From cloud-foundation-principles
This skill should be used when the user asks "which cloud foundation skill should I use", "show me all cloud principles", "help me pick an infrastructure pattern", or at the start of any cloud infrastructure, Terraform, or IaC conversation. Provides the index of all fifteen principle skills and ensures the right ones are invoked before any cloud infrastructure work begins.
npx claudepluginhub oborchers/fractional-cto --plugin cloud-foundation-principlesThis skill uses the workspace's default tool permissions.
<IMPORTANT>
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
These are not suggestions. They are battle-tested, opinionated principles drawn from production experience scaling cloud infrastructure across multiple migrations, hundreds of services, and teams of every size. Each principle exists because its absence caused real, expensive damage.
Use the Skill tool to invoke any skill by name. When invoked, follow the skill's guidance directly.
| Skill | Triggers On |
|---|---|
cloud-foundation-principles:multi-account-from-day-one | Account structure, environment isolation, governance setup, organization units, landing zones |
cloud-foundation-principles:naming-and-labeling-as-code | Resource naming, tagging, cost centers, labels module, naming conventions, cost attribution |
cloud-foundation-principles:architecture-decision-records | Decision documentation, ADRs, exemptions, context preservation, technical decision tracking |
cloud-foundation-principles:repository-and-state-strategy | Terraform repo structure, numbered layers, state-per-layer isolation, cross-layer references, blast radius |
cloud-foundation-principles:terraform-module-patterns | Module design, wrapping community modules, smart defaults, validation, version pinning, conditional creation |
cloud-foundation-principles:network-architecture | VPC/VNet design, subnet tiers, API gateways, DNS, routing, NAT, VPC endpoints, private connectivity |
cloud-foundation-principles:zero-static-credentials | SSO setup, OIDC federation, no API keys, no VPN, no SSH keys, identity management, CI/CD auth |
cloud-foundation-principles:security-monitoring-from-day-one | Threat detection, compliance scanning, security hub, guard duty, centralized security account |
cloud-foundation-principles:secrets-and-configuration-management | Secrets rotation, config vs credentials, parameter stores, secret managers, access patterns |
cloud-foundation-principles:managed-services-over-self-hosted | Managed vs self-hosted, container orchestration, workflow engines, caches, databases |
cloud-foundation-principles:service-owned-infrastructure | Service teams own IaC, no central bottleneck, per-service Terraform, shared modules |
cloud-foundation-principles:container-image-tagging | Docker image tags, git SHA traceability, registry lifecycle policies, image metadata, OCI labels |
cloud-foundation-principles:tag-based-production-deploys | Production release triggers, git tags vs branches, manual approval gates, pipeline stages, pre-commit hooks |
cloud-foundation-principles:unified-cicd-platform | CI/CD platform consolidation, single pipeline platform, OIDC pipeline auth, eliminating multi-provider ops burden |
cloud-foundation-principles:operational-hygiene | Resource cleanup, cost attribution, monitoring, drift detection, lifecycle policies |
Invoke a skill when there is even a small chance the work touches one of these areas:
All fifteen principles rest on three foundations:
Governance before infrastructure — Naming conventions, account structure, and decision records must exist before the first resource is created. Skipping governance on day one creates debt that compounds every day.
Everything in code, no exceptions — Infrastructure not in code is a liability. Every resource, every permission, every configuration must be version-controlled, reviewable, and reproducible. If it can't be in code yet, document why in an ADR.
Prevent day-1 mistakes that become day-100 catastrophes — Some decisions are cheap to make on day one and catastrophically expensive to fix later. Multi-account isolation, naming conventions, and state separation are the canonical examples. This plugin exists to ensure you make them on day one.