# Operating Infra

> Author, inspect, troubleshoot, and review infrastructure across IaC,

- **Type:** Skill
- **Install:** `agentstack add skill-alexei-led-cc-thingz-operating-infra`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [alexei-led](https://agentstack.voostack.com/s/alexei-led)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [alexei-led](https://github.com/alexei-led)
- **Source:** https://github.com/alexei-led/cc-thingz/tree/master/dist/codex/plugins/infra-ops/skills/operating-infra

## Install

```sh
agentstack add skill-alexei-led-cc-thingz-operating-infra
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Operate Infrastructure

## Boundary

- Work from files, plans, logs, and read-only commands before changing anything.
- Do not run apply, delete, destroy, or rollback until identity, exact resources, blast radius, and plan/diff/inventory are shown and the user confirms.
- If the task is deployment, rollout, rollback, or production apply, use `deploying-infra`.
- If the task is only shell scripts or generic command pipelines, use `writing-shell`.

## Role behavior

- Write-capable: make minimal file changes and run safe validation. Stop before live mutation unless the user confirmed exact resources.
- Read-only: apply nothing; return proposed file changes, evidence, and validation commands.

## Load references

Load every matching reference:

- Terraform/OpenTofu files, modules, state, or plans → [terraform.md](references/terraform.md)
- Kubernetes manifests or `kustomization.yaml` → [kubernetes.md](references/kubernetes.md)
- `Chart.yaml`, Helm values, or chart templates → [helm.md](references/helm.md)
- GitHub workflow YAML → [github-actions.md](references/github-actions.md)
- `Dockerfile` or container image build/release concerns → [dockerfile.md](references/dockerfile.md)
- AWS CLI, EC2, ECS, Lambda, S3, RDS, IAM, or CloudWatch → [aws.md](references/aws.md)
- GCP CLI, GCS, Compute Engine, IAM, quotas, or Cloud Logging → [gcp.md](references/gcp.md)
- Cloud Run services, revisions, traffic, or logs → [cloud-run.md](references/cloud-run.md)
- BigQuery queries, tables, datasets, or cost checks → [bigquery.md](references/bigquery.md)
- Linux services, hosts, processes, disks, or networks → [linux.md](references/linux.md)

Mixed stacks: load all matching references. Unknown stack: use the workflow below only.

## Workflow

1. Identify scope: files, resources, environment, account/project, region/zone, and owner.
2. Verify cloud identity before cloud work; prefer explicit profile/project/region over defaults.
3. Inspect current state with read-only evidence: files, plan/diff, list/describe/status, logs, metrics, and recent events.
4. For authoring/design: choose the smallest pattern that preserves ownership, state boundaries, and least privilege.
5. For troubleshooting: rank likely causes, gather one safe signal, then propose the next step.
6. For validation: run relevant gates when tools exist; state skipped gates and why.
7. For destructive, costly, or externally visible work: show exact resources and blast radius, then stop for confirmation or hand off to `deploying-infra`.

## Validation gates

- Terraform/OpenTofu: format, init without backend when possible, validate, plan, `tflint`, `checkov` or `trivy config`; use plan JSON for policy checks when needed.
- Kubernetes/Kustomize: render first, schema-check with `kubeconform`, then policy/security-check with `kube-linter`, `kubescape`, `conftest`, or `kyverno`.
- Helm: lint chart, render templates, use `helm diff` before upgrade planning, validate rendered YAML.
- Docker/images: lint Dockerfile with `hadolint`; scan images/config with `trivy`; use `syft`, `grype`, and `cosign` where SBOM, vulnerability, or signature proof matters.
- GitHub Actions: run `actionlint` and `zizmor`; require SHA-pinned actions and least-permission jobs.
- Cloud CLI: verify identity, inventory resources, estimate cost or dry-run when available, and check IAM/quota before mutation.

## Output

```text
INFRA RESULT
============
Scope: 
Identity: 
Status: DONE | NEEDS CONFIRMATION | BLOCKED

Evidence:
- 

Changes or proposal:
- 

Validation:
-  — pass/fail/skipped

Next:
- 
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [alexei-led](https://github.com/alexei-led)
- **Source:** [alexei-led/cc-thingz](https://github.com/alexei-led/cc-thingz)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-alexei-led-cc-thingz-operating-infra
- Seller: https://agentstack.voostack.com/s/alexei-led
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.