Skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Skills (Plugin) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Claude Code plugin marketplace — 58 installable reference skills across vLLM/SGLang inference, Kubernetes & Harvester, GPU host bring-up, observability, security, and agent workflows.
/plugin marketplace add air-gapped/skills
/plugin install <plugin>@air-gapped-marketplacePlugins are either single-skill (e.g. jinja-expert, aiperf) or multi-skill suites (e.g. vllm — bundles all vLLM reference skills into one plugin). The Plugin column in the table below is exactly the name to pass to /plugin install: suites are listed first with their member skills grouped together, single-skill plugins follow. See .claude-plugin/marketplace.json for the full list.
Versioning scheme per plugin: 0.YYYYMMDD.N where YYYYMMDD is the UTC date of the most recent content change across member skills and N is the unique commit count touching any member skill directory. Run /plugin update to pick up new bumps.
<!-- skills-start -->
| Plugin | Skill | Description |
|---|---|---|
agent | autoresearch | Autonomous experiment loops that hill-climb a measurable metric — apply one change, measure, keep it only if the number improved, revert if not, repeat unattended. Also deep multi-perspective research producing a saved report, and… |
agent | skill-improver | Improve, test and maintain Claude Code skills. Modes: fix runs a skill's eval cases and fixes what the failed answers show is missing; improve hill-climbs a 10-dimension quality rubric with blind scoring and an A/B comparator; score rates a… |
bitnami-exit | redis-to-valkey | Migrate Redis deployments (especially Bitnami Redis Helm charts in Sentinel HA mode) to Valkey on Kubernetes, including fully air-gapped clusters. Core knowledge: the RDB-version wall (Valkey replicates/loads only from Redis ≤ 7.2.x; Redis 7.4+… |
ceph | rook-ceph-best-practices | Operate, configure and upgrade Rook-managed Ceph on Kubernetes (CephCluster CR; rook-ceph, rook-ceph-cluster and ceph-csi-drivers charts; ceph-csi-operator). Core knowledge: the Rook -> Ceph -> key-rotation upgrade order and its version gates; the… |
ceph | ceph-troubleshooting | Diagnose and recover an unhealthy Ceph cluster, with Rook-on-Kubernetes specifics: slow or stuck recovery/backfill under the mClock scheduler (why osd_max_backfills "does nothing"), nearfull/backfillfull/full, inconsistent/unfound/incomplete/down… |
ceph | ceph-performance | Tune and benchmark a healthy Ceph cluster, with Rook-on-Kubernetes specifics: mClock profiles and the NVMe capacity-fallback trap (osd_mclock_max_capacity_iops), osd_memory_target from pod requests, BlueStore allocation and cache defaults, PG… |
ceph | ceph-s3 | Run Ceph RGW as an S3 endpoint under Rook (CephObjectStore, CephObjectStoreUser, ObjectBucketClaim, COSI, CephBucketTopic, multisite realms/zones). Core knowledge: the 19.2.6 / 20.2.4 RGW security fixes and their fallout (SigV4 hardening rejecting… |
defending-code | threat-model | [1/4 defending-code] Build a threat model for a target codebase. Optional first step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch); its THREAT_MODEL.md scopes and severity-calibrates every later step, but /vuln-scan… |
defending-code | vuln-scan | [2/4 defending-code] Static source-code vulnerability scan. Second step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch), and the usual entry point when no threat model exists. Reads a target directory (and THREAT_MODEL.md… |
defending-code | triage | [3/4 defending-code] Triage a batch of raw security findings. Third step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch); consumes /vuln-scan's VULN-FINDINGS.json, but accepts any scanner output, so it also stands alone… |
defending-code | patch | [4/4 defending-code] Generate candidate fixes for verified security findings. Last step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch); run /triage first so fixes aren't written for false positives. Consumes TRIAGE.json… |
dell | ansible-idrac-9-10 | Run and debug dellemc.openmanage Ansible playbooks against Dell PowerEdge iDRAC 9 (14G–16G) and iDRAC 10 (17G — R670, R770, R870, R970, XE9780, XE9785). Covers the iDRAC 10 / iDRAC 9 ≥ 7.30.10.50 BasicAuthState: Unadvertised default that… |
dev | baml-expert | BAML (Boundary ML) expert for projects defining LLM calls as typed functions in .baml files with a generated Python client. Use whenever the repo contains baml_src/, baml_client/, baml-cli commands, or imports from baml_py / baml_client. Covers… |
dev | jinja-expert | Author, read, and debug Jinja2 templates across the three places Jinja lives in 2026 — HuggingFace chat_template.jinja (rendered by apply_chat_template for vLLM / sglang), Ansible playbooks + .j2 files, and Jinja-adjacent Kubernetes workflows… |
dev | makefile-best-practices | Makefile best practices, patterns, and templates for GNU Make 4.x — dependency graphs, task-runner workflows, parallel-safe recipes, self-documenting help targets, and language-specific patterns (Go, Python, Node, Docker, Helm, POSIX). |
dev | transformers-config-tokenizers-expert | Preflight reference for HuggingFace snapshots — what vLLM, sglang, and transformers.generate see at runtime. Covers config-file precedence (tokenizer.json, tokenizer_config.json, generation_config.json, chat_template.jinja), transformers v5… |
harvester | harvester-upgrade | Plan and run a controlled, COMMUNITY-edition Harvester HCI upgrade off an EOL line up to latest stable — the no-skip minor ladder (1.5→1.6→1.7→1.8; embedded RKE2/KubeVirt/Longhorn/SLE-Micro ride along), gated at each hop on first upgrading the… |
inference-apis | chat-completions-api | Reference for the OpenAI Chat Completions API (/v1/chat/completions) and legacy /v1/completions as the lingua-franca compatibility protocol — the official spec incl. deprecation timeline and Responses-only feature delta, how 7 local servers (vLLM,… |
inference-apis | responses-api | Reference for the OpenAI Responses API (/v1/responses), OpenResponses open standard, and Codex CLI. Covers the request/response schema, previous_response_id, Conversations API, server-side compaction, WebSocket transport, hosted Shell tool, Skills,… |
inference-apis | messages-api | Reference for the Anthropic Messages API (/v1/messages) as a third-party compatibility protocol — the 7 inference servers that implement it natively (vLLM, SGLang, llama.cpp, Ollama, mistral.rs, Llama Stack/OGX, Lemonade), gateways that adapt it… |
inference-cache | lmcache-mp | LMCache multiprocess (MP) mode — standalone LMCache server in its own pod/process that vLLM connects to over ZMQ. Gives process isolation, no GIL contention on the inference path, one cache shared by multiple vLLM pods per node, and CPU-memory… |
inference-cache | nvidia-nixl | NVIDIA Inference Xfer Library (NIXL) operator + developer reference. Point-to-point KV-cache and tensor transport for distributed inference (Dynamo, vLLM, SGLang). Covers the agent API (full Python reference; C++/Rust via upstream pointers), all 15… |
inference-host | nvidia-datacenter-bringup | Bring up NVIDIA HGX/DGX datacenter GPU hosts on Ubuntu 24.04 LTS — air-gapped or connected, Secure Boot enabled. Covers B300/B200/H100/A100/L40S/L4 driver+fabricmanager+NVLSM+DOCA-OFED install order and exact package set from NVIDIA CUDA repo + DOCA… |
inference-host | gpu-host-tuning | Audit AND tune Linux/GPU inference hosts — read-only host snapshot |
jira | jira-cli | Drive Atlassian Jira from the terminal with the jira CLI (jira-cli, v1.7.0) against ANY Jira — Cloud or on-premise/Data Center. Covers the full command surface (issue / epic / sprint / board / project / release), the non-interactive automation… |
k8s | argo-cd-apps | Author and maintain Argo CD Application and ApplicationSet manifests as a GitOps consumer (publisher), targeting Argo CD v3.4 / v3.5 (Sept 2026). Covers source types (Helm, Kustomize, OCI, multi-source, plugin), sync policies + options + waves +… |
k8s | helm | This skill should be used for Helm chart work in either direction. Authoring: creating charts, templates and _helpers.tpl, values.yaml patterns, Chart.yaml, values.schema.json, helm-docs, library charts, chart CI/CD and signing. Consuming: carrying… |
k8s | k8s-components-checker | Survey an RKE2 community cluster against an embedded compatibility registry of 20 stack components and produce a verdict for upgrade-readiness, drift-review, and version-skew questions. Components: RKE2, Rancher, Harvester, Cilium, Tetragon,… |
k8s | keda | Configure, operate, and master KEDA (Kubernetes Event-driven Autoscaling) — ScaledObject, ScaledJob, TriggerAuthentication CRDs, 79 scalers, HPA behavior tuning, scale-to-zero, the KEDA HTTP Add-on, production hardening, multi-trigger semantics,… |
k8s | keycloak-iam | Operate, configure, deploy, secure, and integrate with Keycloak (open-source IAM) — the modern Quarkus distribution (24.x–26.8.x), the Keycloak Operator with Keycloak and KeycloakRealmImport CRDs, realm/client/identity-provider configuration,… |
k8s | openshift-app | Package applications for OpenShift deployment: container images (UBI, arbitrary UID, multi-stage builds), packaging formats (Helm, Kustomize, Operators, OLM v1), CI/CD (Tekton, ArgoCD, Shipwright, Conforma), security (SCC, PSA, supply chain, image… |
k8s | postgres-operator-cloudnative-pg-migration | Migrate PostgreSQL clusters from the Zalando postgres-operator (acid.zalan.do postgresql CRs, Spilo/Patroni, WAL-G) to CloudNativePG (CNPG) on Kubernetes, incl. fully air-gapped clusters. Core knowledge: the two walls (Spilo↔CNPG glibc/collation… |
k8s | rancher-upgrade | Plan and sequence COMMUNITY-edition Rancher upgrades across air-gapped multi-cluster fleets — a management/"hosting" Rancher cluster plus the downstream RKE2/K3s clusters it provisions. Covers the community release model (2.11→2.15,… |
k8s | traefik-hardening | Harden a Traefik 2.x/3.x reverse proxy against abusive or unwanted traffic — per-identity rate + concurrency limiting, IP allowlisting, request-body buffering, middleware chaining, keying limits on a JWT claim/header instead of raw source IP,… |
litellm | litellm-valkey | Run LiteLLM proxy multi-pod with Redis/Valkey (standalone, Sentinel, or Cluster) so rate limits, budgets, and router state are actually shared across pods. Centerpiece: LiteLLM's dominant failure mode is SILENT fallback from Redis to per-pod… |
litellm | litellm-api | Administer a LiteLLM proxy via its management REST API (keys, teams, users, orgs, models, budgets, spend) — a 447-path control plane where ~63% of paths are undocumented, 91 are hidden from /openapi.json, and the OpenAPI schema documents wrong field… |
observability | prometheus-mimir-grafana | Query Prometheus and Grafana Mimir, write and debug PromQL, and build or fix Grafana dashboards — for agents solving problems from metrics. Covers the Prometheus HTTP API (/api/v1/query, query_range, series, labels, metadata), Mimir… |
observability | mimir-upgrade | Plan and run a controlled, COMMUNITY-edition Grafana Mimir upgrade on the mimir-distributed Helm chart, air-gap first — the chart↔app co-pinned ladder (5.7→5.8→6.0.6→6.1.0 = app 2.16→2.17→3.0.4→3.1.2), the classic-vs-ingest-storage decision (the… |
observability | snmp-exporter | Best practices for Prometheus snmp_exporter (v0.30.x): writing generator.yml modules, curating MIB walks, SNMPv2c/v3 auth, timeout tuning, Kubernetes deployment (Probe/ScrapeConfig CRDs, secrets, UDP egress), local docker testing, and debugging… |
observability | logging-operator | Configure and operate the kube-logging logging-operator (formerly Banzai Cloud) on Kubernetes — the CRD-driven log pipeline: Fluent Bit collector → fluentd or syslog-ng aggregator → outputs. Covers the 16-CRD model (Logging, Flow/ClusterFlow,… |
observability | rancher-logging-exit | Migrate off the Rancher-bundled rancher-logging chart (cattle-logging-system, rancher/mirrored-kube-logging-* images) to the upstream kube-logging logging-operator ≥6.7.0 — air-gap-first. Rancher 2.11 through 2.15-dev all bundle a frozen operator… |
open-webui | open-webui-api | Administer Open WebUI entirely via its REST API (v0.11.x): user/group lifecycle, permissions, model catalog GitOps (export/import/sync), knowledge/RAG pipelines, config-as-code, SCIM provisioning, event webhooks, and backup surfaces. Grounded in the… |
open-webui | open-webui-embeddings | Choose and wire open-weights embedding + reranker models into Open WebUI's RAG pipeline, across TEI, vLLM, OpenRouter or LiteLLM. Covers model selection on current MTEB data (quality, zero-shot contamination, and a FLOPs-based throughput model,… |
open-webui | open-webui-valkey-websocket | Deploy Open WebUI multi-pod with WebSockets and Valkey/Redis Sentinel at 1000+ user scale on Kubernetes. Centerpiece is the structural Socket.IO+Redis frame-amplification bug (#23733) that crippled multi-pod streaming before v0.11.1, and the… |
sglang | sglang-hicache | SGLang HiCache (hierarchical KV cache) — three-tier prefix cache: GPU HBM (L1) → pinned host DRAM (L2) → distributed L3 (Mooncake / 3FS / NIXL / AIBrix / EIC / SiMM / file / LMCache). Covers --enable-hierarchical-cache, all --hicache-* flags,… |
sglang | sglang-model-gateway | SGLang Model Gateway (sgl-model-gateway, formerly sgl-router) — Rust router fronting vLLM and SGLang inference workers on Kubernetes. Covers first-class vLLM gRPC backend plus HTTP transparent-proxy for vanilla vLLM, the policy set (six… |
ubuntu | ubuntu-autoinstall | Author, validate, and debug Ubuntu Server autoinstall configuration (the Subiquity installer's autoinstall: schema, version 1) for Ubuntu Server LTS 24.04 and 26.04, focused on unattended on-premise and air-gapped installs — identity, storage… |
ubuntu | ubuntu-cloud-init | Author, validate, and debug cloud-init configuration for Ubuntu Server LTS 24.04 and 26.04, focused on on-premise and air-gapped hosts via the NoCloud datasource — #cloud-config user-data, the cloud-config modules (users, ssh, write_files, runcmd,… |
ubuntu | ubuntu-netplan | Author, validate, and debug netplan network configuration (/etc/netplan/*.yaml) for Ubuntu Server LTS 24.04 and 26.04, focused on on-premise and air-gapped hosts — static addressing, bonds, bridges, VLANs, VRFs, routing/policy-routing, DNS,… |
vllm | vllm-benchmarking | Run production vLLM benchmarks — vllm bench (serve, throughput, latency, sweep, startup, mm-processor), request-rate vs max-concurrency semantics, TTFT/TPOT/ITL/E2EL percentiles, goodput SLO measurement, prefix-cache workloads, air-gapped… |
vllm | vllm-caching | vLLM tiered KV cache configuration for production H100/H200 clusters. Native CPU offload, LMCache (CPU+NVMe+GDS), NixlConnector (disaggregated prefill), MooncakeConnector (RDMA), MultiConnector composition. Version gates, sizing math (flag total… |
vllm | vllm-chat-templates | vLLM chat-template (prompt-side Jinja) operator reference. Template resolution precedence (--chat-template → AutoProcessor → tokenizer default → bundled fallback), chat_template_kwargs allowlist silently dropping… |
vllm | vllm-configuration | Configure vLLM completely — YAML config file format, CLI arg precedence, full VLLM_/HF_/TRANSFORMERS_* env-var catalog, end-to-end recipe for air-gapped environments (internal HF mirrors, hf-mirror.com, ModelScope, HF_HUB_OFFLINE with pre-seeded… |
vllm | vllm-deployment | Use this skill when authoring, reviewing, or fixing a vLLM Kubernetes manifest, Docker/Podman pod, or OpenShift ServingRuntime — even when the user does not say "vllm". Triggers on: lab cluster performance practices, cache mount + survival across… |
vllm | vllm-gemma-4-31b | Operating-point reference for serving Gemma 4 31B on vLLM — TP sizing, max_model_len, max_num_seqs, gpu_memory_utilization, kv_cache_dtype, EAGLE3 spec-dec, chat_template choice. |
vllm | vllm-input-modalities | vLLM non-chat inference surfaces — text embeddings (/v1/embeddings, /v2/embed), reranking/scoring (/rerank, /score), speech-to-text (/v1/audio/transcriptions, /v1/audio/translations), document OCR via VLMs. Covers 2026 --runner pooling… |
vllm | vllm-nvidia-hardware | NVIDIA AI-hardware + vLLM-platform reference covering Hopper (H100/H200), Blackwell (B100/B200/B300) and Blackwell Ultra, Grace-Blackwell superchips and NVL72 racks (GB200, GB300), Vera Rubin (R100/R300) with VR200 NVL144 and Kyber NVL576, Dell… |
vllm | vllm-observability | Observe production vLLM from the data it already emits — the V1 /metrics Prometheus surface, SLO alerts on TTFT/ITL/queue/KV/preemption/aborts/corrupted logits, the shipped Grafana dashboards, OTLP tracing (--otlp-traces-endpoint,… |
vllm | vllm-omni | vLLM-Omni output-side multimodal generation — image (FLUX.1/2, Qwen-Image, GLM-Image, BAGEL, SD3.5, HunyuanImage-3.0), video (Wan2.1/2.2, LTX-2, HunyuanVideo-1.5), TTS (Qwen3-TTS, CosyVoice3, Voxtral-TTS), any-to-any omni (Qwen3-Omni, Qwen2.5-Omni,… |
vllm | vllm-performance-tuning | vLLM performance-tuning operator reference — tuning workflow (baseline → bottleneck → knob → re-bench), fused-MoE kernel autotune (benchmark_moe.py generates E=N,N=M,device_name=X.json configs), DeepEP all-to-all + expert parallelism + EPLB,… |
vllm | vllm-quantization | vLLM datacenter-GPU quantization — picking, configuring, troubleshooting NVFP4, FP8, MXFP4, MXFP8, AWQ, GPTQ, INT8, compressed-tensors, modelopt, quark on H100/H200/B200/B300/GB200/GB300; every --quantization flag value, KV-cache dtypes (fp8_e4m3,… |
vllm | vllm-reasoning-parsers | vLLM reasoning-parser operator + developer reference. --reasoning-parser CLI wiring, ReasoningParser contract (non-streaming extract_reasoning + per-delta extract_reasoning_streaming), is_reasoning_end xgrammar gating,… |
vllm | vllm-speculative-decoding | Pick, configure, tune, monitor vLLM speculative decoding in production. Thirteen SpeculativeMethod options (ngram, ngram_gpu, medusa, mlp_speculator, draft_model, suffix, custom_class, eagle, eagle3, dflash, dspark, mtp, extract_hidden_states),… |
vllm | vllm-tool-parsers | vLLM tool-calling operator reference — picking --tool-call-parser per model family, writing custom parsers via --tool-parser-plugin, navigating vLLM source + GitHub tracker to debug any specific tool-call question. Pointer map, not source… |
aiperf | aiperf | NVIDIA AIPerf — vendor-neutral generative-AI inference benchmarking (genai-perf successor). aiperf profile: concurrency / request-rate / fixed-schedule trace replay / user-centric / multi-run confidence, 19 endpoint types (chat, completions,… |
airgap-vetting | airgap-vetting | Vet an open-source product for air-gap readiness BEFORE adoption. Answers eight questions — telemetry, does-opt-out-actually-work, proxy-in-disguise over a hosted API, runtime downloads, custom-CA support, feature-level content egress / offline… |
analytical-troubleshooting | analytical-troubleshooting | Structured live troubleshooting for deviation problems: something worked (or should work) and now doesn't, and the cause is unknown. Staged method — quick likelihood-weighted tests first, escalating to a comparative IS/IS-NOT specification with… |
claude-code-ci-harness | claude-code-ci-harness | Run Claude Code headlessly as an isolated CI harness against any Anthropic Messages-compatible endpoint (local engine, gateway or hosted API) or a Claude subscription token. Covers credential isolation, stream-json transcripts, tool-call assertions,… |
confluence-best-practices | confluence-best-practices | Advise on USING Confluence well, not operating it: make the structural call — is this a space, a page, or a child page? — diagnose why a wiki is a dread (can't find anything, content rots, duplicates, hidden by permissions, unreadable), and… |
gitlab-best-practices | gitlab-best-practices | Operate self-managed GitLab on the official Helm chart — multi-hop upgrade campaigns across required stops, the chart-10 wall (bundled PostgreSQL, Redis and MinIO removed and now mandatory), PostgreSQL 17 being both the minimum and the maximum for… |
jira-best-practices | jira-best-practices | Advise on USING Jira well, not operating it: make the structural call — is this an epic, a story, a task, or a sub-task? — and diagnose why a Jira is a dread, then recommend the lean fix. Adapt to the organisation's OWN hierarchy names, conventions,… |
jira-confluence-mcp | jira-confluence-mcp | Install, configure, secure, and troubleshoot the mcp-atlassian MCP server (sooperset/mcp-atlassian) that connects an agent to Jira/Confluence — including AIR-GAPPED setup (mirror the prebuilt image by digest; no PyPI/git mirror) and internal-CA /… |
netbox-best-practices | netbox-best-practices | NetBox 4.2-4.7 deployment and upgrade knowledge the official netboxlabs/skills marketplace does not cover — deploying or upgrading NetBox on Kubernetes with the netbox-community helm chart (netbox-chart), external PostgreSQL/valkey wiring, API token… |
opencode-ci-harness | opencode-ci-harness | Run opencode (v2) CLI as a headless, fully-isolated test harness against any OpenAI-, Responses- or Messages-compatible endpoint (local inference engine or remote API), or against any provider credential already stored in an opencode profile (API… |
postgres-operator-best-practices | postgres-operator-best-practices | Run, configure, upgrade and troubleshoot the Zalando postgres-operator (acid.zalan.do postgresql CRs, Spilo, Patroni, WAL-G) on Kubernetes. Core knowledge: the v1.x -> v2.x major upgrade and its three changed defaults that bite silently… |
secure-boot-cert-rotation | secure-boot-cert-rotation | Triage and fix the Microsoft Secure Boot 2011→2023 UEFI certificate rotation across Dell PowerEdge / iDRAC9 bare metal, Ubuntu/Linux servers, and Harvester HCI / KubeVirt guest VMs. Two 2011 CAs expired June 2026 and Windows Production PCA 2011… |
<!-- skills-end -->
MIT licensed.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.