Infrastructure Protection Skill

Apply safety rules for infrastructure and system operations.

Why This Matters

Infrastructure operations are enforced by hooks - destructive operations will be blocked. This skill ensures you understand the rules so your operations aren't rejected.

Protection Levels

Read Operations (Always Allowed)

# Information gathering - safe
govc vm.info
kubectl get pods
docker ps
virsh list
terraform plan
ansible --check

Write Operations (Require Caution)

# State-changing operations - proceed carefully
govc vm.power -on
kubectl apply
docker run
virsh start
terraform apply

Destructive Operations (Blocked by Default)

# Dangerous operations - blocked unless explicit
govc vm.destroy
kubectl delete
docker rm -f
virsh undefine
terraform destroy

Protected Platforms

Virtualization

• •VMware (govc, esxcli)
• •Hyper-V (PowerShell VM cmdlets)
• •KVM/libvirt (virsh)
• •VirtualBox (vboxmanage)
• •Proxmox (qm, pct)

Containers

• •Docker (docker, docker-compose)
• •Kubernetes (kubectl, helm)
• •Multipass

Cloud

• •AWS (aws cli)
• •Azure (az cli)
• •GCP (gcloud)

Configuration Management

• •Terraform
• •Ansible
• •Packer
• •Vagrant

Blocked Operations List

# VM/Container destruction
govc vm.destroy
virsh destroy
virsh undefine
docker rm -f
kubectl delete pod --force

# Disk operations
dd if=/dev/zero of=/dev/sda
mkfs
fdisk /dev/sda

# System cleanup
rm -rf /

Safe Operation Patterns

Before Destructive Operations

1. •Confirm intent: User explicitly requested destruction
2. •Verify target: Double-check resource name/ID
3. •Check dependencies: What depends on this resource?
4. •Backup if needed: Take snapshot/backup first

Prefer IaC Over Imperative

# Preferred: Declarative/IaC
terraform apply
ansible-playbook deploy.yml
kubectl apply -f manifest.yaml

# Avoid: Imperative one-offs
govc vm.create ...
kubectl run ...
docker run ... (for persistent services)

Hook Enforcement

The agent-infrastructure-protection.js hook will:

1. •Block destructive operations without explicit request
2. •Allow read operations freely
3. •Warn on write operations
4. •Require explicit confirmation for dangerous actions

Emergency Override

In genuine emergencies, users can:

1. •Set emergency_override_enabled: true in config
2. •Provide emergency override token
3. •Document reason for emergency action

Note: Emergency override is disabled by default.

Integration with Hooks

This skill provides guidance - you understand the rules. The hook provides enforcement - violations are blocked.

Together they prevent:

• •Accidental VM/container destruction
• •Unintended infrastructure changes
• •Production outages from careless commands