skill
skills
Claude Code plugin marketplace — 58 installable reference skills across vLLM/SGLang inference, Kubernetes & Harvester, GPU host bring-up, observability, security, and agent workflows.
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/air-gapped/skills itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
Skills do not use an MCP config. Follow the steps in the README below.
README
synced Oct 17, 2026skills
Claude Code plugin marketplace — 58 installable reference skills across vLLM/SGLang inference, Kubernetes & Harvester, GPU host bring-up, observability, security, and agent workflows.
Install
/plugin marketplace add air-gapped/skills
/plugin install <plugin>@air-gapped-marketplace
Plugins are either single-skill (e.g. jinja-expert, aiperf) or multi-skill suites (e.g. vllm — bundles all vLLM reference skills into one plugin). The Plugin column in the table below is exactly the name to pass to /plugin install: suites are listed first with their member skills grouped together, single-skill plugins follow. See .claude-plugin/marketplace.json for the full list.
Versioning scheme per plugin: 0.YYYYMMDD.N where YYYYMMDD is the UTC date of the most recent content change across member skills and N is the unique commit count touching any member skill directory. Run /plugin update to pick up new bumps.
| Plugin | Skill | Description |
|---|---|---|
agent | autoresearch | Autonomous experiment loops that hill-climb a measurable metric — apply one change, measure, keep it only if the number improved, revert if not, repeat unattended. Also deep multi-perspective research producing a saved report, and… |
agent | skill-improver | Improve, test and maintain Claude Code skills. Modes: fix runs a skill's eval cases and fixes what the failed answers show is missing; improve hill-climbs a 10-dimension quality rubric with blind scoring and an A/B comparator; score rates a… |
bitnami-exit | redis-to-valkey | Migrate Redis deployments (especially Bitnami Redis Helm charts in Sentinel HA mode) to Valkey on Kubernetes, including fully air-gapped clusters. Core knowledge: the RDB-version wall (Valkey replicates/loads only from Redis ≤ 7.2.x; Redis 7.4+… |
ceph | rook-ceph-best-practices | Operate, configure and upgrade Rook-managed Ceph on Kubernetes (CephCluster CR; rook-ceph, rook-ceph-cluster and ceph-csi-drivers charts; ceph-csi-operator). Core knowledge: the Rook -> Ceph -> key-rotation upgrade order and its version gates; the… |
ceph | ceph-troubleshooting | Diagnose and recover an unhealthy Ceph cluster, with Rook-on-Kubernetes specifics: slow or stuck recovery/backfill under the mClock scheduler (why osd_max_backfills "does nothing"), nearfull/backfillfull/full, inconsistent/unfound/incomplete/down… |
ceph | ceph-performance | Tune and benchmark a healthy Ceph cluster, with Rook-on-Kubernetes specifics: mClock profiles and the NVMe capacity-fallback trap (osd_mclock_max_capacity_iops), osd_memory_target from pod requests, BlueStore allocation and cache defaults, PG… |
ceph | ceph-s3 | Run Ceph RGW as an S3 endpoint under Rook (CephObjectStore, CephObjectStoreUser, ObjectBucketClaim, COSI, CephBucketTopic, multisite realms/zones). Core knowledge: the 19.2.6 / 20.2.4 RGW security fixes and their fallout (SigV4 hardening rejecting… |
defending-code | threat-model | [1/4 defending-code] Build a threat model for a target codebase. Optional first step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch); its THREAT_MODEL.md scopes and severity-calibrates every later step, but /vuln-scan… |
defending-code | vuln-scan | [2/4 defending-code] Static source-code vulnerability scan. Second step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch), and the usual entry point when no threat model exists. Reads a target directory (and THREAT_MODEL.md… |
defending-code | triage | [3/4 defending-code] Triage a batch of raw security findings. Third step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch); consumes /vuln-scan's VULN-FINDINGS.json, but accepts any scanner output, so it also stands alone… |
defending-code | patch | [4/4 defending-code] Generate candidate fixes for verified security findings. Last step of the find-and-fix loop (/threat-model -> /vuln-scan -> /triage -> /patch); run /triage first so fixes aren't written for false positives. Consumes TRIAGE.json… |
dell | ansible-idrac-9-10 | Run and debug dellemc.openmanage Ansible playbooks against Dell PowerEdge iDRAC 9 (14G–16G) and iDRAC 10 (17G — R670, R770, R870, R970, XE9780, XE9785). Covers the iDRAC 10 / iDRAC 9 ≥ 7.30.10.50 BasicAuthState: Unadvertised default that… |
dev | baml-expert | BAML (Boundary ML) expert for projects defining LLM calls as typed functions in .baml files with a generated Python client. Use whenever the repo contains baml_src/, baml_client/, baml-cli commands, or imports from baml_py / baml_client. Covers… |
dev | jinja-expert | Author, read, and debug Jinja2 templates across the three places Jinja lives in 2026 — HuggingFace chat_template.jinja (rendered by apply_chat_template for vLLM / sglang), Ansible playbooks + .j2 files, and Jinja-adjacent Kubernetes workflows… |
dev | makefile-best-practices | Makefile best practices, patterns, and templates for GNU Make 4.x — dependency graphs, task-runner workflows, parallel-safe recipes, self-documenting help targets, and language-specific patterns (Go, Python, Node, Docker, Helm, POSIX). |
dev | transformers-config-tokenizers-expert | Preflight reference for HuggingFace snapshots — what vLLM, sglang, and transformers.generate see at runtime. Covers config-file precedence (tokenizer.json, tokenizer_config.json, generation_config.json, chat_template.jinja), transformers v5… |
harvester | harvester-upgrade | Plan and run a controlled, COMMUNITY-edition Harvester HCI upgrade off an EOL line up to latest stable — the no-skip minor ladder (1.5→1.6→1.7→1.8; embedded RKE2/KubeVirt/Longhorn/SLE-Micro ride along), gated at each hop on first upgrading the… |
inference-apis | chat-completions-api | Reference for the OpenAI Chat Completions API (/v1/chat/completions) and legacy /v1/completions as the lingua-franca compatibility protocol — the official spec incl. deprecation timeline and Responses-only feature delta, how 7 local servers (vLLM,… |
inference-apis | responses-api | Reference for the OpenAI Responses API (/v1/responses), OpenResponses open standard, and Codex CLI. Covers the request/response schema, previous_response_id, Conversations API, server-side compaction, WebSocket transport, hosted Shell tool, Skills,… |
inference-apis | messages-api | Reference for the Anthropic Messages API (/v1/messages) as a third-party compatibility protocol — the 7 inference servers that implement it natively (vLLM, SGLang, llama.cpp, Ollama, mistral.rs, Llama Stack/OGX, Lemonade), gateways that adapt it… |
inference-cache | lmcache-mp | LMCache multiprocess (MP) mode — standalone LMCache server in its own pod/process that vLLM connects to over ZMQ. Gives process isolation, no GIL contention on the inference path, one cache shared by multiple vLLM pods per node, and CPU-memory… |
inference-cache | nvidia-nixl | NVIDIA Inference Xfer Library (NIXL) operator + developer reference. Point-to-point KV-cache and tensor transport for distributed inference (Dynamo, vLLM, SGLang). Covers the agent API (full Python reference; C++/Rust via upstream pointers), all 15… |
inference-host | nvidia-datacenter-bringup | Bring up NVIDIA HGX/DGX datacenter GPU hosts on Ubuntu 24.04 LTS — air-gapped or connected, Secure Boot enabled. Covers B300/B200/H100/A100/L40S/L4 driver+fabricmanager+NVLSM+DOCA-OFED install order and exact package set from NVIDIA CUDA repo + DOCA… |
inference-host | gpu-host-tuning | Audit AND tune Linux/GPU inference hosts — read-only host snapshot |
jira | jira-cli | Drive Atlassian Jira from the terminal with the jira CLI (jira-cli, v1.7.0) against ANY Jira — Cloud or on-premise/Data Center. Covers the full command surface (issue / epic / sprint / board / project / release), the non-interactive automation… |
k8s | argo-cd-apps | Author and maintain Argo CD Application and ApplicationSet manifests as a GitOps consumer (publisher), targeting Argo CD v3.4 / v3.5 (Sept 2026). Covers source types (Helm, Kustomize, OCI, multi-source, plugin), sync policies + options + waves +… |
k8s | helm | This skill should be used for Helm chart work in either direction. Authoring: creating charts, templates and _helpers.tpl, values.yaml patterns, Chart.yaml, values.schema.json, helm-docs, library charts, chart CI/CD and signing. Consuming: carrying… |
k8s | k8s-components-checker | Survey an RKE2 community cluster against an embedded compatibility registry of 20 stack components and produce a verdict for upgrade-readiness, drift-review, and version-skew questions. Components: RKE2, Rancher, Harvester, Cilium, Tetragon,… |
k8s | keda | Configure, operate, and master KEDA (Kubernetes Event-driven Autoscaling) — ScaledObject, ScaledJob, TriggerAuthentication CRDs, 79 scalers, HPA behavior tuning, scale-to-zero, the KEDA HTTP Add-on, production hardening, multi-trigger semantics,… |
k8s | keycloak-iam | Operate, configure, deploy, secure, and integrate with Keycloak (open-source IAM) — the modern Quarkus distribution (24.x–26.8.x), the Keycloak Operator with Keycloak and KeycloakRealmImport CRDs, realm/client/identity-provider configuration,… |
k8s | openshift-app | Package applications for OpenShift deployment: container images (UBI, arbitrary UID, multi-stage builds), packaging formats (Helm, Kustomize, Operators, OLM v1), CI/CD (Tekton, ArgoCD, Shipwright, Conforma), security (SCC, PSA, supply chain, image… |
k8s | postgres-operator-cloudnative-pg-migration | Migrate PostgreSQL clusters from the Zalando postgres-operator (acid.zalan.do postgresql CRs, Spilo/Patroni, WAL-G) to CloudNativePG (CNPG) on Kubernetes, incl. fully air-gapped clusters. Core knowledge: the two walls (Spilo↔CNPG glibc/collation… |
k8s | rancher-upgrade | Plan and sequence COMMUNITY-edition Rancher upgrades across air-gapped multi-cluster fleets — a management/"hosting" Rancher cluster plus the downstream RKE2/K3s clusters it provisions. Covers the community release model (2.11→2.15,… |
k8s | traefik-hardening | Harden a Traefik 2.x/3.x reverse proxy against abusive or unwanted traffic — per-identity rate + concurrency limiting, IP allowlisting, request-body buffering, middleware chaining, keying limits on a JWT claim/header instead of raw source IP,… |
litellm | litellm-valkey | Run LiteLLM proxy multi-pod with Redis/Valkey (standalone, Sentinel, or Cluster) so rate limits, budgets, and router state are actually shared across pods. Centerpiece: LiteLLM's dominant failure mode is SILENT fallback from Redis to per-pod… |
litellm | litellm-api | Administer a LiteLLM proxy via its management REST API (keys, teams, users, orgs, models, budgets, spend) — a 447-path control plane where ~63% of paths are undocumented, 91 are hidden from /openapi.json, and the OpenAPI schema documents wrong field… |
observability | prometheus-mimir-grafana | Query Prometheus and Grafana Mimir, write and debug PromQL, and build or fix Grafana dashboards — for agents solving problems from metrics. Covers the Prometheus HTTP API (/api/v1/query, query_range, series, labels, metadata), Mimir… |
observability | mimir-upgrade | Plan and run a controlled, COMMUNITY-edition Grafana Mimir upgrade on the mimir-distributed Helm chart, air-gap first — the chart↔app co-pinned ladder (5.7→5.8→6.0.6→6.1.0 = app 2.16→2.17→3.0.4→3.1.2), the classic-vs-ingest-storage decision (the… |
observability | snmp-exporter | Best practices for Prometheus snmp_exporter (v0.30.x): writing generator.yml modules, curating MIB walks, SNMPv2c/v3 auth, timeout tuning, Kubernetes deployment (Probe/ScrapeConfig CRDs, secrets, UDP egress), local docker testing, and debugging… |
observability | logging-operator | Configure and operate the kube-logging logging-operator (formerly Banzai Cloud) on Kubernetes — the CRD-driven log pipeline: Fluent Bit collector → fluentd or syslog-ng aggregator → outputs. Covers the 16-CRD model (Logging, Flow/ClusterFlow,… |
observability | rancher-logging-exit | Migrate off the Rancher-bundled rancher-logging chart (cattle-logging-system, rancher/mirrored-kube-logging-* images) to the upstream kube-logging logging-operator ≥6.7.0 — air-gap-first. Rancher 2.11 through 2.15-dev all bundle a frozen operator… |
open-webui | open-webui-api | Administer Open WebUI entirely via its REST API (v0.11.x): user/group lifecycle, permissions, model catalog GitOps (export/import/sync), knowledge/RAG pipelines, config-as-code, SCIM provisioning, event webhooks, and backup surfaces. Grounded in the… |
open-webui | open-webui-embeddings | Choose and wire open-weights embedding + reranker models into Open WebUI's RAG pipeline, across TEI, vLLM, OpenRouter or LiteLLM. Covers model selection on current MTEB data (quality, zero-shot contamination, and a FLOPs-based throughput model,… |
open-webui | open-webui-valkey-websocket | Deploy Open WebUI multi-pod with WebSockets and Valkey/Redis Sentinel at 1000+ user scale on Kubernetes. Centerpiece is the structural Socket.IO+Redis frame-amplification bug (#23733) that crippled multi-pod streaming before v0.11.1, and the… |
sglang | sglang-hicache | SGLang HiCache (hierarchical KV cache) — three-tier prefix cache: GPU HBM (L1) → pinned host DRAM (L2) → distributed L3 (Mooncake / 3FS / NIXL / AIBrix / EIC / SiMM / file / LMCache). Covers --enable-hierarchical-cache, all --hicache-* flags,… |
sglang | sglang-model-gateway | SGLang Model Gateway (sgl-model-gateway, formerly sgl-router) — Rust router fronting vLLM and SGLang inference workers on Kubernetes. Covers first-class vLLM gRPC backend plus HTTP transparent-proxy for vanilla vLLM, the policy set (six… |
ubuntu | ubuntu-autoinstall | Author, validate, and debug Ubuntu Server autoinstall configuration (the Subiquity installer's autoinstall: schema, version 1) for Ubuntu Server LTS 24.04 and 26.04, focused on unattended on-premise and air-gapped installs — identity, storage… |
ubuntu | ubuntu-cloud-init | Author, validate, and debug cloud-init configuration for Ubuntu Server LTS 24.04 and 26.04, focused on on-premise and air-gapped hosts via the NoCloud datasource — #cloud-config user-data, the cloud-config modules (users, ssh, write_files, runcmd,… |
ubuntu | ubuntu-netplan | Author, validate, and debug netplan network configuration (/etc/netplan/*.yaml) for Ubuntu Server LTS 24.04 and 26.04, focused on on-premise and air-gapped hosts — static addressing, bonds, bridges, VLANs, VRFs, routing/policy-routing, DNS,… |
vllm | vllm-benchmarking | Run production vLLM benchmarks — vllm bench (serve, throughput, latency, sweep, startup, mm-processor), request-rate vs max-concurrency semantics, TTFT/TPOT/ITL/E2EL percentiles, goodput SLO measurement, prefix-cache workloads, air-gapped… |
vllm | vllm-caching | vLLM tiered KV cache configuration for production H100/H200 clusters. Native CPU offload, LMCache (CPU+NVMe+GDS), NixlConnector (disaggregated prefill), MooncakeConnector (RDMA), MultiConnector composition. Version gates, sizing math (flag total… |
vllm | vllm-chat-templates | vLLM chat-template (prompt-side Jinja) operator reference. Template resolution precedence (--chat-template → AutoProcessor → tokenizer default → bundled fallback), chat_template_kwargs allowlist silently dropping… |
vllm | vllm-configuration | Configure vLLM completely — YAML config file format, CLI arg precedence, full VLLM_/HF_/TRANSFORMERS_* env-var catalog, end-to-end recipe for air-gapped environments (internal HF mirrors, hf-mirror.com, ModelScope, HF_HUB_OFFLINE with pre-seeded… |
vllm | vllm-deployment | Use this skill when authoring, reviewing, or fixing a vLLM Kubernetes manifest, Docker/Podman pod, or OpenShift ServingRuntime — even when the user does not say "vllm". Triggers on: lab cluster performance practices, cache mount + survival across… |
vllm | vllm-gemma-4-31b | Operating-point reference for serving Gemma 4 31B on vLLM — TP sizing, max_model_len, max_num_seqs, gpu_memory_utilization, kv_cache_dtype, EAGLE3 spec-dec, chat_template choice. |
vllm | vllm-input-modalities | vLLM non-chat inference surfaces — text embeddings (/v1/embeddings, /v2/embed), reranking/scoring (/rerank, /score), speech-to-text (/v1/audio/transcriptions, /v1/audio/translations), document OCR via VLMs. Covers 2026 --runner pooling… |
vllm | vllm-nvidia-hardware | NVIDIA AI-hardware + vLLM-platform reference covering Hopper (H100/H200), Blackwell (B100/B200/B300) and Blackwell Ultra, Grace-Blackwell superchips and NVL72 racks (GB200, GB300), Vera Rubin (R100/R300) with VR200 NVL144 and Kyber NVL576, Dell… |
vllm | vllm-observability | Observe production vLLM — /metrics Prometheus surface (V1 engine), SLO-driven alerting on TTFT/ITL/queue/KV/preemption/aborts/corrupted-logits, shipping Grafana dashboards in examples/observability/, OTLP tracing with --otlp-traces-endpoint… |
vllm | vllm-omni | vLLM-Omni output-side multimodal generation — image (FLUX.1/2, Qwen-Image, GLM-Image, BAGEL, SD3.5, HunyuanImage-3.0), video (Wan2.1/2.2, LTX-2, HunyuanVideo-1.5), TTS (Qwen3-TTS, CosyVoice3, Voxtral-TTS), any-to-any omni (Qwen3-Omni, Qwen2.5-Omni,… |
vllm | vllm-performance-tuning | vLLM performance-tuning operator reference — tuning workflow (baseline → bottleneck → knob → re-bench), fused-MoE kernel autotune (benchmark_moe.py generates E=N,N=M,device_name=X.json configs), DeepEP all-to-all + expert parallelism + EPLB,… |
vllm | vllm-quantization | vLLM datacenter-GPU quantization — picking, configuring, troubleshooting NVFP4, FP8, MXFP4, MXFP8, AWQ, GPTQ, INT8, compressed-tensors, modelopt, quark on H100/H200/B200/B300/GB200/GB300. 30 --quantization flag values on current vLLM (31 through… |
vllm | vllm-reasoning-parsers | vLLM reasoning-parser operator + developer reference. --reasoning-parser CLI wiring, ReasoningParser contract (non-streaming extract_reasoning + per-delta extract_reasoning_streaming), is_reasoning_end xgrammar gating,… |
vllm | vllm-speculative-decoding | Pick, configure, tune, monitor vLLM speculative decoding in production. Thirteen SpeculativeMethod options (ngram, ngram_gpu, medusa, mlp_speculator, draft_model, suffix, custom_class, eagle, eagle3, dflash, dspark, mtp, extract_hidden_states),… |
vllm | vllm-tool-parsers | vLLM tool-calling operator reference — picking --tool-call-parser per model family, writing custom parsers via --tool-parser-plugin, navigating vLLM source + GitHub tracker to debug any specific tool-call question. Pointer map, not source… |
aiperf | aiperf | NVIDIA AIPerf — vendor-neutral generative-AI inference benchmarking (genai-perf successor). Covers aiperf profile with concurrency / request-rate / fixed-schedule trace replay / user-centric / multi-run confidence, 18 endpoint types (chat,… |
airgap-vetting | airgap-vetting | Vet an open-source product for air-gap readiness BEFORE adoption. Answers eight questions — telemetry, does-opt-out-actually-work, proxy-in-disguise over a hosted API, runtime downloads, custom-CA support, feature-level content egress / offline… |
analytical-troubleshooting | analytical-troubleshooting | Structured live troubleshooting for deviation problems: something worked (or should work) and now doesn't, and the cause is unknown. Staged method — quick likelihood-weighted tests first, escalating to a comparative IS/IS-NOT specification with… |
claude-code-ci-harness | claude-code-ci-harness | Run Claude Code headlessly as an isolated CI harness against any Anthropic Messages-compatible endpoint (local engine, gateway or hosted API) or a Claude subscription token. Covers credential isolation, stream-json transcripts, tool-call assertions,… |
confluence-best-practices | confluence-best-practices | Advise on USING Confluence well, not operating it: make the structural call — is this a space, a page, or a child page? — diagnose why a wiki is a dread (can't find anything, content rots, duplicates, hidden by permissions, unreadable), and… |
gitlab-best-practices | gitlab-best-practices | Operate self-managed GitLab on the official Helm chart — multi-hop upgrade campaigns across required stops, the chart-10 wall (bundled PostgreSQL, Redis and MinIO removed and now mandatory), PostgreSQL 17 being both the minimum and the maximum for… |
jira-best-practices | jira-best-practices | Advise on USING Jira well, not operating it: make the structural call — is this an epic, a story, a task, or a sub-task? — and diagnose why a Jira is a dread, then recommend the lean fix. Adapt to the organisation's OWN hierarchy names, conventions,… |
jira-confluence-mcp | jira-confluence-mcp | Install, configure, secure, and troubleshoot the mcp-atlassian MCP server (sooperset/mcp-atlassian) that connects an agent to Jira/Confluence — including AIR-GAPPED setup (mirror the prebuilt image by digest; no PyPI/git mirror) and internal-CA /… |
netbox-best-practices | netbox-best-practices | NetBox 4.2-4.6 deployment and upgrade knowledge the official netboxlabs/skills marketplace does not cover — deploying or upgrading NetBox on Kubernetes with the netbox-community helm chart (netbox-chart), external PostgreSQL/valkey wiring, API token… |
opencode-ci-harness | opencode-ci-harness | Run opencode (v2) CLI as a headless, fully-isolated test harness against any OpenAI-, Responses- or Messages-compatible endpoint (local inference engine or remote API), or against any provider credential already stored in an opencode profile (API… |
postgres-operator-best-practices | postgres-operator-best-practices | Run, configure, upgrade and troubleshoot the Zalando postgres-operator (acid.zalan.do postgresql CRs, Spilo, Patroni, WAL-G) on Kubernetes. Core knowledge: the v1.x -> v2.x major upgrade and its three changed defaults that bite silently… |
secure-boot-cert-rotation | secure-boot-cert-rotation | Triage and fix the Microsoft Secure Boot 2011→2023 UEFI certificate rotation across Dell PowerEdge / iDRAC9 bare metal, Ubuntu/Linux servers, and Harvester HCI / KubeVirt guest VMs. Two 2011 CAs expired June 2026 and Windows Production PCA 2011… |
MIT licensed.