DevOps-Security-Agent-Skills: a SKILL.md knowledge base for infrastructure agents
Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container hardening, SOC2/ISO27001, and incident response—plus ready-to-run scripts, templates, and playbooks for SRE, platform, and security teams.
At a glance
- What is it?
- The repository ships over 160 Agent Skills covering Kubernetes, Terraform, cloud platforms, compliance and AI operations, installed through the skills.sh CLI or a git clone. It is a documentation and template distribution, not a runtime tool, and its value depends on whether your agent actually supports the Agent Skills format.
- Who is it for?
- Adopt it if your team already runs an agent that reads SKILL.md files and you want curated infrastructure and security material in that format rather than an awesome-list of links. Do not adopt it if you need executable tooling, pinned version guarantees, or a vendor-maintained compliance artifact.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 116 days ago.
- What is it written in?
- Mainly Shell, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The gap between an awesome list and something an agent can act on
An AI agent asked to debug a CrashLoopBackOff has no shortage of general Kubernetes knowledge. What it lacks is your team's preferred shape for the answer: which kubectl commands to run first, which securityContext fields to set, which resource limit patterns you accept. The README frames the problem directly, contrasting link collections with what it calls production-ready knowledge the agent can act on. Each skill is a folder containing a SKILL.md of roughly 250 to 400 lines, plus scripts, references and assets. The audience is narrow and specific: SRE, platform and security teams whose agents read files from disk. If nobody on the team runs Claude Code, Cursor, Codex, OpenCode or Cline, the repository has no consumer.
How a skill gets discovered, matched and activated
The README describes a three-stage flow. The agent scans skill folders at startup, matches a user question against the YAML frontmatter of each SKILL.md, then reads the full file and runs scripts only when a skill is activated. That lazy loading is the mechanism worth understanding. Frontmatter stays in context permanently; the 250 to 400 line body does not. The practical consequence is that install size and context cost are decoupled, which is why a catalog of 160+ skills does not immediately flood the agent's window. The cost lands in matching accuracy instead. If frontmatter descriptions are vague, the agent either misses the skill or activates the wrong one, and nothing in the README describes a test harness or eval suite for that matching step. The repository's own agent-evals skill is about evaluating agents, not about validating its own skill metadata.
Installing with skills.sh, or cloning the tree
The README gives two paths. The CLI route uses npx skills add bagelhole/DevOps-Security-Agent-Skills for a full install, with flags for narrowing scope: --list to enumerate, --skill kubernetes-ops --skill hashicorp-vault to pick individual skills, -a cursor to target a specific agent, -g for a global install, and -y to skip confirmation. A combined example from the README is npx skills add bagelhole/DevOps-Security-Agent-Skills --skill kubernetes-ops --skill hashicorp-vault -a cursor -y. The manual route is git clone https://github.com/bagelhole/DevOps-Security-Agent-Skills.git ~/.skills/devops-security, which puts the whole tree under a skills directory you choose. There is no configuration file, no environment variable and no build step. The repository is Shell as its primary language, which matches a layout of scripts and markdown rather than a compiled tool.
What is actually inside a skill folder
The README shows a four-part layout: SKILL.md, scripts/, references/ and assets/. SKILL.md is documented as carrying sections for When to Use, Prerequisites, Real Configs, CLI Commands, Troubleshooting and Related Skills. The cross-reference section matters more than it looks. With 65+ infrastructure skills spanning AWS, Azure, GCP, Cloudflare, databases, networking and GPU clusters, an agent that activates one skill needs a path to adjacent ones, otherwise it answers a Terraform question without ever reaching the OpenTofu migration material. The sample content shown is a Kubernetes Deployment manifest with resource requests and limits plus a securityContext setting runAsNonRoot and readOnlyRootFilesystem. That is a reasonable default posture, though a single snippet in a README tells you nothing about whether the other 160 skills hold the same line on security defaults.
The catalog skews toward breadth, and breadth has a cost
The domain table lists 40+ DevOps skills, 35+ security, 65+ infrastructure, 20+ AI engineering, 20+ compliance and 5+ IT operations. Infrastructure is the largest bucket by a wide margin, and it is also the one most exposed to drift. Cloud provider APIs, Terraform provider versions and Kubernetes API deprecations move on their own schedules. A SKILL.md written in early 2026 may still describe a resource argument that has since been renamed. Nothing in the README describes a version matrix, a tested-against field in frontmatter, or a deprecation policy for skills that fall behind. The compliance bucket carries a different risk. 20+ skills covering SOC2, HIPAA, GDPR and PCI-DSS are reference material, not audit evidence, and the README does not claim otherwise, but the framing invites over-reading. Treat those files as a starting point for a control description, not as the control itself.
Where a curated skill set loses to purpose-built tooling
Consider a concrete comparison. For Kubernetes manifest validation, kubeconform and the Open Policy Agent Gatekeeper route do something this repository cannot: they execute against your manifests in CI and fail the build. A SKILL.md can tell an agent which constraints matter and produce a manifest that satisfies them, but it produces no exit code. If your requirement is a gate that blocks a merge, the skill is upstream of the gate, not a substitute for it. The same applies to secrets management. A hashicorp-vault skill can walk an agent through policy syntax and auth methods; it does not hold a token, renew a lease or audit a path. The honest positioning is that this repository improves the quality of what an agent writes and how it reasons, and leaves enforcement to the tools you already run.
Maintenance, licensing and what you are actually depending on
The licence is MIT, which permits commercial use, modification and redistribution provided the copyright notice and permission notice are retained. That is permissive and imposes no copyleft obligation on your own repository. The practical implication worth noting is that MIT also means no warranty and no support commitment from the maintainers. The release history shows v1.0.0 in January 2026 and v2.0.0 in March 2026, with the last push in May 2026. Two releases in roughly four months, and a jump from 80+ skills in the description to 160+ in the README, suggests the catalog is still expanding quickly. Fast expansion is the maintenance risk: every new skill is another file that can drift from the platform it documents. If you clone the tree into ~/.skills/devops-security, updating means pulling the repository again, and any local edits you made to a SKILL.md will conflict.
Editorial conclusion
Adopt it if your team already runs an agent that reads SKILL.md files and you want curated infrastructure and security material in that format rather than an awesome-list of links. Do not adopt it if you need executable tooling, pinned version guarantees, or a vendor-maintained compliance artifact. Before rolling it out, open two or three SKILL.md files from the domains you care about, check whether the embedded configs match your cluster and cloud versions, and confirm your agent's skills directory and activation behaviour.
Community notes