skill-coverage.md

Skill coverage across the portfolio

This record maps the skills this marketplace bundles to the work the Devantler Tech portfolio actually does. For each gap it gives one decision: covered, owned by an existing issue, adopt an upstream skill, or do not add. It answers #637. Whether agents load the skills they have is measured separately: the activation baseline is in #642, and the eval suite is #651.

This is an engineering inventory. It makes no legal or compliance claim.

Method

• Skills: 39 skills at 73c39b3: 35 in agentic-engineering, 1 in ksail and 3 in vibe-coding. The monorepo also carries 4 deployment overlays and 17 product cards under .claude/skills/. Three of the overlays extend the bundled portfolio-maintenance, product-engineering and self-improvement skills for that deployment. The fourth, finops, is a deployment-only procedure for the engineer's spend mandate. None of the overlays is bundled here.
• Portfolio use: code search scoped to devantler-tech and the product manifests, read on 2026-11-04. Product evidence links are pinned to that day's default-branch commit.
• Candidates: official vendor or project repositories first. Licence, maintainer and last push were read from the GitHub API on 2026-11-04. Skill directories that mirror other repositories were not used as sources.
• Importance: High means production or personal data, customer-facing legal exposure, or a security boundary. Medium means recurring work on a production system. Low means no product does this work today.

Coverage matrix

Area	Portfolio use	Bundled resources	Gap	Importance	Decision
Privacy and GDPR	contact handling, customer identity and invoices in the business-site portal; guest RSVPs in wedding-app	privacy-engineering (purpose, legal basis, retention, rights, providers, transfers, impact assessments, breach reporting, with Danish additions)	what the skill's source list says it does not claim: disputed interpretation and sector rules (health, finance, telecoms). Each product still names its own data, its accountable person and where its record of processing is kept	High	Covered since 7.6.0 by the first-party privacy-engineering (#638): no upstream candidate could be adopted, as the candidate table says
Danish commerce, consumer and accessibility rules	client sites with service offerings and booking (ascoachingogvaner); business-site invoicing	danish-business-rules (which rules apply and to whom: cookies, marketing, purchase information, withdrawal, subscriptions, invoices, accessibility); web-design-guidelines for accessible UI	everything its source list lists as not covered, among them the E-commerce Act, price labelling in detail, invoices to private customers, environmental claims, sales law, payment rules, sector rules and sales to other countries	High	Covered since 7.6.0 by the first-party danish-business-rules (#639): no upstream skill for Danish rules exists
Application security and tenant isolation	the business-site customer portal, KHoist's data product API, tenant apps on the shared platform	application-security (threat model, access rules, tenant isolation, webhooks, uploads, limits and the tests that prove them). CI and supply chain: github-actions-hardening, codeql, secret-scanning, dependency-scanning, dependabot. Cluster tenants: gitops-tenant-onboarding	none in guidance. Each product still writes its own isolation tests, and its own instructions name its roles and tenants	High	Covered since 7.5.0 by the first-party application-security (#640): no upstream candidate could be adopted, as the candidate table says
SvelteKit and TypeScript	business-site web/, wedding-app, ascoachingogvaner	svelte-core-bestpractices and the svelte documentation server (documentation, autofixer and playground links), beside the framework-neutral frontend-design and web-design-guidelines	none for Svelte. TypeScript itself is not treated as a gap; if that needs checking, add a TypeScript case to #651	Medium	Covered since 7.0.0 (#652)
Astro	the KSail docs and the KHoist website	product-documentation, write-docs-introduction	Astro framework guidance: the astro skill left the bundle in 7.0.0	Medium	Not bundled. The 7.0.0 entry in the plugin's changelog has the one command that installs astro from its upstream for work on these two sites
Go	ksail, khoist, the business-site server, platform helpers	golang-pro, test-driven-development, refactor	activation only: 0 loads in a week with at least 34 Go sessions (#642)	Medium	Covered; measured by #651
API and form validation	request handling in the SvelteKit sites (for example the wedding-app RSVP endpoint) and the Go portal	web-design-guidelines covers form markup	none for validation, limits and uploads (application-security); personal data in forms belongs to privacy	Medium	Do not add a separate skill: application-security covers validation, limits and uploads, and #638 owns personal data
PostgreSQL schema and migrations	the business-site portal schema, wedding-app on Drizzle migrations, KHoist's CloudNativePG provider	none	schema design, query plans, lock-safe migrations	High	Open. The one vendor-maintained candidate was evaluated and not adopted (#653); the candidate table says why. Each repository's own migration and tenant-isolation rules stay the authority
PostgreSQL backup and restore	the platform's CloudNativePG and Velero procedures	none	none for a skill: the procedure is specific to one repository	High	Do not add: stays in the platform's docs and verifiers
ClickHouse	only as Coroot's log and trace storage, which the platform runs but no product queries	none	none today	Low	Do not add. Revisit when a product writes ClickHouse schemas or queries
Prometheus and OpenTelemetry	Coroot with its bundled Prometheus, which Flagger and KEDA query in PromQL; Alertmanager; an OpenTelemetry log forwarder	promql (writing and checking PromQL) and prometheus (alert and recording rules, Alertmanager routing); gitops-cluster-debug reads metrics only through the Flux MCP server	OpenTelemetry collector pipelines: the only vendor-maintained candidate defaults to a hosted service the platform does not use. Look collector configuration up through the context7 documentation server	Medium	Covered for PromQL and alert rules since 7.3.0 (#654); collector pipelines not added
SLOs	the platform alerts on Coroot's built-in per-application SLOs; no repository sets its own SLO targets or error-budget policy	none	SLO targets and error-budget policy, which nobody authors today	Low	Do not add. Tuning Coroot's SLO alerts goes with #654. Revisit when a product sets its own SLO targets
FinOps	the engineer's spend mandate (stewardship disabled by contract)	the agentic-engineer agent and the github-actions-efficiency skill; the monorepo finops overlay is outside this repository	none	Medium	Covered
Payments, subscriptions and webhooks	no product takes payments: the code search org:devantler-tech stripe on 2026-11-04 returned 7 matches, all dependency metadata, a bookmark, game assets or a skill reference	none	none today	Low	Do not add. Webhook verification is in application-security; subscription disclosures belong to #639. Revisit when a product commits to payments
GitOps, Kubernetes and deployment	the platform, ksail and the templates	skills gitops-knowledge, gitops-cluster-debug, gitops-tenant-onboarding, ksail and siderolabs; the bundled Flux MCP server	activation only: 0 loads with at least 11 manifest sessions (#642)	High	Covered; measured by #651

Owned means the audit hands the gap to an existing issue instead of filing an overlapping one. The candidate comparison and the adopt-or-build decision for those three gaps happen there: each issue's acceptance criteria require a candidate assessment before anything is built.

The matrix maps the 19 domain skills it names. The other 20 bundled skills are about how engineering work is run, not about a stack, so they have no domain row:

• run procedures and roles: portfolio-maintenance, product-engineering, self-improvement, agent-improvement;
• repository workflow: ways-of-working, git-commit, conventional-release, github-issues, gh-cli, gh-stack, github-actions-docs;
• writing: agent-instructions, write-readme, write-contributing;
• thinking aids: grilling, prototype, find-skills;
• conversational building (vibe-coding): needs-stack-mapping, allowed-stack-guardrail, jargon-free-voice.

Whether these load when they should is part of #642's baseline and #651's suite. The adoption process itself belongs to #641.

Activation conditions for the adopted skills are their trigger cases. Each follow-up issue lists them: should-trigger, near-miss and over-trigger cases that #651's suite runs.

Candidate comparison

Gap	Candidate	Licence and owner	Last push	Fit and risk	Decision
SvelteKit	svelte-core-bestpractices, svelte-code-writer	MIT, the Svelte team	2026-11-04	Official. The code writer runs npx @sveltejs/mcp without a pinned version	svelte-core-bestpractices adopted in 7.0.0. svelte-code-writer rejected: it downloads and runs an unpinned package on every call, and the bundled svelte server already offers the same documentation and autofixer tools (#652)
PostgreSQL	supabase-postgres-best-practices	MIT, Supabase	2026-11-07	Text only and actively maintained, for "Postgres running anywhere". A review of its v0.1.9 examples found defects where they matter most here: row-level security keyed on a session setting that any querying role can change and that carries over between pooled connections, a helper function whose execute right is revoked from the role that needs it, constraint checks that match by name on any table, and a migration example that takes a blocking lock	Not adopted at v0.1.9 (#653). Re-evaluate when the upstream corrects these or a better candidate appears
PostgreSQL	infra-postgres	Apache-2.0, ClickHouse	2026-11-02	Provisions Postgres through the clickhousectl CLI; no schema, query or migration guidance	Do not add
Observability	promql, prometheus, opentelemetry, alerting-irm	Apache-2.0, Grafana Labs	2026-11-09	Official. promql and prometheus are general Prometheus guidance. opentelemetry sends telemetry to Grafana Cloud by default and builds on Grafana Alloy. alerting-irm configures Grafana's own alerting product, which the platform does not run	promql and prometheus adopted in 7.3.0. Two examples in the promql pattern library are known to be wrong: the "stale exporter" test matches every healthy target, and the Alloy label-drop snippet is not valid configuration. Both fail loudly and are reported for an upstream fix in #676. opentelemetry and alerting-irm rejected (#654)
Observability	community skills such as opentelemetry and observability-sre	MIT, individual maintainers	2026-05-22, 2026-11-04	General-purpose. The vendor-maintained Grafana skills cover the same scope	Rejected
ClickHouse	clickhouse-best-practices	Apache-2.0, ClickHouse	2026-11-02	Strong, but no product authors ClickHouse work	Do not add yet
Payments	stripe-best-practices	MIT, Stripe	2026-11-04	Official, but no product takes payments and no provider is chosen	Do not add yet
Application security	security-review, security-model	Apache-2.0 repository, Sentry; the references of security-review are CC BY-SA 4.0	2026-11-05	security-review reviews finished code by vulnerability class and is well made, but its references derive from OWASP material under share-alike terms, and it has no threat model, tenant design or webhook guidance. security-model writes a policy file for scanners and needs Python helpers	Rejected for now: the licence review is #581's. Revisit security-review for the review-time half when #581 clears share-alike redistribution
Application security	security-review, threat-model-analyst	MIT, github/awesome-copilot	2026-11-10	The first is a scanner procedure that repeats the secret and dependency checks this plugin already has. The second is threat modelling only, as a multi-agent report generator of 17 files and 335 KB	Rejected
Application security	owasp-security	MIT, one maintainer	2026-11-03	Closest in content, with evaluation cases upstream. Its frontmatter uses a field the open skill format does not define, so the copy fails validation here unmodified, and its largest reference restates OWASP material under an MIT label	Rejected
Application security	VibeSec-Skill	Apache-2.0, one maintainer	2026-02-17	One long secure-coding file. Its name is not a valid skill name, so it fails validation unmodified	Rejected
Application security	the Trail of Bits collection	CC BY-SA 4.0, Trail of Bits	2026-11-06	Audit workflows for security researchers, not design guidance. Share-alike terms	Rejected for now: the licence review is #581's
Privacy	gdpr-compliant	MIT, github/awesome-copilot	2026-03-30	Engineering-focused and the closest fit, but it states coding preferences as legal duties, and two of the three reference files it links do not resolve	Rejected
Privacy	compliance-check	Apache-2.0, Anthropic	2026-11-09	Written for an in-house legal team checking a business initiative across many jurisdictions; would not load for engineering work	Rejected
Privacy	a collection of 824 privacy skills, secpriv-skill	Apache-2.0 and MIT	2026-03-16, 2026-10-06	The first is too large to review for correctness. The second has no frontmatter, so it is not in the open skill format	Rejected
Danish rules	none found	—	—	Four repository searches on 2026-11-11 returned no skill for Danish or EU consumer, marketing or cookie rules	Built
Any gap	author a first-party skill	this repository	—	A maintained official candidate exists for every gap adopted so far. Application security, privacy and the Danish rules are the gaps where none could be adopted, so application-security, privacy-engineering and danish-business-rules were built after the comparisons above	Built only where the comparison rejects every candidate (the adoption-first workflow of #637)

The Sentry and trailofbits/skills candidates above carry CC BY-SA 4.0 terms. Share-alike redistribution needs the review that #581 owns before anything under those terms is bundled.

Reusable skills and repository-specific instructions

• A skill here holds guidance that is true for any repository using the tool: Svelte, Postgres, PromQL, a GDPR engineering checklist. A skill never names a portfolio product.
• A product's AGENTS.md, or its monorepo product card, holds the facts about that one product: which data is personal, which customers are consumers, how its database is backed up and restored, its tenant values. A product card never restates a skill.
• A monorepo deployment overlay (portfolio-maintenance, product-engineering, self-improvement, finops) binds a reviewed plugin role to this deployment.

One drift found (monorepo#4845): the business-site product card still describes an Astro application, but the site now builds with SvelteKit and a Go server. An agent that trusts the card would choose astro.

Prioritized gaps

1. Prerequisites for every adoption: the adopt-or-build rubric and pinning lifecycle are delivered in 7.4.0 as the skill-lifecycle skill and skill-lifecycle.md (#641); still open are updater pull requests that say what changed upstream (#583, under #581), the activation suite (#651), and stale user-level copies that shadow plugin skills (monorepo#4840). Each adoption also adds description text, and #642 found 30 of 94 listed skills shown by name only. So every adoption PR reports how many description characters it adds.
2. Application security and tenant isolation (#640). Covered in 7.5.0 by the first-party application-security skill. What remains is per product: the isolation tests themselves.
3. Privacy and GDPR (#638). Covered in 7.6.0 by the first-party privacy-engineering skill.
4. PostgreSQL schema and migrations (#653). Evaluated: the candidate was not adopted, so the gap stays open.
5. Danish commerce, consumer and accessibility rules (#639). Covered in 7.6.0 by the first-party danish-business-rules skill, within the limits its source list states.
6. Prometheus and OpenTelemetry (#654). PromQL and alert rules adopted in 7.3.0; collector pipelines not added, as the matrix says.

Done: SvelteKit (#652), covered since 7.0.0.

Not now: ClickHouse, payments, SLOs and a separate validation skill. Each row above says what would change that.

Keeping this current

Update this file in place, never by adding another. Revisit it when a product adopts a new stack, when an adoption issue above closes, or after #651's first two baselines.