEDIUM",{"type":44,"tag":79,"props":157,"children":158},{},[159,163],{"type":44,"tag":83,"props":160,"children":161},{},[162],{"type":50,"value":97},{"type":50,"value":164},": All containers must declare resource limits (CPU and memory).",{"type":44,"tag":79,"props":166,"children":167},{},[168,172,173,179],{"type":44,"tag":83,"props":169,"children":170},{},[171],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":174,"children":176},{"className":175},[],[177],{"type":50,"value":178},"spec.containers[*].resources.limits",{"type":50,"value":180}," is defined for all containers",{"type":44,"tag":79,"props":182,"children":184},{"className":183},[128],[185,188],{"type":44,"tag":131,"props":186,"children":187},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":190,"children":192},{"id":191},"rule-no-hostpath",[193],{"type":50,"value":194},"Rule: no-hostpath",{"type":44,"tag":73,"props":196,"children":198},{"className":197},[76],[199,207,216,232],{"type":44,"tag":79,"props":200,"children":201},{},[202,206],{"type":44,"tag":83,"props":203,"children":204},{},[205],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":208,"children":209},{},[210,214],{"type":44,"tag":83,"props":211,"children":212},{},[213],{"type":50,"value":97},{"type":50,"value":215},": Pods must not use hostPath volumes.",{"type":44,"tag":79,"props":217,"children":218},{},[219,223,224,230],{"type":44,"tag":83,"props":220,"children":221},{},[222],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":225,"children":227},{"className":226},[],[228],{"type":50,"value":229},"spec.volumes[*].hostPath",{"type":50,"value":231}," is null or not present",{"type":44,"tag":79,"props":233,"children":235},{"className":234},[128],[236,239],{"type":44,"tag":131,"props":237,"children":238},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":241,"children":243},{"id":242},"rule-no-latest-tag",[244],{"type":50,"value":245},"Rule: no-latest-tag",{"type":44,"tag":73,"props":247,"children":249},{"className":248},[76],[250,258,267,289],{"type":44,"tag":79,"props":251,"children":252},{},[253,257],{"type":44,"tag":83,"props":254,"children":255},{},[256],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":259,"children":260},{},[261,265],{"type":44,"tag":83,"props":262,"children":263},{},[264],{"type":50,"value":97},{"type":50,"value":266},": Container images must not use the ':latest' tag.",{"type":44,"tag":79,"props":268,"children":269},{},[270,274,275,281,283],{"type":44,"tag":83,"props":271,"children":272},{},[273],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":276,"children":278},{"className":277},[],[279],{"type":50,"value":280},"spec.containers[*].image",{"type":50,"value":282}," does not end with ",{"type":44,"tag":111,"props":284,"children":286},{"className":285},[],[287],{"type":50,"value":288},":latest",{"type":44,"tag":79,"props":290,"children":292},{"className":291},[128],[293,296],{"type":44,"tag":131,"props":294,"children":295},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":298,"children":300},{"id":299},"rule-no-privilege-escalation",[301],{"type":50,"value":302},"Rule: no-privilege-escalation",{"type":44,"tag":73,"props":304,"children":306},{"className":305},[76],[307,315,324,344],{"type":44,"tag":79,"props":308,"children":309},{},[310,314],{"type":44,"tag":83,"props":311,"children":312},{},[313],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":316,"children":317},{},[318,322],{"type":44,"tag":83,"props":319,"children":320},{},[321],{"type":50,"value":97},{"type":50,"value":323},": Containers must not allow privilege escalation.",{"type":44,"tag":79,"props":325,"children":326},{},[327,331,332,338,339],{"type":44,"tag":83,"props":328,"children":329},{},[330],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":333,"children":335},{"className":334},[],[336],{"type":50,"value":337},"spec.containers[*].securityContext.allowPrivilegeEscalation",{"type":50,"value":118},{"type":44,"tag":111,"props":340,"children":342},{"className":341},[],[343],{"type":50,"value":124},{"type":44,"tag":79,"props":345,"children":347},{"className":346},[128],[348,351],{"type":44,"tag":131,"props":349,"children":350},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":353,"children":355},{"id":354},"rule-no-dangerous-capabilities",[356],{"type":50,"value":357},"Rule: no-dangerous-capabilities",{"type":44,"tag":73,"props":359,"children":361},{"className":360},[76],[362,370,379,437],{"type":44,"tag":79,"props":363,"children":364},{},[365,369],{"type":44,"tag":83,"props":366,"children":367},{},[368],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":371,"children":372},{},[373,377],{"type":44,"tag":83,"props":374,"children":375},{},[376],{"type":50,"value":97},{"type":50,"value":378},": Containers must not add dangerous capabilities (SYS_ADMIN, NET_ADMIN, ALL, etc.).",{"type":44,"tag":79,"props":380,"children":381},{},[382,386,387,393,395,401,403,409,410,416,417,423,424,430,431],{"type":44,"tag":83,"props":383,"children":384},{},[385],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":388,"children":390},{"className":389},[],[391],{"type":50,"value":392},"spec.containers[*].securityContext.capabilities.add",{"type":50,"value":394}," does not contain any of: ",{"type":44,"tag":111,"props":396,"children":398},{"className":397},[],[399],{"type":50,"value":400},"SYS_ADMIN",{"type":50,"value":402},", ",{"type":44,"tag":111,"props":404,"children":406},{"className":405},[],[407],{"type":50,"value":408},"NET_ADMIN",{"type":50,"value":402},{"type":44,"tag":111,"props":411,"children":413},{"className":412},[],[414],{"type":50,"value":415},"ALL",{"type":50,"value":402},{"type":44,"tag":111,"props":418,"children":420},{"className":419},[],[421],{"type":50,"value":422},"SYS_PTRACE",{"type":50,"value":402},{"type":44,"tag":111,"props":425,"children":427},{"className":426},[],[428],{"type":50,"value":429},"SYS_MODULE",{"type":50,"value":402},{"type":44,"tag":111,"props":432,"children":434},{"className":433},[],[435],{"type":50,"value":436},"DAC_READ_SEARCH",{"type":44,"tag":79,"props":438,"children":440},{"className":439},[128],[441,444],{"type":44,"tag":131,"props":442,"children":443},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":446,"children":448},{"id":447},"rule-run-as-non-root",[449],{"type":50,"value":450},"Rule: run-as-non-root",{"type":44,"tag":73,"props":452,"children":454},{"className":453},[76],[455,463,472,493],{"type":44,"tag":79,"props":456,"children":457},{},[458,462],{"type":44,"tag":83,"props":459,"children":460},{},[461],{"type":50,"value":87},{"type":50,"value":155},{"type":44,"tag":79,"props":464,"children":465},{},[466,470],{"type":44,"tag":83,"props":467,"children":468},{},[469],{"type":50,"value":97},{"type":50,"value":471},": Containers must run as a non-root user.",{"type":44,"tag":79,"props":473,"children":474},{},[475,479,480,486,488],{"type":44,"tag":83,"props":476,"children":477},{},[478],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":481,"children":483},{"className":482},[],[484],{"type":50,"value":485},"spec.securityContext.runAsNonRoot",{"type":50,"value":487}," is set to ",{"type":44,"tag":111,"props":489,"children":491},{"className":490},[],[492],{"type":50,"value":124},{"type":44,"tag":79,"props":494,"children":496},{"className":495},[128],[497,500],{"type":44,"tag":131,"props":498,"children":499},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":502,"children":504},{"id":503},"rule-no-host-network",[505],{"type":50,"value":506},"Rule: no-host-network",{"type":44,"tag":73,"props":508,"children":510},{"className":509},[76],[511,519,528,548],{"type":44,"tag":79,"props":512,"children":513},{},[514,518],{"type":44,"tag":83,"props":515,"children":516},{},[517],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":520,"children":521},{},[522,526],{"type":44,"tag":83,"props":523,"children":524},{},[525],{"type":50,"value":97},{"type":50,"value":527},": Pods must not use host networking.",{"type":44,"tag":79,"props":529,"children":530},{},[531,535,536,542,543],{"type":44,"tag":83,"props":532,"children":533},{},[534],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":537,"children":539},{"className":538},[],[540],{"type":50,"value":541},"spec.hostNetwork",{"type":50,"value":118},{"type":44,"tag":111,"props":544,"children":546},{"className":545},[],[547],{"type":50,"value":124},{"type":44,"tag":79,"props":549,"children":551},{"className":550},[128],[552,555],{"type":44,"tag":131,"props":553,"children":554},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":557,"children":559},{"id":558},"rule-no-host-pid",[560],{"type":50,"value":561},"Rule: no-host-pid",{"type":44,"tag":73,"props":563,"children":565},{"className":564},[76],[566,574,583,603],{"type":44,"tag":79,"props":567,"children":568},{},[569,573],{"type":44,"tag":83,"props":570,"children":571},{},[572],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":575,"children":576},{},[577,581],{"type":44,"tag":83,"props":578,"children":579},{},[580],{"type":50,"value":97},{"type":50,"value":582},": Pods must not share the host PID namespace.",{"type":44,"tag":79,"props":584,"children":585},{},[586,590,591,597,598],{"type":44,"tag":83,"props":587,"children":588},{},[589],{"type":50,"value":107},{"type":50,"value":109},{"type":44,"tag":111,"props":592,"children":594},{"className":593},[],[595],{"type":50,"value":596},"spec.hostPID",{"type":50,"value":118},{"type":44,"tag":111,"props":599,"children":601},{"className":600},[],[602],{"type":50,"value":124},{"type":44,"tag":79,"props":604,"children":606},{"className":605},[128],[607,610],{"type":44,"tag":131,"props":608,"children":609},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":612,"children":614},{"id":613},"rule-read-only-root-filesystem",[615],{"type":50,"value":616},"Rule: read-only-root-filesystem",{"type":44,"tag":73,"props":618,"children":620},{"className":619},[76],[621,629,638,662],{"type":44,"tag":79,"props":622,"children":623},{},[624,628],{"type":44,"tag":83,"props":625,"children":626},{},[627],{"type":50,"value":87},{"type":50,"value":155},{"type":44,"tag":79,"props":630,"children":631},{},[632,636],{"type":44,"tag":83,"props":633,"children":634},{},[635],{"type":50,"value":97},{"type":50,"value":637},": readOnlyRootFilesystem should be true where the application permits.",{"type":44,"tag":79,"props":639,"children":640},{},[641,645,647,653,655,660],{"type":44,"tag":83,"props":642,"children":643},{},[644],{"type":50,"value":107},{"type":50,"value":646},": Verify ",{"type":44,"tag":111,"props":648,"children":650},{"className":649},[],[651],{"type":50,"value":652},"spec.containers[*].securityContext.readOnlyRootFilesystem",{"type":50,"value":654}," is ",{"type":44,"tag":111,"props":656,"children":658},{"className":657},[],[659],{"type":50,"value":124},{"type":50,"value":661}," (use tmpfs for writable paths)",{"type":44,"tag":79,"props":663,"children":665},{"className":664},[128],[666,669],{"type":44,"tag":131,"props":667,"children":668},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":671,"children":673},{"id":672},"rule-gateway-api-for-ingress",[674],{"type":50,"value":675},"Rule: gateway-api-for-ingress",{"type":44,"tag":73,"props":677,"children":679},{"className":678},[76],[680,688,697,730],{"type":44,"tag":79,"props":681,"children":682},{},[683,687],{"type":44,"tag":83,"props":684,"children":685},{},[686],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":689,"children":690},{},[691,695],{"type":44,"tag":83,"props":692,"children":693},{},[694],{"type":50,"value":97},{"type":50,"value":696},": Use Gateway API (HTTPRoute) for ingress, not the legacy Ingress resource.",{"type":44,"tag":79,"props":698,"children":699},{},[700,704,706,712,714,720,722,728],{"type":44,"tag":83,"props":701,"children":702},{},[703],{"type":50,"value":107},{"type":50,"value":705},": Verify no ",{"type":44,"tag":111,"props":707,"children":709},{"className":708},[],[710],{"type":50,"value":711},"kind: Ingress",{"type":50,"value":713}," resources exist; all ingress uses ",{"type":44,"tag":111,"props":715,"children":717},{"className":716},[],[718],{"type":50,"value":719},"kind: HTTPRoute",{"type":50,"value":721}," with ",{"type":44,"tag":111,"props":723,"children":725},{"className":724},[],[726],{"type":50,"value":727},"gateway.networking.k8s.io\u002Fv1",{"type":50,"value":729}," API",{"type":44,"tag":79,"props":731,"children":733},{"className":732},[128],[734,737],{"type":44,"tag":131,"props":735,"children":736},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":739,"children":741},{"id":740},"rule-workload-identity-required",[742],{"type":50,"value":743},"Rule: workload-identity-required",{"type":44,"tag":73,"props":745,"children":747},{"className":746},[76],[748,756,765,790],{"type":44,"tag":79,"props":749,"children":750},{},[751,755],{"type":44,"tag":83,"props":752,"children":753},{},[754],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":757,"children":758},{},[759,763],{"type":44,"tag":83,"props":760,"children":761},{},[762],{"type":50,"value":97},{"type":50,"value":764},": Azure access must use Workload Identity, not stored credentials.",{"type":44,"tag":79,"props":766,"children":767},{},[768,772,774,780,782,788],{"type":44,"tag":83,"props":769,"children":770},{},[771],{"type":50,"value":107},{"type":50,"value":773},": Verify pods use ",{"type":44,"tag":111,"props":775,"children":777},{"className":776},[],[778],{"type":50,"value":779},"azure.workload.identity\u002Fuse: \"true\"",{"type":50,"value":781}," label and ServiceAccount with ",{"type":44,"tag":111,"props":783,"children":785},{"className":784},[],[786],{"type":50,"value":787},"azure.workload.identity\u002Fclient-id",{"type":50,"value":789}," annotation. No Azure connection strings or keys in env vars or secrets.",{"type":44,"tag":79,"props":791,"children":793},{"className":792},[128],[794,797],{"type":44,"tag":131,"props":795,"children":796},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":799,"children":801},{"id":800},"rule-acr-with-acrpull",[802],{"type":50,"value":803},"Rule: acr-with-acrpull",{"type":44,"tag":73,"props":805,"children":807},{"className":806},[76],[808,816,825,850],{"type":44,"tag":79,"props":809,"children":810},{},[811,815],{"type":44,"tag":83,"props":812,"children":813},{},[814],{"type":50,"value":87},{"type":50,"value":89},{"type":44,"tag":79,"props":817,"children":818},{},[819,823],{"type":44,"tag":83,"props":820,"children":821},{},[822],{"type":50,"value":97},{"type":50,"value":824},": Container images must be pulled from ACR with AcrPull role binding.",{"type":44,"tag":79,"props":826,"children":827},{},[828,832,834,840,842,848],{"type":44,"tag":83,"props":829,"children":830},{},[831],{"type":50,"value":107},{"type":50,"value":833},": Verify images reference an ACR registry (",{"type":44,"tag":111,"props":835,"children":837},{"className":836},[],[838],{"type":50,"value":839},"*.azurecr.io",{"type":50,"value":841},"). No ",{"type":44,"tag":111,"props":843,"children":845},{"className":844},[],[846],{"type":50,"value":847},"imagePullSecrets",{"type":50,"value":849}," with static credentials.",{"type":44,"tag":79,"props":851,"children":853},{"className":852},[128],[854,857],{"type":44,"tag":131,"props":855,"children":856},{"disabled":39,"type":133},[],{"type":50,"value":136},{"type":44,"tag":66,"props":859,"children":861},{"id":860},"rule-resource-quotas-production",[862],{"type":50,"value":863},"Rule: resource-quotas-production",{"type":44,"tag":73,"props":865,"children":867},{"className":866},[76],[868,876,885,902],{"type":44,"tag":79,"props":869,"children":870},{},[871,875],{"type":44,"tag":83,"props":872,"children":873},{},[874],{"type":50,"value":87},{"type":50,"value":155},{"type":44,"tag":79,"props":877,"children":878},{},[879,883],{"type":44,"tag":83,"props":880,"children":881},{},[882],{"type":50,"value":97},{"type":50,"value":884},": Production-tier deployments must define ResourceQuota in the namespace.",{"type":44,"tag":79,"props":886,"children":887},{},[888,892,894,900],{"type":44,"tag":83,"props":889,"children":890},{},[891],{"type":50,"value":107},{"type":50,"value":893},": Verify a ",{"type":44,"tag":111,"props":895,"children":897},{"className":896},[],[898],{"type":50,"value":899},"kind: ResourceQuota",{"type":50,"value":901}," exists in the namespace for production deployments",{"type":44,"tag":79,"props":903,"children":905},{"className":904},[128],[906,909],{"type":44,"tag":131,"props":907,"children":908},{"disabled":39,"type":133},[],{"type":50,"value":910}," Pass \u002F Fail (N\u002FA for non-production)",{"type":44,"tag":66,"props":912,"children":914},{"id":913},"rule-network-policies-production",[915],{"type":50,"value":916},"Rule: network-policies-production",{"type":44,"tag":73,"props":918,"children":920},{"className":919},[76],[921,929,938,954],{"type":44,"tag":79,"props":922,"children":923},{},[924,928],{"type":44,"tag":83,"props":925,"children":926},{},[927],{"type":50,"value":87},{"type":50,"value":155},{"type":44,"tag":79,"props":930,"children":931},{},[932,936],{"type":44,"tag":83,"props":933,"children":934},{},[935],{"type":50,"value":97},{"type":50,"value":937},": Production-tier deployments must define NetworkPolicy for pod-to-pod traffic.",{"type":44,"tag":79,"props":939,"children":940},{},[941,945,946,952],{"type":44,"tag":83,"props":942,"children":943},{},[944],{"type":50,"value":107},{"type":50,"value":893},{"type":44,"tag":111,"props":947,"children":949},{"className":948},[],[950],{"type":50,"value":951},"kind: NetworkPolicy",{"type":50,"value":953}," exists restricting ingress\u002Fegress for production deployments",{"type":44,"tag":79,"props":955,"children":957},{"className":956},[128],[958,961],{"type":44,"tag":131,"props":959,"children":960},{"disabled":39,"type":133},[],{"type":50,"value":910},{"type":44,"tag":66,"props":963,"children":965},{"id":964},"rule-pod-disruption-budget-production",[966],{"type":50,"value":967},"Rule: pod-disruption-budget-production",{"type":44,"tag":73,"props":969,"children":971},{"className":970},[76],[972,980,989,1021],{"type":44,"tag":79,"props":973,"children":974},{},[975,979],{"type":44,"tag":83,"props":976,"children":977},{},[978],{"type":50,"value":87},{"type":50,"value":155},{"type":44,"tag":79,"props":981,"children":982},{},[983,987],{"type":44,"tag":83,"props":984,"children":985},{},[986],{"type":50,"value":97},{"type":50,"value":988},": Production-tier deployments must define PodDisruptionBudget for high availability.",{"type":44,"tag":79,"props":990,"children":991},{},[992,996,997,1003,1005,1011,1013,1019],{"type":44,"tag":83,"props":993,"children":994},{},[995],{"type":50,"value":107},{"type":50,"value":893},{"type":44,"tag":111,"props":998,"children":1000},{"className":999},[],[1001],{"type":50,"value":1002},"kind: PodDisruptionBudget",{"type":50,"value":1004}," exists with appropriate ",{"type":44,"tag":111,"props":1006,"children":1008},{"className":1007},[],[1009],{"type":50,"value":1010},"minAvailable",{"type":50,"value":1012}," or ",{"type":44,"tag":111,"props":1014,"children":1016},{"className":1015},[],[1017],{"type":50,"value":1018},"maxUnavailable",{"type":50,"value":1020}," for production deployments",{"type":44,"tag":79,"props":1022,"children":1024},{"className":1023},[128],[1025,1028],{"type":44,"tag":131,"props":1026,"children":1027},{"disabled":39,"type":133},[],{"type":50,"value":910},{"type":44,"tag":59,"props":1030,"children":1032},{"id":1031},"automated-validation",[1033],{"type":50,"value":1034},"Automated Validation",{"type":44,"tag":53,"props":1036,"children":1037},{},[1038,1040,1046],{"type":50,"value":1039},"When possible, use the ",{"type":44,"tag":111,"props":1041,"children":1043},{"className":1042},[],[1044],{"type":50,"value":1045},"runCommands",{"type":50,"value":1047}," tool to validate manifests programmatically:",{"type":44,"tag":1049,"props":1050,"children":1055},"pre",{"className":1051,"code":1052,"language":1053,"meta":1054,"style":1054},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Dry-run validation against K8s API schemas\nkubectl apply --dry-run=client -f k8s\u002F\n\n# Validate with kubeconform (if installed)\nkubeconform -strict -summary k8s\u002F*.yaml\n","bash","",[1056],{"type":44,"tag":111,"props":1057,"children":1058},{"__ignoreMap":1054},[1059,1071,1102,1111,1120],{"type":44,"tag":1060,"props":1061,"children":1064},"span",{"class":1062,"line":1063},"line",1,[1065],{"type":44,"tag":1060,"props":1066,"children":1068},{"style":1067},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1069],{"type":50,"value":1070},"# Dry-run validation against K8s API schemas\n",{"type":44,"tag":1060,"props":1072,"children":1074},{"class":1062,"line":1073},2,[1075,1081,1087,1092,1097],{"type":44,"tag":1060,"props":1076,"children":1078},{"style":1077},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1079],{"type":50,"value":1080},"kubectl",{"type":44,"tag":1060,"props":1082,"children":1084},{"style":1083},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1085],{"type":50,"value":1086}," apply",{"type":44,"tag":1060,"props":1088,"children":1089},{"style":1083},[1090],{"type":50,"value":1091}," --dry-run=client",{"type":44,"tag":1060,"props":1093,"children":1094},{"style":1083},[1095],{"type":50,"value":1096}," -f",{"type":44,"tag":1060,"props":1098,"children":1099},{"style":1083},[1100],{"type":50,"value":1101}," k8s\u002F\n",{"type":44,"tag":1060,"props":1103,"children":1105},{"class":1062,"line":1104},3,[1106],{"type":44,"tag":1060,"props":1107,"children":1108},{"emptyLinePlaceholder":39},[1109],{"type":50,"value":1110},"\n",{"type":44,"tag":1060,"props":1112,"children":1114},{"class":1062,"line":1113},4,[1115],{"type":44,"tag":1060,"props":1116,"children":1117},{"style":1067},[1118],{"type":50,"value":1119},"# Validate with kubeconform (if installed)\n",{"type":44,"tag":1060,"props":1121,"children":1123},{"class":1062,"line":1122},5,[1124,1129,1134,1139,1144,1150],{"type":44,"tag":1060,"props":1125,"children":1126},{"style":1077},[1127],{"type":50,"value":1128},"kubeconform",{"type":44,"tag":1060,"props":1130,"children":1131},{"style":1083},[1132],{"type":50,"value":1133}," -strict",{"type":44,"tag":1060,"props":1135,"children":1136},{"style":1083},[1137],{"type":50,"value":1138}," -summary",{"type":44,"tag":1060,"props":1140,"children":1141},{"style":1083},[1142],{"type":50,"value":1143}," k8s\u002F",{"type":44,"tag":1060,"props":1145,"children":1147},{"style":1146},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1148],{"type":50,"value":1149},"*",{"type":44,"tag":1060,"props":1151,"children":1152},{"style":1083},[1153],{"type":50,"value":1154},".yaml\n",{"type":44,"tag":59,"props":1156,"children":1158},{"id":1157},"review-instructions",[1159],{"type":50,"value":1160},"Review Instructions",{"type":44,"tag":53,"props":1162,"children":1163},{},[1164],{"type":50,"value":1165},"When reviewing manifests, use this checklist to validate each safeguard rule:",{"type":44,"tag":1167,"props":1168,"children":1169},"ol",{},[1170,1180,1229,1239,1256],{"type":44,"tag":79,"props":1171,"children":1172},{},[1173,1178],{"type":44,"tag":83,"props":1174,"children":1175},{},[1176],{"type":50,"value":1177},"For each rule above",{"type":50,"value":1179},", examine the relevant manifest sections",{"type":44,"tag":79,"props":1181,"children":1182},{},[1183,1188,1190],{"type":44,"tag":83,"props":1184,"children":1185},{},[1186],{"type":50,"value":1187},"Mark the status",{"type":50,"value":1189}," for each rule as:\n",{"type":44,"tag":73,"props":1191,"children":1192},{},[1193,1205,1217],{"type":44,"tag":79,"props":1194,"children":1195},{},[1196,1198,1203],{"type":50,"value":1197},"✓ ",{"type":44,"tag":83,"props":1199,"children":1200},{},[1201],{"type":50,"value":1202},"PASS",{"type":50,"value":1204}," — The manifest complies with this rule",{"type":44,"tag":79,"props":1206,"children":1207},{},[1208,1210,1215],{"type":50,"value":1209},"✗ ",{"type":44,"tag":83,"props":1211,"children":1212},{},[1213],{"type":50,"value":1214},"FAIL",{"type":50,"value":1216}," — The manifest violates this rule",{"type":44,"tag":79,"props":1218,"children":1219},{},[1220,1222,1227],{"type":50,"value":1221},"⊘ ",{"type":44,"tag":83,"props":1223,"children":1224},{},[1225],{"type":50,"value":1226},"N\u002FA",{"type":50,"value":1228}," — This rule does not apply to the manifest (e.g., a Deployment that has no volumes cannot violate the hostPath rule)",{"type":44,"tag":79,"props":1230,"children":1231},{},[1232,1237],{"type":44,"tag":83,"props":1233,"children":1234},{},[1235],{"type":50,"value":1236},"Report results",{"type":50,"value":1238}," in a summary table showing rule ID, status, and any notes",{"type":44,"tag":79,"props":1240,"children":1241},{},[1242,1247,1249,1254],{"type":44,"tag":83,"props":1243,"children":1244},{},[1245],{"type":50,"value":1246},"Block on failures",{"type":50,"value":1248},": Any FAIL on a ",{"type":44,"tag":83,"props":1250,"children":1251},{},[1252],{"type":50,"value":1253},"HIGH-severity",{"type":50,"value":1255}," rule must be fixed before the manifest proceeds to deployment",{"type":44,"tag":79,"props":1257,"children":1258},{},[1259,1264],{"type":44,"tag":83,"props":1260,"children":1261},{},[1262],{"type":50,"value":1263},"Address medium-severity failures",{"type":50,"value":1265},": MEDIUM-severity FAILs should be resolved or explicitly justified before proceeding",{"type":44,"tag":59,"props":1267,"children":1269},{"id":1268},"example-review-output",[1270],{"type":50,"value":1271},"Example Review Output",{"type":44,"tag":1049,"props":1273,"children":1277},{"className":1274,"code":1276,"language":50},[1275],"language-text","| Rule ID | Severity | Status | Notes |\n|---------|----------|--------|-------|\n| no-privileged | HIGH | ✓ PASS | securityContext.privileged is false |\n| require-limits | MEDIUM | ✓ PASS | All containers have CPU\u002Fmemory limits |\n| no-hostpath | HIGH | ✓ PASS | No hostPath volumes defined |\n| no-latest-tag | HIGH | ✓ PASS | Image uses pinned tag v1.2.3 |\n| ... | ... | ... | ... |\n",[1278],{"type":44,"tag":111,"props":1279,"children":1280},{"__ignoreMap":1054},[1281],{"type":50,"value":1276},{"type":44,"tag":59,"props":1283,"children":1285},{"id":1284},"how-to-use-this-skill",[1286],{"type":50,"value":1287},"How to Use This Skill",{"type":44,"tag":1167,"props":1289,"children":1290},{},[1291,1301,1311,1321],{"type":44,"tag":79,"props":1292,"children":1293},{},[1294,1299],{"type":44,"tag":83,"props":1295,"children":1296},{},[1297],{"type":50,"value":1298},"When validating K8s manifests",{"type":50,"value":1300},", reference this checklist to ensure compliance",{"type":44,"tag":79,"props":1302,"children":1303},{},[1304,1309],{"type":44,"tag":83,"props":1305,"children":1306},{},[1307],{"type":50,"value":1308},"Review the generated YAML",{"type":50,"value":1310}," against each rule listed above",{"type":44,"tag":79,"props":1312,"children":1313},{},[1314,1319],{"type":44,"tag":83,"props":1315,"children":1316},{},[1317],{"type":50,"value":1318},"Document any violations",{"type":50,"value":1320}," and remediate before proceeding",{"type":44,"tag":79,"props":1322,"children":1323},{},[1324,1329],{"type":44,"tag":83,"props":1325,"children":1326},{},[1327],{"type":50,"value":1328},"Use the severity levels",{"type":50,"value":1330}," to prioritize fixes (HIGH first, then MEDIUM)",{"type":44,"tag":1332,"props":1333,"children":1334},"hr",{},[],{"type":44,"tag":53,"props":1336,"children":1337},{},[1338],{"type":44,"tag":1339,"props":1340,"children":1341},"em",{},[1342,1344],{"type":50,"value":1343},"Last updated: Safeguards from ",{"type":44,"tag":111,"props":1345,"children":1347},{"className":1346},[],[1348],{"type":50,"value":1349},"packages\u002Fpack-aks-automatic\u002Fsrc\u002Fsafeguards.json",{"type":44,"tag":1351,"props":1352,"children":1353},"style",{},[1354],{"type":50,"value":1355},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1357,"total":1452},[1358,1370,1385,1398,1414,1427,1440],{"slug":1359,"name":1359,"fn":1360,"description":1361,"org":1362,"tags":1363,"stars":26,"repoUrl":27,"updatedAt":1369},"kickstart-acr-integration","integrate Azure Container Registry with AKS","ACR integration for AKS Automatic. Teaches attaching an ACR, image reference conventions (digest pinning, no :latest), and pull-secret-free authentication via the managed identity.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1364,1365,1368],{"name":11,"slug":8,"type":16},{"name":1366,"slug":1367,"type":16},"Containers","containers",{"name":21,"slug":22,"type":16},"2026-07-12T08:18:05.091337",{"slug":1371,"name":1371,"fn":1372,"description":1373,"org":1374,"tags":1375,"stars":26,"repoUrl":27,"updatedAt":1384},"kickstart-bicep-authoring","author idiomatic Azure Bicep templates","Writing idiomatic, safe, and reviewable Bicep templates for Azure resources.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1376,1377,1380,1381],{"name":11,"slug":8,"type":16},{"name":1378,"slug":1379,"type":16},"Bicep","bicep",{"name":21,"slug":22,"type":16},{"name":1382,"slug":1383,"type":16},"Infrastructure as Code","infrastructure-as-code","2026-07-12T08:18:02.601998",{"slug":1386,"name":1386,"fn":1387,"description":1388,"org":1389,"tags":1390,"stars":26,"repoUrl":27,"updatedAt":1397},"kickstart-cluster-status","monitor AKS cluster provisioning status","Non-blocking cluster status peek — run at the end of Phases 3, 4, 5 to check AKS provisioning progress without hanging.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1391,1392,1393,1394],{"name":11,"slug":8,"type":16},{"name":21,"slug":22,"type":16},{"name":24,"slug":25,"type":16},{"name":1395,"slug":1396,"type":16},"Monitoring","monitoring","2026-07-12T08:18:01.355249",{"slug":1399,"name":1399,"fn":1400,"description":1401,"org":1402,"tags":1403,"stars":26,"repoUrl":27,"updatedAt":1413},"kickstart-collaborator-voice","define agent voice and interaction patterns","Voice, tone, and interaction patterns for Kickstart agents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1404,1407,1410],{"name":1405,"slug":1406,"type":16},"Agents","agents",{"name":1408,"slug":1409,"type":16},"Branding","branding",{"name":1411,"slug":1412,"type":16},"Communications","communications","2026-07-12T08:18:09.636172",{"slug":1415,"name":1415,"fn":1416,"description":1417,"org":1418,"tags":1419,"stars":26,"repoUrl":27,"updatedAt":1426},"kickstart-configure-infra","configure Azure infrastructure for AKS clusters","Configure Infrastructure phase playbook — launch the dedicated Kickstart cluster-setup view, which collects and creates the Azure resources (subscription, resource group, AKS Automatic cluster, ACR) and hands the results back to the chat.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1420,1421,1422,1425],{"name":11,"slug":8,"type":16},{"name":21,"slug":22,"type":16},{"name":1423,"slug":1424,"type":16},"Infrastructure","infrastructure",{"name":24,"slug":25,"type":16},"2026-07-12T08:18:03.828624",{"slug":1428,"name":1428,"fn":1429,"description":1430,"org":1431,"tags":1432,"stars":26,"repoUrl":27,"updatedAt":1439},"kickstart-deploy","deploy applications with Azure CLI and kubectl","Deploy phase playbook — build, push, apply with Azure CLI and kubectl.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1433,1434,1437,1438],{"name":11,"slug":8,"type":16},{"name":1435,"slug":1436,"type":16},"CLI","cli",{"name":21,"slug":22,"type":16},{"name":24,"slug":25,"type":16},"2026-07-12T08:17:52.254389",{"slug":1441,"name":1441,"fn":1442,"description":1443,"org":1444,"tags":1445,"stars":26,"repoUrl":27,"updatedAt":1451},"kickstart-design","propose target architecture on AKS","Design phase playbook — propose target architecture on AKS Automatic.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1446,1449,1450],{"name":1447,"slug":1448,"type":16},"Architecture","architecture",{"name":11,"slug":8,"type":16},{"name":21,"slug":22,"type":16},"2026-07-12T08:17:50.938775",19,{"items":1454,"total":1629},[1455,1474,1489,1508,1523,1538,1551,1566,1577,1591,1604,1617],{"slug":1456,"name":1456,"fn":1457,"description":1458,"org":1459,"tags":1460,"stars":1471,"repoUrl":1472,"updatedAt":1473},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1461,1462,1465,1468],{"name":11,"slug":8,"type":16},{"name":1463,"slug":1464,"type":16},"Compliance","compliance",{"name":1466,"slug":1467,"type":16},"Governance","governance",{"name":1469,"slug":1470,"type":16},"Policy","policy",1686,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":1475,"name":1475,"fn":1476,"description":1477,"org":1478,"tags":1479,"stars":1486,"repoUrl":1487,"updatedAt":1488},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1480,1481,1482,1483],{"name":11,"slug":8,"type":16},{"name":21,"slug":22,"type":16},{"name":1382,"slug":1383,"type":16},{"name":1484,"slug":1485,"type":16},"Migration","migration",260,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-07-12T08:17:49.646405",{"slug":1490,"name":1490,"fn":1491,"description":1492,"org":1493,"tags":1494,"stars":1505,"repoUrl":1506,"updatedAt":1507},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1495,1498,1499,1502],{"name":1496,"slug":1497,"type":16},"API Development","api-development",{"name":11,"slug":8,"type":16},{"name":1500,"slug":1501,"type":16},"Code Review","code-review",{"name":1503,"slug":1504,"type":16},"Documentation","documentation",133,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":1509,"name":1509,"fn":1510,"description":1511,"org":1512,"tags":1513,"stars":1505,"repoUrl":1506,"updatedAt":1522},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1514,1515,1516,1519],{"name":11,"slug":8,"type":16},{"name":21,"slug":22,"type":16},{"name":1517,"slug":1518,"type":16},"SDK","sdk",{"name":1520,"slug":1521,"type":16},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":1524,"name":1524,"fn":1525,"description":1526,"org":1527,"tags":1528,"stars":1505,"repoUrl":1506,"updatedAt":1537},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1529,1530,1533,1536],{"name":11,"slug":8,"type":16},{"name":1531,"slug":1532,"type":16},"GitHub","github",{"name":1534,"slug":1535,"type":16},"Project Management","project-management",{"name":1517,"slug":1518,"type":16},"2026-07-12T08:17:38.345387",{"slug":1539,"name":1539,"fn":1540,"description":1541,"org":1542,"tags":1543,"stars":1505,"repoUrl":1506,"updatedAt":1550},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1544,1545,1548,1549],{"name":11,"slug":8,"type":16},{"name":1546,"slug":1547,"type":16},"CI\u002FCD","ci-cd",{"name":21,"slug":22,"type":16},{"name":1517,"slug":1518,"type":16},"2026-07-12T08:17:34.27607",{"slug":1552,"name":1552,"fn":1553,"description":1554,"org":1555,"tags":1556,"stars":1505,"repoUrl":1506,"updatedAt":1565},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1557,1558,1559,1562],{"name":1496,"slug":1497,"type":16},{"name":11,"slug":8,"type":16},{"name":1560,"slug":1561,"type":16},"OpenAPI","openapi",{"name":1563,"slug":1564,"type":16},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":1567,"name":1567,"fn":1568,"description":1569,"org":1570,"tags":1571,"stars":1505,"repoUrl":1506,"updatedAt":1576},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1572,1573,1574,1575],{"name":11,"slug":8,"type":16},{"name":1546,"slug":1547,"type":16},{"name":1517,"slug":1518,"type":16},{"name":1520,"slug":1521,"type":16},"2026-07-12T08:17:37.08523",{"slug":1578,"name":1578,"fn":1579,"description":1580,"org":1581,"tags":1582,"stars":1505,"repoUrl":1506,"updatedAt":1590},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1583,1586,1589],{"name":1584,"slug":1585,"type":16},"LLM","llm",{"name":1587,"slug":1588,"type":16},"Performance","performance",{"name":1563,"slug":1564,"type":16},"2026-07-12T08:17:42.080413",{"slug":1592,"name":1592,"fn":1593,"description":1594,"org":1595,"tags":1596,"stars":1505,"repoUrl":1506,"updatedAt":1603},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1597,1598,1599,1602],{"name":11,"slug":8,"type":16},{"name":1546,"slug":1547,"type":16},{"name":1600,"slug":1601,"type":16},"Debugging","debugging",{"name":1517,"slug":1518,"type":16},"2026-07-12T08:17:40.821512",{"slug":1605,"name":1605,"fn":1606,"description":1607,"org":1608,"tags":1609,"stars":1505,"repoUrl":1506,"updatedAt":1616},"sensei","improve skill frontmatter compliance","**WORKFLOW SKILL** — Iteratively improve skill frontmatter compliance using the Ralph loop pattern. WHEN: \"run sensei\", \"sensei help\", \"improve skill\", \"fix frontmatter\", \"skill compliance\", \"frontmatter audit\", \"score skill\", \"check skill tokens\". INVOKES: token counting tools, test runners, git commands. FOR SINGLE OPERATIONS: use token CLI directly for counts\u002Fchecks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1610,1611,1612,1615],{"name":11,"slug":8,"type":16},{"name":1463,"slug":1464,"type":16},{"name":1613,"slug":1614,"type":16},"Process Optimization","process-optimization",{"name":1563,"slug":1564,"type":16},"2026-07-12T08:17:32.970921",{"slug":1618,"name":1618,"fn":1619,"description":1620,"org":1621,"tags":1622,"stars":1505,"repoUrl":1506,"updatedAt":1628},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: improving existing skills (use sensei), general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1623,1624,1627],{"name":1503,"slug":1504,"type":16},{"name":1625,"slug":1626,"type":16},"Plugin Development","plugin-development",{"name":1563,"slug":1564,"type":16},"2026-07-12T08:17:35.873862",109]