[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DRX47J5GNGCDR4RSSV0NT2":3,"skill-same:01M6DRX47J5GNGCDR4RSSV0NT2":185},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":6,"ownerHtmlUrl":43,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":44,"install":45,"resources":58},"01M6DRX47J5GNGCDR4RSSV0NT2","helm-validator",null,"Validate, lint, audit, check Helm charts — Chart.yaml, templates, values.yaml, CRDs, schemas.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32],"helm","helm validator","validate","lint","audit","yaml","templates","Charts","check","chart","2026-11-10 10:12:30",false,"---\nname: helm-validator\ndescription: Validate, lint, audit, check Helm charts — Chart.yaml, templates, values.yaml, CRDs, schemas.\n---\n\n# Helm Chart Validator & Analysis Toolkit\n\n## Overview\n\nThis skill provides a comprehensive validation and analysis workflow for Helm charts, combining Helm-native linting, template rendering, YAML validation, schema validation, CRD documentation lookup, and security best practices checking.\n\n**IMPORTANT: This validator is read-only by default.** It analyzes charts and proposes improvements. Only modify files when the user explicitly asks to apply fixes.\n\n## Trigger Cases\n\nUse this skill when one or more of these top cases apply:\n- The user asks to validate, lint, check, test, or troubleshoot a Helm chart\n- Helm templates fail to render, lint, or produce valid Kubernetes YAML\n- A pre-deployment quality gate is needed (schema, dry-run, security checks)\n- CRD resources are present and their spec fields must be verified against docs\n- The user wants a severity-based validation report with proposed remediations\n\nTrigger phrase examples:\n- \"Validate this Helm chart before release\"\n- \"Why does `helm template` fail?\"\n- \"Check this chart for Kubernetes and security issues\"\n\nOut of scope by default:\n- New chart scaffolding or broad chart generation (use `helm-generator`)\n\n## Role Boundaries\n\n- This skill validates and reports; it does not silently rewrite user files.\n- It can propose concrete patches and apply them only when the user explicitly requests fixes.\n- If execution constraints block a stage, it must continue with reachable stages and document the skip reason.\n\n## Execution Model\n\n1. Run stages in order (1 through 10).\n2. Keep going after stage-level failures to collect complete findings, unless rendering fails and no manifests exist.\n3. If Stage 4 produces no manifests, mark Stages 5 to 9 as blocked and continue to Stage 10 reporting.\n4. Treat Stage 8 as environment-dependent optional; treat Stage 9 and Stage 10 as mandatory when manifests exist.\n5. For every skipped stage, record the exact tool\u002Fenvironment reason in the final summary table.\n\n## Quick Execution Modes\n\n### Mode A: Local Validation (no cluster required)\n```bash\nbash scripts\u002Fsetup_tools.sh\nbash scripts\u002Fvalidate_chart_structure.sh \u003Cchart-directory>\nhelm lint \u003Cchart-directory> --strict\nhelm template \u003Crelease-name> \u003Cchart-directory> --values \u003Cvalues-file> --debug --output-dir .\u002Frendered\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) -exec yamllint -c assets\u002F.yamllint {} +\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) -exec kubeconform -summary -verbose {} +\n```\n\n### Mode B: Full Validation (cluster available)\nRun Mode A plus Stage 8 dry-run commands in this document.\n\n## Validation & Testing Workflow\n\nFollow this sequential validation workflow. Each stage catches different types of issues:\n\n### Stage 1: Tool Check\n\nBefore starting validation, verify required tools are installed:\n\n```bash\nbash scripts\u002Fsetup_tools.sh\n```\n\nRequired tools:\n- **helm**: Helm package manager for Kubernetes (v3+)\n- **yamllint**: YAML syntax and style linting\n- **kubeconform**: Kubernetes schema validation with CRD support\n- **kubectl**: Cluster dry-run testing (optional but recommended)\n\nFallback policy for unavailable tools or environment constraints:\n\n| Condition | Action | Stage status |\n|-----------|--------|--------------|\n| `helm` missing | Run Stage 2 only, then report Stages 3 to 9 as skipped\u002Fblocked | ⚠️ Warning |\n| `yamllint` missing | Use `yq` syntax checks if available; otherwise skip Stage 5 | ⚠️ Warning |\n| `kubeconform` missing | Skip Stage 7 and rely on Stage 6 CRD\u002Fmanual checks | ⚠️ Warning |\n| `kubectl` missing or no kube-context | Skip Stage 8, continue with remaining stages | ⚠️ Warning |\n| No internet access for CRD docs | Use local CRD manifests and kubeconform output, mark doc lookup incomplete | ⚠️ Warning |\n\nIf tools are missing, provide installation instructions from `scripts\u002Fsetup_tools.sh` output and continue with the fallback path above.\n\n### Stage 2: Helm Chart Structure Validation\n\nVerify the chart follows the standard Helm directory structure:\n\n```bash\nbash scripts\u002Fvalidate_chart_structure.sh \u003Cchart-directory>\n```\n\n**Expected structure:**\n```\nmychart\u002F\n  Chart.yaml          # Chart metadata (required)\n  values.yaml         # Default values (required)\n  values.schema.json  # JSON Schema for values validation (optional)\n  templates\u002F          # Template directory (required)\n    _helpers.tpl      # Template helpers (recommended)\n    NOTES.txt         # Post-install notes (recommended)\n    *.yaml            # Kubernetes manifest templates\n  charts\u002F             # Chart dependencies (optional)\n  crds\u002F               # Custom Resource Definitions (optional)\n  .helmignore         # Files to ignore during packaging (optional)\n```\n\n**Common issues caught:**\n- Missing required files (Chart.yaml, values.yaml, templates\u002F)\n- Invalid Chart.yaml syntax or missing required fields\n- Malformed values.schema.json\n- Incorrect file permissions\n\n### Stage 3: Helm Lint\n\nRun Helm's built-in linter to catch chart-specific issues:\n\n```bash\nhelm lint \u003Cchart-directory> --strict\n```\n\n**Optional flags:**\n- `--values \u003Cvalues-file>`: Test with specific values\n- `--set key=value`: Override specific values\n- `--debug`: Show detailed error information\n\n**Common issues caught:**\n- Invalid Chart.yaml metadata\n- Template syntax errors\n- Missing or undefined values\n- Deprecated Kubernetes API versions\n- Chart best practice violations\n\n**Auto-fix approach:**\n- For template errors, identify the problematic template file\n- Show the user the specific line causing issues\n- Propose a patch\u002Fdiff for the fix\n- Apply fixes only if the user explicitly asks\n- Re-run `helm lint` after fixes are applied\n\n### Stage 4: Template Rendering\n\nRender templates locally to verify they produce valid YAML:\n\n```bash\nhelm template \u003Crelease-name> \u003Cchart-directory> \\\n  --values \u003Cvalues-file> \\\n  --debug \\\n  --output-dir .\u002Frendered\n```\n\n**Options to consider:**\n- `--values values.yaml`: Use specific values file\n- `--set key=value`: Override individual values\n- `--show-only templates\u002Fdeployment.yaml`: Render specific template\n- `--validate`: Validate against Kubernetes OpenAPI schema\n- `--include-crds`: Include CRDs in rendered output\n- `--is-upgrade`: Simulate upgrade scenario\n- `--kube-version 1.28.0`: Target specific Kubernetes version\n\n**Common issues caught:**\n- Template syntax errors (Go template issues)\n- Undefined variables or values\n- Type mismatches (string vs. integer)\n- Missing required values\n- Logic errors in conditionals or loops\n- Incorrect indentation in nested templates\n\n**For template errors:**\n- Identify the template file and line number\n- Check if values are properly defined in values.yaml\n- Verify template function usage (quote, required, default, include, etc.)\n- Test with different value combinations\n\n### Stage 5: YAML Syntax Validation\n\nValidate YAML syntax and formatting of rendered templates:\n\n```bash\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec yamllint -c assets\u002F.yamllint {} +\n```\n\n**Common issues caught:**\n- Indentation errors (tabs vs spaces)\n- Trailing whitespace\n- Line length violations\n- Syntax errors\n- Duplicate keys\n- Document start\u002Fend markers\n\n**Auto-fix approach:**\n- For simple issues (indentation, trailing spaces), propose fixes using the Edit tool\n- For template-generated issues, fix the source template, not rendered output\n- Always show the user what will be changed before applying fixes\n\n### Stage 6: CRD Detection and Documentation Lookup\n\nBefore schema validation, detect if the chart contains or renders Custom Resource Definitions:\n\n```bash\n# Check crds\u002F directory\nif [ -d \u003Cchart-directory>\u002Fcrds ]; then\n  find \u003Cchart-directory>\u002Fcrds -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n    -exec bash scripts\u002Fdetect_crd_wrapper.sh {} +\nfi\n\n# Check rendered templates\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec bash scripts\u002Fdetect_crd_wrapper.sh {} +\n```\n\nThe script outputs JSON with resource information:\n```json\n[\n  {\n    \"kind\": \"Certificate\",\n    \"apiVersion\": \"cert-manager.io\u002Fv1\",\n    \"group\": \"cert-manager.io\",\n    \"version\": \"v1\",\n    \"isCRD\": true,\n    \"name\": \"example-cert\"\n  }\n]\n```\n\n**For each detected CRD:**\n\n1. **Try context7 MCP first (preferred):**\n   ```\n   Use mcp__context7__resolve-library-id with the CRD project name\n   Example: \"cert-manager\" for cert-manager.io CRDs\n            \"prometheus-operator\" for monitoring.coreos.com CRDs\n            \"istio\" for networking.istio.io CRDs\n\n   Then use mcp__context7__query-docs with:\n   - libraryId from resolve step\n   - query: The CRD kind and relevant features (e.g., \"Certificate spec required fields\")\n   ```\n\n2. **Fallback to `web.search_query` (web search) if Context7 fails:**\n   ```\n   Search query pattern:\n   \"\u003Ckind>\" \"\u003Cgroup>\" kubernetes CRD \"\u003Cversion>\" documentation spec\n\n   Example:\n   \"Certificate\" \"cert-manager.io\" kubernetes CRD \"v1\" documentation spec\n   \"Prometheus\" \"monitoring.coreos.com\" kubernetes CRD \"v1\" documentation spec\n   ```\n\n3. **Extract key information:**\n   - Required fields in `spec`\n   - Field types and validation rules\n   - Examples from documentation\n   - Version-specific changes or deprecations\n   - Common configuration patterns\n\n**Why this matters:** CRDs have custom schemas not available in standard Kubernetes validation tools. Understanding the CRD's spec requirements prevents validation errors and ensures correct resource configuration.\n\n### Stage 7: Schema Validation\n\nValidate rendered templates against Kubernetes schemas:\n\n```bash\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) -exec \\\n  kubeconform \\\n    -schema-location default \\\n    -schema-location 'https:\u002F\u002Fraw.githubusercontent.com\u002Fdatreeio\u002FCRDs-catalog\u002Fmain\u002F{{.Group}}\u002F{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \\\n    -summary \\\n    -verbose \\\n    {} +\n```\n\n**Options to consider:**\n- Add `-strict` to reject unknown fields (recommended for production)\n- Add `-ignore-missing-schemas` if working with custom\u002Finternal CRDs\n- Add `-kubernetes-version 1.28.0` to validate against specific K8s version\n- Add `-output json` for programmatic processing\n\n**Common issues caught:**\n- Invalid apiVersion or kind\n- Missing required fields\n- Wrong field types\n- Invalid enum values\n- Unknown fields (with -strict)\n\n**For CRDs:** If kubeconform reports \"no schema found\", this is expected. Use the documentation from Stage 6 to manually validate the spec fields.\n\n**Stage 7 success criteria (explicit):**\n- ✅ Passed: `kubeconform` exits `0`, and no invalid resources are reported.\n- ⚠️ Warning: only CRD schema-missing findings remain and Stage 6 documentation\u002Fmanual verification is completed.\n- ❌ Failed: any non-CRD schema violation, parse error, or unresolved required-field\u002Ftype error.\n\n### Stage 8: Cluster Dry-Run (if available)\n\nIf kubectl is configured and cluster access is available, perform a server-side dry-run:\n\n```bash\n# Test installation\nhelm install \u003Crelease-name> \u003Cchart-directory> \\\n  --dry-run=server \\\n  --debug \\\n  --values \u003Cvalues-file>\n\n# Test upgrade\nhelm upgrade \u003Crelease-name> \u003Cchart-directory> \\\n  --dry-run=server \\\n  --debug \\\n  --values \u003Cvalues-file>\n```\n\nIf the Helm version does not support `--dry-run=server`, use `--dry-run` and document that only client-side Helm simulation was executed.\n\n**This catches:**\n- Admission controller rejections\n- Policy violations (PSP, OPA, Kyverno, etc.)\n- Resource quota violations\n- Missing namespaces\n- Invalid ConfigMap\u002FSecret references\n- Webhook validations\n- Existing resource conflicts\n\n**If dry-run is not possible:**\n- Use kubectl with rendered templates: `kubectl apply --dry-run=server -f .\u002Frendered\u002F`\n- Skip if no cluster access\n- Document that cluster-specific validation was skipped\n\n**For updates to existing releases:**\n```bash\nhelm diff upgrade \u003Crelease-name> \u003Cchart-directory>\n```\nThis shows what would change, helping catch unintended modifications. (Requires helm-diff plugin)\n\n**Stage 8 success criteria (explicit):**\n- ✅ Passed: dry-run install and upgrade commands exit `0` with no admission\u002Fpolicy errors.\n- ⚠️ Warning: stage skipped because `kubectl`\u002Fcluster context\u002Faccess is unavailable, or only client-side fallback was possible.\n- ❌ Failed: dry-run commands return non-zero due to admission webhooks, policy violations, namespace\u002Fquota errors, or reference errors.\n\n### Stage 9: Security Best Practices Check (MANDATORY)\n\n**IMPORTANT:** This stage is MANDATORY. Analyze rendered templates for security best practices compliance.\n\n**Check rendered Deployment\u002FPod templates for:**\n\n1. **Missing securityContext** - Look for pods\u002Fcontainers without security settings:\n   ```yaml\n   # Check if pod-level securityContext exists\n   spec:\n     securityContext:\n       runAsNonRoot: true\n       runAsUser: 1000\n       fsGroup: 2000\n   ```\n\n2. **Missing container securityContext** - Each container should have:\n   ```yaml\n   securityContext:\n     allowPrivilegeEscalation: false\n     readOnlyRootFilesystem: true\n     runAsNonRoot: true\n     capabilities:\n       drop:\n         - ALL\n   ```\n\n3. **Missing resource limits\u002Frequests** - Check for:\n   ```yaml\n   resources:\n     limits:\n       cpu: \"100m\"\n       memory: \"128Mi\"\n     requests:\n       cpu: \"100m\"\n       memory: \"128Mi\"\n   ```\n\n4. **Image tag issues** - Flag if using `:latest` or no tag\n\n5. **Missing probes** - Check for liveness\u002Freadiness probes\n\n**How to check:** Read the rendered deployment YAML files and grep for these patterns:\n```bash\n# Check for securityContext\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec grep -l \"securityContext\" {} +\n\n# Check for resources\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec grep -l \"resources:\" {} +\n\n# Check for latest tag\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec grep \"image:.*:latest\" {} +\n```\n\n### Stage 10: Final Report (MANDATORY)\n\n**IMPORTANT:** This stage is MANDATORY even if all validations pass. You MUST complete ALL of the following actions.\n\n**Default behavior is read-only.** Do not modify files unless the user explicitly asks you to apply fixes.\n\n#### Step 1: Load Reference Files (MANDATORY when warnings exist)\n\n**If ANY warnings, errors, or security issues were found, you MUST read:**\n```\nRead references\u002Fhelm_best_practices.md\nRead references\u002Fk8s_best_practices.md\n```\n\nUse these references to provide context and recommendations for each issue found.\n\n#### Step 2: Present Validation Summary\n\n**Always present a validation summary** formatted as a table showing:\n- Each validation stage executed (Stages 1-9)\n- Status of each stage (✅ Passed, ⚠️ Warning, ❌ Failed)\n- Count of issues found per stage\n\nExample:\n```\n| Stage | Status | Issues |\n|-------|--------|--------|\n| 1. Tool Check | ✅ Passed | All tools available |\n| 2. Structure | ⚠️ Warning | Missing: .helmignore, NOTES.txt |\n| 3. Helm Lint | ✅ Passed | 0 errors |\n| 4. Template Render | ✅ Passed | 5 templates rendered |\n| 5. YAML Syntax | ✅ Passed | No yamllint errors |\n| 6. CRD Detection | ✅ Passed | 1 CRD documented |\n| 7. Schema Validation | ✅ Passed | All resources valid |\n| 8. Dry-Run | ✅ Passed | No cluster errors |\n| 9. Security Check | ⚠️ Warning | Missing securityContext |\n```\n\n#### Step 3: Categorize All Issues\n\nGroup findings by severity:\n\n**❌ Errors (must fix):**\n- Template syntax errors\n- Missing required fields\n- Schema validation failures\n- Dry-run failures\n\n**⚠️ Warnings (should fix):**\n- Deprecated Kubernetes APIs\n- Missing securityContext\n- Missing resource limits\u002Frequests\n- Using `:latest` image tag\n- Missing recommended files (_helpers.tpl, .helmignore, NOTES.txt)\n\n**ℹ️ Info (recommendations):**\n- Missing values.schema.json\n- Missing README.md\n- Optimization opportunities\n\n#### Step 4: List Proposed Changes (DO NOT APPLY)\n\nFor each issue, provide a **proposed fix** with:\n- File path and line number (if applicable)\n- Before\u002Fafter code blocks\n- Explanation of why this change is recommended\n\nExample format:\n```\n## Proposed Changes\n\n### 1. Add securityContext to Deployment\n**File:** templates\u002Fdeployment.yaml:25\n**Severity:** ⚠️ Warning\n**Reason:** Running containers as root is a security risk\n\n**Current:**\n```yaml\nspec:\n  containers:\n    - name: app\n      image: nginx:1.21\n```\n\n**Proposed:**\n```yaml\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    fsGroup: 2000\n  containers:\n    - name: app\n      image: nginx:1.21\n      securityContext:\n        allowPrivilegeEscalation: false\n        readOnlyRootFilesystem: true\n        capabilities:\n          drop:\n            - ALL\n```\n\n### 2. Add .helmignore file\n**File:** .helmignore (new file)\n**Severity:** ⚠️ Warning\n**Reason:** Excludes unnecessary files from chart packaging\n\n**Proposed:** Copy from `assets\u002F.helmignore`\n```\n\n#### Step 5: Automation Opportunities\n\nList all detected automation opportunities:\n- If `_helpers.tpl` is missing → Recommend: `bash scripts\u002Fgenerate_helpers.sh \u003Cchart>`\n- If `.helmignore` is missing → Recommend: Copy from `assets\u002F.helmignore`\n- If `values.schema.json` is missing → Recommend: Copy and customize from `assets\u002Fvalues.schema.json`\n- If `NOTES.txt` is missing → Recommend: Create post-install notes template\n- If `README.md` is missing → Recommend: Create chart documentation\n\n#### Step 6: Final Summary\n\nProvide a final summary:\n```\n## Validation Summary\n\n**Chart:** \u003Cchart-name>\n**Status:** ⚠️ Warnings Found (or ✅ Ready for Deployment)\n\n**Issues Found:**\n- Errors: X\n- Warnings: Y\n- Info: Z\n\n**Proposed Changes:** N changes recommended\n\n**Next Steps:**\n1. Review proposed changes above\n2. Apply changes manually or use helm-generator skill\n3. Re-run validation to confirm fixes\n```\n\n## Workflow Done Criteria\n\nValidation is complete only when all of the following are true:\n- A Stage 1 to Stage 10 status table is present with `✅ Passed`, `⚠️ Warning`, `❌ Failed`, or `⏭️ Skipped` for each stage.\n- Every skipped stage includes a concrete tool or environment reason.\n- Stage 7 and Stage 8 are evaluated against their explicit success criteria above.\n- Severity totals are reported (`Errors`, `Warnings`, `Info`) with proposed remediation actions.\n- Role boundary is respected: no file edits unless explicitly requested by the user.\n\n## Helm Templating Automation & Best Practices\n\nThis section covers advanced Helm templating techniques, helper functions, and automation strategies.\n\n### Template Helpers (`_helpers.tpl`)\n\nTemplate helpers are reusable functions defined in `templates\u002F_helpers.tpl`. They promote DRY principles and consistency.\n\n**Standard helper patterns:**\n\n1. **Chart name helper:**\n```yaml\n{{\u002F*\nExpand the name of the chart.\n*\u002F}}\n{{- define \"mychart.name\" -}}\n{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n```\n\n2. **Fullname helper:**\n```yaml\n{{\u002F*\nCreate a default fully qualified app name.\n*\u002F}}\n{{- define \"mychart.fullname\" -}}\n{{- if .Values.fullnameOverride }}\n{{- .Values.fullnameOverride | trunc 63 | trimSuffix \"-\" }}\n{{- else }}\n{{- $name := default .Chart.Name .Values.nameOverride }}\n{{- if contains $name .Release.Name }}\n{{- .Release.Name | trunc 63 | trimSuffix \"-\" }}\n{{- else }}\n{{- printf \"%s-%s\" .Release.Name $name | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n{{- end }}\n{{- end }}\n```\n\n3. **Chart reference helper:**\n```yaml\n{{\u002F*\nCreate chart name and version as used by the chart label.\n*\u002F}}\n{{- define \"mychart.chart\" -}}\n{{- printf \"%s-%s\" .Chart.Name .Chart.Version | replace \"+\" \"_\" | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n```\n\n4. **Standard labels helper:**\n```yaml\n{{\u002F*\nCommon labels\n*\u002F}}\n{{- define \"mychart.labels\" -}}\nhelm.sh\u002Fchart: {{ include \"mychart.chart\" . }}\n{{ include \"mychart.selectorLabels\" . }}\n{{- if .Chart.AppVersion }}\napp.kubernetes.io\u002Fversion: {{ .Chart.AppVersion | quote }}\n{{- end }}\napp.kubernetes.io\u002Fmanaged-by: {{ .Release.Service }}\n{{- end }}\n```\n\n5. **Selector labels helper:**\n```yaml\n{{\u002F*\nSelector labels\n*\u002F}}\n{{- define \"mychart.selectorLabels\" -}}\napp.kubernetes.io\u002Fname: {{ include \"mychart.name\" . }}\napp.kubernetes.io\u002Finstance: {{ .Release.Name }}\n{{- end }}\n```\n\n6. **ServiceAccount name helper:**\n```yaml\n{{\u002F*\nCreate the name of the service account to use\n*\u002F}}\n{{- define \"mychart.serviceAccountName\" -}}\n{{- if .Values.serviceAccount.create }}\n{{- default (include \"mychart.fullname\" .) .Values.serviceAccount.name }}\n{{- else }}\n{{- default \"default\" .Values.serviceAccount.name }}\n{{- end }}\n{{- end }}\n```\n\n**When to create helpers:**\n- Values used in multiple templates\n- Complex logic that's repeated\n- Label sets that should be consistent\n- Name generation patterns\n- Conditional resource inclusion\n\n### Essential Template Functions\n\nReference and use these Helm template functions for robust charts:\n\n1. **`required` - Enforce required values:**\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: {{ required \"A valid service name is required!\" .Values.service.name }}\n```\n\n2. **`default` - Provide fallback values:**\n```yaml\nreplicas: {{ .Values.replicaCount | default 1 }}\n```\n\n3. **`quote` - Safely quote string values:**\n```yaml\nenv:\n  - name: DATABASE_HOST\n    value: {{ .Values.database.host | quote }}\n```\n\n4. **`include` - Use helpers with pipeline:**\n```yaml\nmetadata:\n  labels:\n    {{- include \"mychart.labels\" . | nindent 4 }}\n```\n\n5. **`tpl` - Render strings as templates:**\n```yaml\n{{- tpl .Values.customConfig . }}\n```\n\n6. **`toYaml` - Convert objects to YAML:**\n```yaml\n{{- with .Values.resources }}\nresources:\n  {{- toYaml . | nindent 2 }}\n{{- end }}\n```\n\n7. **`fromYaml` - Parse YAML strings:**\n```yaml\n{{- $config := .Values.configYaml | fromYaml }}\n```\n\n8. **`merge` - Merge maps:**\n```yaml\n{{- $merged := merge .Values.override .Values.defaults }}\n```\n\n9. **`lookup` - Query cluster resources (use carefully):**\n```yaml\n{{- $secret := lookup \"v1\" \"Secret\" .Release.Namespace \"my-secret\" }}\n{{- if $secret }}\n  # Secret exists, use it\n{{- else }}\n  # Create new secret\n{{- end }}\n```\n\n### Advanced Template Patterns\n\n1. **Conditional resource creation:**\n```yaml\n{{- if .Values.ingress.enabled -}}\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\n# ... ingress definition\n{{- end }}\n```\n\n2. **Range over lists:**\n```yaml\n{{- range .Values.extraEnvVars }}\n- name: {{ .name }}\n  value: {{ .value | quote }}\n{{- end }}\n```\n\n3. **Range over maps:**\n```yaml\n{{- range $key, $value := .Values.configMap }}\n{{ $key }}: {{ $value | quote }}\n{{- end }}\n```\n\n4. **With blocks for scoping:**\n```yaml\n{{- with .Values.nodeSelector }}\nnodeSelector:\n  {{- toYaml . | nindent 2 }}\n{{- end }}\n```\n\n5. **Named templates with custom context:**\n```yaml\n{{- include \"mychart.container\" (dict \"root\" . \"container\" .Values.mainContainer) }}\n```\n\n### Values Structure Best Practices\n\n**Prefer flat structures when possible:**\n\n```yaml\n# Good - Flat structure\nserverName: nginx\nserverPort: 80\n\n# Acceptable - Nested structure for related settings\nserver:\n  name: nginx\n  port: 80\n  replicas: 3\n```\n\n**Always provide defaults in values.yaml:**\n```yaml\nreplicaCount: 1\n\nimage:\n  repository: nginx\n  pullPolicy: IfNotPresent\n  tag: \"1.21.0\"\n\nservice:\n  type: ClusterIP\n  port: 80\n\nresources:\n  limits:\n    cpu: 100m\n    memory: 128Mi\n  requests:\n    cpu: 100m\n    memory: 128Mi\n```\n\n**Document all values:**\n```yaml\n# replicaCount is the number of pod replicas for the deployment\nreplicaCount: 1\n\n# image configures the container image\nimage:\n  # image.repository is the container image registry and name\n  repository: nginx\n  # image.tag overrides the image tag (default is chart appVersion)\n  tag: \"1.21.0\"\n```\n\n### Template Comments and Documentation\n\nUse Helm template comments for documentation:\n\n```yaml\n{{- \u002F*\nmychart.fullname generates the fullname for resources.\nIt supports nameOverride and fullnameOverride values.\nUsage: {{ include \"mychart.fullname\" . }}\n*\u002F -}}\n{{- define \"mychart.fullname\" -}}\n{{- if .Values.fullnameOverride }}\n{{- .Values.fullnameOverride | trunc 63 | trimSuffix \"-\" }}\n{{- else }}\n{{- printf \"%s-%s\" .Release.Name .Chart.Name | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n{{- end }}\n```\n\nUse YAML comments for user-facing notes:\n\n```yaml\n# WARNING: Changing the storage class will not migrate existing data\nstorageClass: \"standard\"\n```\n\n### Whitespace Management\n\nUse `-` to chomp whitespace in template directives:\n\n```yaml\n{{- if .Values.enabled }}\n  # Remove leading whitespace\n{{- end }}\n\n{{ .Values.name -}}\n  # Remove trailing whitespace\n```\n\nGood formatting:\n```yaml\n{{- if .Values.enabled }}\n  key: value\n{{- end }}\n```\n\nBad formatting:\n```yaml\n{{if .Values.enabled}}\nkey: value\n{{end}}\n```\n\n## Helper Patterns Reference\n\nWhen analyzing charts, identify opportunities for helper functions:\n\n1. **Identify repetition:**\n   - Same label sets across resources\n   - Repeated name generation logic\n   - Common conditional patterns\n\n2. **Common helper patterns to recommend:**\n   - Chart name helper (`.name`)\n   - Fullname helper (`.fullname`)\n   - Chart version label (`.chart`)\n   - Common labels (`.labels`)\n   - Selector labels (`.selectorLabels`)\n   - ServiceAccount name (`.serviceAccountName`)\n\n3. **When to recommend helpers:**\n   - Missing `_helpers.tpl` file\n   - Repeated code patterns across templates\n   - Inconsistent label usage\n   - Long resource names that need truncation\n\n## Best Practices Reference\n\nFor detailed Helm and Kubernetes best practices, load the references:\n\n```\nRead references\u002Fhelm_best_practices.md\nRead references\u002Fk8s_best_practices.md\n```\n\nThese references include:\n- Chart structure and metadata\n- Template conventions and patterns\n- Values file organization\n- Security best practices\n- Resource limits and requests\n- Common validation issues and fixes\n\n**When to load:** When validation reveals issues that need context, when implementing new features, or when the user asks about best practices.\n\n## Working with Chart Dependencies\n\nWhen a chart has dependencies (in `Chart.yaml` or `charts\u002F` directory):\n\n1. **Update dependencies:**\n```bash\nhelm dependency update \u003Cchart-directory>\n```\n\n2. **List dependencies:**\n```bash\nhelm dependency list \u003Cchart-directory>\n```\n\n3. **Validate dependencies:**\n   - Check that dependency versions are available\n   - Verify dependency values are properly scoped\n   - Test templates with dependency resources\n\n4. **Override dependency values:**\n```yaml\n# values.yaml\npostgresql:\n  enabled: true\n  postgresqlPassword: \"secret\"\n  persistence:\n    size: 10Gi\n```\n\n## Error Handling Strategies\n\n### Tool Not Available\n- Run `scripts\u002Fsetup_tools.sh` to check availability\n- Provide installation instructions\n- Skip optional stages but document what was skipped\n- Continue with available tools\n\n### Template Rendering Errors\n- Show the specific template file and line number\n- Check if values are defined in values.yaml\n- Verify template function syntax\n- Test with simpler value combinations\n- Use `--debug` flag for detailed error messages\n\n### Cluster Access Issues\n- Fall back to client-side validation\n- Use rendered templates with kubectl\n- Skip cluster validation if no kubectl config\n- Document limitations in validation report\n\n### CRD Documentation Not Found\n- Document that documentation lookup failed\n- Attempt validation with kubeconform CRD schemas\n- Suggest manual CRD inspection:\n  ```bash\n  kubectl get crd \u003Ccrd-name>.group -o yaml\n  kubectl explain \u003Ckind>\n  ```\n\n### Validation Stage Failures\n- Continue to next stage even if one fails\n- Collect all errors before presenting to user\n- Prioritize fixing Helm lint errors first\n- Then fix template errors\n- Finally fix schema\u002Fvalidation errors\n\n### macOS Extended Attributes Issue\n\n**Symptom:** Helm reports \"Chart.yaml file is missing\" even though the file exists and is readable.\n\n**Cause:** On macOS, files created programmatically (via Write tool, scripts, or certain editors) may have extended attributes (e.g., `com.apple.provenance`, `com.apple.quarantine`) that interfere with Helm's file detection.\n\n**Diagnosis:**\n```bash\n# Check for extended attributes\nxattr \u002Fpath\u002Fto\u002Fchart\u002FChart.yaml\n\n# If attributes are present, you'll see output like:\n# com.apple.provenance\n# com.apple.quarantine\n```\n\n**Solutions:**\n\n1. **Remove extended attributes:**\n   ```bash\n   # Remove all extended attributes from a file\n   xattr -c \u002Fpath\u002Fto\u002Fchart\u002FChart.yaml\n\n   # Remove all extended attributes recursively from chart directory\n   xattr -cr \u002Fpath\u002Fto\u002Fchart\u002F\n   ```\n\n2. **Create files using shell commands instead:**\n   ```bash\n   # Use cat with heredoc instead of direct file writes\n   cat > Chart.yaml \u003C\u003C 'EOF'\n   apiVersion: v2\n   name: mychart\n   version: 0.1.0\n   EOF\n   ```\n\n3. **Copy from helm-created chart:**\n   ```bash\n   # Create a fresh chart and copy structure\n   helm create temp-chart\n   cp -r temp-chart\u002F* \u002Fpath\u002Fto\u002Fyour\u002Fchart\u002F\n   rm -rf temp-chart\n   ```\n\n**Prevention:** When creating new chart files on macOS, prefer using `helm create` as a base or use shell heredocs (`cat > file \u003C\u003C 'EOF'`) rather than direct file creation tools.\n\n## Communication Guidelines\n\nWhen presenting validation results and fixes:\n\n1. **Be clear and concise** about what was found\n2. **Explain why issues matter** (e.g., \"This will cause pod creation to fail\")\n3. **Provide context** from Helm best practices when relevant\n4. **Group related issues** (e.g., all missing helper issues together)\n5. **Use file:line references** when available\n6. **Show confidence level** for auto-fixes (high confidence = syntax, low = logic changes)\n7. **Always provide a summary after proposing fixes** (and after applying fixes when explicitly requested) including:\n   - What was changed and why\n   - File and line references for each fix\n   - Total count of issues resolved\n   - Final validation status\n   - Any remaining warnings or recommendations\n\n## Version Awareness\n\nAlways consider Kubernetes and Helm version compatibility:\n- Check for deprecated Kubernetes APIs\n- Ensure Helm chart apiVersion is v2 (for Helm 3+)\n- For CRDs, ensure the apiVersion matches what's in the cluster\n- Use `kubectl api-versions` to list available API versions\n- Reference version-specific documentation when available\n- Set `kubeVersion` constraint in Chart.yaml if needed\n\n## Chart Testing\n\nFor comprehensive testing, use Helm test resources:\n\n1. **Create test resources:**\n```yaml\n# templates\u002Ftests\u002Ftest-connection.yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: \"{{ include \"mychart.fullname\" . }}-test-connection\"\n  annotations:\n    \"helm.sh\u002Fhook\": test\nspec:\n  containers:\n    - name: wget\n      image: busybox\n      command: ['wget']\n      args: ['{{ include \"mychart.fullname\" . }}:{{ .Values.service.port }}']\n  restartPolicy: Never\n```\n\n2. **Run tests:**\n```bash\nhelm test \u003Crelease-name>\n```\n\n## Automation Opportunities Reference\n\n**During Stage 10 (Final Report), list all detected automation opportunities in the summary.**\n\n**Do NOT ask user questions or modify files. Simply list recommendations.**\n\n**Automation opportunities to detect and list:**\n\n| Missing Item | Recommendation |\n|--------------|----------------|\n| `_helpers.tpl` | Run: `bash scripts\u002Fgenerate_helpers.sh \u003Cchart>` |\n| `.helmignore` | Copy from: `assets\u002F.helmignore` |\n| `values.schema.json` | Copy and customize from: `assets\u002Fvalues.schema.json` |\n| `NOTES.txt` | Create post-install notes template |\n| `README.md` | Create chart documentation |\n| Repeated patterns | Extract to helper functions |\n\n**Security recommendations to include when issues found:**\n\n| Issue | Recommendation |\n|-------|----------------|\n| Missing pod securityContext | Add `runAsNonRoot: true`, `runAsUser: 1000`, `fsGroup: 2000` |\n| Missing container securityContext | Add `allowPrivilegeEscalation: false`, `readOnlyRootFilesystem: true`, `capabilities.drop: [ALL]` |\n| Missing resource limits | Add CPU\u002Fmemory limits and requests |\n| Using `:latest` tag | Pin to specific image version |\n| Missing probes | Add liveness and readiness probes |\n\n**Template improvement recommendations:**\n\n| Issue | Recommendation |\n|-------|----------------|\n| Using `template` instead of `include` | Replace with `include` for pipeline support |\n| Missing `nindent` | Add `nindent` for proper YAML indentation |\n| No default values | Add `default` function for optional values |\n| Missing `required` function | Add `required` for critical values |\n\n## Resources\n\n### scripts\u002F\n\n**setup_tools.sh**\n- Checks for required validation tools (helm, yamllint, kubeconform, kubectl)\n- Provides installation instructions for missing tools\n- Verifies versions of installed tools\n- Usage: `bash scripts\u002Fsetup_tools.sh`\n\n**validate_chart_structure.sh**\n- Validates Helm chart directory structure\n- Checks for required files (Chart.yaml, values.yaml, templates\u002F)\n- Verifies file formats and syntax\n- Usage: `bash scripts\u002Fvalidate_chart_structure.sh \u003Cchart-directory>`\n\n**detect_crd_wrapper.sh**\n- Wrapper script that handles Python dependency management\n- Automatically creates temporary venv if PyYAML is not available\n- Calls detect_crd.py to parse YAML files\n- Usage: `bash scripts\u002Fdetect_crd_wrapper.sh \u003Cfile.yaml> [file2.yaml ...]`\n\n**detect_crd.py**\n- Parses YAML files to identify Custom Resource Definitions\n- Extracts kind, apiVersion, group, and version information\n- Outputs JSON for programmatic processing\n- Requires PyYAML (handled automatically by wrapper script)\n- Can be called directly: `python3 scripts\u002Fdetect_crd.py \u003Cfile.yaml> [file2.yaml ...]`\n\n**generate_helpers.sh**\n- Generates standard Helm helpers (_helpers.tpl) for a chart\n- Creates fullname, labels, and selector helpers\n- Usage: `bash scripts\u002Fgenerate_helpers.sh \u003Cchart-directory>`\n\n### references\u002F\n\n**helm_best_practices.md**\n- Comprehensive guide to Helm chart best practices\n- Covers template patterns, helper functions, values structure\n- Common validation issues and how to fix them\n- Security and performance recommendations\n- Load when providing context for Helm-specific issues\n\n**k8s_best_practices.md**\n- Comprehensive guide to Kubernetes YAML best practices\n- Covers metadata, labels, resource limits, security context\n- Common validation issues and how to fix them\n- Load when providing context for Kubernetes-specific issues\n\n**template_functions.md**\n- Reference guide for Helm template functions\n- Examples of all built-in functions\n- Sprig function library reference\n- Custom function patterns\n- Load when implementing complex templates\n\n### assets\u002F\n\n**.helmignore**\n- Standard .helmignore file for excluding files from packaging\n- Pre-configured with common patterns\n\n**.yamllint**\n- Pre-configured yamllint rules for Kubernetes YAML\n- Follows Kubernetes conventions (2-space indentation, line length, etc.)\n- Can be customized per project\n- Usage: `yamllint -c assets\u002F.yamllint \u003Cfile.yaml>`\n\n**values.schema.json**\n- Example JSON Schema for values validation\n- Can be copied and customized for specific charts\n- Provides type safety and validation\n","# Helm Chart Validator & Analysis Toolkit\n\n## Overview\n\nThis skill provides a comprehensive validation and analysis workflow for Helm charts, combining Helm-native linting, template rendering, YAML validation, schema validation, CRD documentation lookup, and security best practices checking.\n\n**IMPORTANT: This validator is read-only by default.** It analyzes charts and proposes improvements. Only modify files when the user explicitly asks to apply fixes.\n\n## Trigger Cases\n\nUse this skill when one or more of these top cases apply:\n- The user asks to validate, lint, check, test, or troubleshoot a Helm chart\n- Helm templates fail to render, lint, or produce valid Kubernetes YAML\n- A pre-deployment quality gate is needed (schema, dry-run, security checks)\n- CRD resources are present and their spec fields must be verified against docs\n- The user wants a severity-based validation report with proposed remediations\n\nTrigger phrase examples:\n- \"Validate this Helm chart before release\"\n- \"Why does `helm template` fail?\"\n- \"Check this chart for Kubernetes and security issues\"\n\nOut of scope by default:\n- New chart scaffolding or broad chart generation (use `helm-generator`)\n\n## Role Boundaries\n\n- This skill validates and reports; it does not silently rewrite user files.\n- It can propose concrete patches and apply them only when the user explicitly requests fixes.\n- If execution constraints block a stage, it must continue with reachable stages and document the skip reason.\n\n## Execution Model\n\n1. Run stages in order (1 through 10).\n2. Keep going after stage-level failures to collect complete findings, unless rendering fails and no manifests exist.\n3. If Stage 4 produces no manifests, mark Stages 5 to 9 as blocked and continue to Stage 10 reporting.\n4. Treat Stage 8 as environment-dependent optional; treat Stage 9 and Stage 10 as mandatory when manifests exist.\n5. For every skipped stage, record the exact tool\u002Fenvironment reason in the final summary table.\n\n## Quick Execution Modes\n\n### Mode A: Local Validation (no cluster required)\n```bash\nbash scripts\u002Fsetup_tools.sh\nbash scripts\u002Fvalidate_chart_structure.sh \u003Cchart-directory>\nhelm lint \u003Cchart-directory> --strict\nhelm template \u003Crelease-name> \u003Cchart-directory> --values \u003Cvalues-file> --debug --output-dir .\u002Frendered\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) -exec yamllint -c assets\u002F.yamllint {} +\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) -exec kubeconform -summary -verbose {} +\n```\n\n### Mode B: Full Validation (cluster available)\nRun Mode A plus Stage 8 dry-run commands in this document.\n\n## Validation & Testing Workflow\n\nFollow this sequential validation workflow. Each stage catches different types of issues:\n\n### Stage 1: Tool Check\n\nBefore starting validation, verify required tools are installed:\n\n```bash\nbash scripts\u002Fsetup_tools.sh\n```\n\nRequired tools:\n- **helm**: Helm package manager for Kubernetes (v3+)\n- **yamllint**: YAML syntax and style linting\n- **kubeconform**: Kubernetes schema validation with CRD support\n- **kubectl**: Cluster dry-run testing (optional but recommended)\n\nFallback policy for unavailable tools or environment constraints:\n\n| Condition | Action | Stage status |\n|-----------|--------|--------------|\n| `helm` missing | Run Stage 2 only, then report Stages 3 to 9 as skipped\u002Fblocked | ⚠️ Warning |\n| `yamllint` missing | Use `yq` syntax checks if available; otherwise skip Stage 5 | ⚠️ Warning |\n| `kubeconform` missing | Skip Stage 7 and rely on Stage 6 CRD\u002Fmanual checks | ⚠️ Warning |\n| `kubectl` missing or no kube-context | Skip Stage 8, continue with remaining stages | ⚠️ Warning |\n| No internet access for CRD docs | Use local CRD manifests and kubeconform output, mark doc lookup incomplete | ⚠️ Warning |\n\nIf tools are missing, provide installation instructions from `scripts\u002Fsetup_tools.sh` output and continue with the fallback path above.\n\n### Stage 2: Helm Chart Structure Validation\n\nVerify the chart follows the standard Helm directory structure:\n\n```bash\nbash scripts\u002Fvalidate_chart_structure.sh \u003Cchart-directory>\n```\n\n**Expected structure:**\n```\nmychart\u002F\n  Chart.yaml          # Chart metadata (required)\n  values.yaml         # Default values (required)\n  values.schema.json  # JSON Schema for values validation (optional)\n  templates\u002F          # Template directory (required)\n    _helpers.tpl      # Template helpers (recommended)\n    NOTES.txt         # Post-install notes (recommended)\n    *.yaml            # Kubernetes manifest templates\n  charts\u002F             # Chart dependencies (optional)\n  crds\u002F               # Custom Resource Definitions (optional)\n  .helmignore         # Files to ignore during packaging (optional)\n```\n\n**Common issues caught:**\n- Missing required files (Chart.yaml, values.yaml, templates\u002F)\n- Invalid Chart.yaml syntax or missing required fields\n- Malformed values.schema.json\n- Incorrect file permissions\n\n### Stage 3: Helm Lint\n\nRun Helm's built-in linter to catch chart-specific issues:\n\n```bash\nhelm lint \u003Cchart-directory> --strict\n```\n\n**Optional flags:**\n- `--values \u003Cvalues-file>`: Test with specific values\n- `--set key=value`: Override specific values\n- `--debug`: Show detailed error information\n\n**Common issues caught:**\n- Invalid Chart.yaml metadata\n- Template syntax errors\n- Missing or undefined values\n- Deprecated Kubernetes API versions\n- Chart best practice violations\n\n**Auto-fix approach:**\n- For template errors, identify the problematic template file\n- Show the user the specific line causing issues\n- Propose a patch\u002Fdiff for the fix\n- Apply fixes only if the user explicitly asks\n- Re-run `helm lint` after fixes are applied\n\n### Stage 4: Template Rendering\n\nRender templates locally to verify they produce valid YAML:\n\n```bash\nhelm template \u003Crelease-name> \u003Cchart-directory> \\\n  --values \u003Cvalues-file> \\\n  --debug \\\n  --output-dir .\u002Frendered\n```\n\n**Options to consider:**\n- `--values values.yaml`: Use specific values file\n- `--set key=value`: Override individual values\n- `--show-only templates\u002Fdeployment.yaml`: Render specific template\n- `--validate`: Validate against Kubernetes OpenAPI schema\n- `--include-crds`: Include CRDs in rendered output\n- `--is-upgrade`: Simulate upgrade scenario\n- `--kube-version 1.28.0`: Target specific Kubernetes version\n\n**Common issues caught:**\n- Template syntax errors (Go template issues)\n- Undefined variables or values\n- Type mismatches (string vs. integer)\n- Missing required values\n- Logic errors in conditionals or loops\n- Incorrect indentation in nested templates\n\n**For template errors:**\n- Identify the template file and line number\n- Check if values are properly defined in values.yaml\n- Verify template function usage (quote, required, default, include, etc.)\n- Test with different value combinations\n\n### Stage 5: YAML Syntax Validation\n\nValidate YAML syntax and formatting of rendered templates:\n\n```bash\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec yamllint -c assets\u002F.yamllint {} +\n```\n\n**Common issues caught:**\n- Indentation errors (tabs vs spaces)\n- Trailing whitespace\n- Line length violations\n- Syntax errors\n- Duplicate keys\n- Document start\u002Fend markers\n\n**Auto-fix approach:**\n- For simple issues (indentation, trailing spaces), propose fixes using the Edit tool\n- For template-generated issues, fix the source template, not rendered output\n- Always show the user what will be changed before applying fixes\n\n### Stage 6: CRD Detection and Documentation Lookup\n\nBefore schema validation, detect if the chart contains or renders Custom Resource Definitions:\n\n```bash\n# Check crds\u002F directory\nif [ -d \u003Cchart-directory>\u002Fcrds ]; then\n  find \u003Cchart-directory>\u002Fcrds -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n    -exec bash scripts\u002Fdetect_crd_wrapper.sh {} +\nfi\n\n# Check rendered templates\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec bash scripts\u002Fdetect_crd_wrapper.sh {} +\n```\n\nThe script outputs JSON with resource information:\n```json\n[\n  {\n    \"kind\": \"Certificate\",\n    \"apiVersion\": \"cert-manager.io\u002Fv1\",\n    \"group\": \"cert-manager.io\",\n    \"version\": \"v1\",\n    \"isCRD\": true,\n    \"name\": \"example-cert\"\n  }\n]\n```\n\n**For each detected CRD:**\n\n1. **Try context7 MCP first (preferred):**\n   ```\n   Use mcp__context7__resolve-library-id with the CRD project name\n   Example: \"cert-manager\" for cert-manager.io CRDs\n            \"prometheus-operator\" for monitoring.coreos.com CRDs\n            \"istio\" for networking.istio.io CRDs\n\n   Then use mcp__context7__query-docs with:\n   - libraryId from resolve step\n   - query: The CRD kind and relevant features (e.g., \"Certificate spec required fields\")\n   ```\n\n2. **Fallback to `web.search_query` (web search) if Context7 fails:**\n   ```\n   Search query pattern:\n   \"\u003Ckind>\" \"\u003Cgroup>\" kubernetes CRD \"\u003Cversion>\" documentation spec\n\n   Example:\n   \"Certificate\" \"cert-manager.io\" kubernetes CRD \"v1\" documentation spec\n   \"Prometheus\" \"monitoring.coreos.com\" kubernetes CRD \"v1\" documentation spec\n   ```\n\n3. **Extract key information:**\n   - Required fields in `spec`\n   - Field types and validation rules\n   - Examples from documentation\n   - Version-specific changes or deprecations\n   - Common configuration patterns\n\n**Why this matters:** CRDs have custom schemas not available in standard Kubernetes validation tools. Understanding the CRD's spec requirements prevents validation errors and ensures correct resource configuration.\n\n### Stage 7: Schema Validation\n\nValidate rendered templates against Kubernetes schemas:\n\n```bash\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) -exec \\\n  kubeconform \\\n    -schema-location default \\\n    -schema-location 'https:\u002F\u002Fraw.githubusercontent.com\u002Fdatreeio\u002FCRDs-catalog\u002Fmain\u002F{{.Group}}\u002F{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \\\n    -summary \\\n    -verbose \\\n    {} +\n```\n\n**Options to consider:**\n- Add `-strict` to reject unknown fields (recommended for production)\n- Add `-ignore-missing-schemas` if working with custom\u002Finternal CRDs\n- Add `-kubernetes-version 1.28.0` to validate against specific K8s version\n- Add `-output json` for programmatic processing\n\n**Common issues caught:**\n- Invalid apiVersion or kind\n- Missing required fields\n- Wrong field types\n- Invalid enum values\n- Unknown fields (with -strict)\n\n**For CRDs:** If kubeconform reports \"no schema found\", this is expected. Use the documentation from Stage 6 to manually validate the spec fields.\n\n**Stage 7 success criteria (explicit):**\n- ✅ Passed: `kubeconform` exits `0`, and no invalid resources are reported.\n- ⚠️ Warning: only CRD schema-missing findings remain and Stage 6 documentation\u002Fmanual verification is completed.\n- ❌ Failed: any non-CRD schema violation, parse error, or unresolved required-field\u002Ftype error.\n\n### Stage 8: Cluster Dry-Run (if available)\n\nIf kubectl is configured and cluster access is available, perform a server-side dry-run:\n\n```bash\n# Test installation\nhelm install \u003Crelease-name> \u003Cchart-directory> \\\n  --dry-run=server \\\n  --debug \\\n  --values \u003Cvalues-file>\n\n# Test upgrade\nhelm upgrade \u003Crelease-name> \u003Cchart-directory> \\\n  --dry-run=server \\\n  --debug \\\n  --values \u003Cvalues-file>\n```\n\nIf the Helm version does not support `--dry-run=server`, use `--dry-run` and document that only client-side Helm simulation was executed.\n\n**This catches:**\n- Admission controller rejections\n- Policy violations (PSP, OPA, Kyverno, etc.)\n- Resource quota violations\n- Missing namespaces\n- Invalid ConfigMap\u002FSecret references\n- Webhook validations\n- Existing resource conflicts\n\n**If dry-run is not possible:**\n- Use kubectl with rendered templates: `kubectl apply --dry-run=server -f .\u002Frendered\u002F`\n- Skip if no cluster access\n- Document that cluster-specific validation was skipped\n\n**For updates to existing releases:**\n```bash\nhelm diff upgrade \u003Crelease-name> \u003Cchart-directory>\n```\nThis shows what would change, helping catch unintended modifications. (Requires helm-diff plugin)\n\n**Stage 8 success criteria (explicit):**\n- ✅ Passed: dry-run install and upgrade commands exit `0` with no admission\u002Fpolicy errors.\n- ⚠️ Warning: stage skipped because `kubectl`\u002Fcluster context\u002Faccess is unavailable, or only client-side fallback was possible.\n- ❌ Failed: dry-run commands return non-zero due to admission webhooks, policy violations, namespace\u002Fquota errors, or reference errors.\n\n### Stage 9: Security Best Practices Check (MANDATORY)\n\n**IMPORTANT:** This stage is MANDATORY. Analyze rendered templates for security best practices compliance.\n\n**Check rendered Deployment\u002FPod templates for:**\n\n1. **Missing securityContext** - Look for pods\u002Fcontainers without security settings:\n   ```yaml\n   # Check if pod-level securityContext exists\n   spec:\n     securityContext:\n       runAsNonRoot: true\n       runAsUser: 1000\n       fsGroup: 2000\n   ```\n\n2. **Missing container securityContext** - Each container should have:\n   ```yaml\n   securityContext:\n     allowPrivilegeEscalation: false\n     readOnlyRootFilesystem: true\n     runAsNonRoot: true\n     capabilities:\n       drop:\n         - ALL\n   ```\n\n3. **Missing resource limits\u002Frequests** - Check for:\n   ```yaml\n   resources:\n     limits:\n       cpu: \"100m\"\n       memory: \"128Mi\"\n     requests:\n       cpu: \"100m\"\n       memory: \"128Mi\"\n   ```\n\n4. **Image tag issues** - Flag if using `:latest` or no tag\n\n5. **Missing probes** - Check for liveness\u002Freadiness probes\n\n**How to check:** Read the rendered deployment YAML files and grep for these patterns:\n```bash\n# Check for securityContext\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec grep -l \"securityContext\" {} +\n\n# Check for resources\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec grep -l \"resources:\" {} +\n\n# Check for latest tag\nfind .\u002Frendered -type f \\( -name \"*.yaml\" -o -name \"*.yml\" \\) \\\n  -exec grep \"image:.*:latest\" {} +\n```\n\n### Stage 10: Final Report (MANDATORY)\n\n**IMPORTANT:** This stage is MANDATORY even if all validations pass. You MUST complete ALL of the following actions.\n\n**Default behavior is read-only.** Do not modify files unless the user explicitly asks you to apply fixes.\n\n#### Step 1: Load Reference Files (MANDATORY when warnings exist)\n\n**If ANY warnings, errors, or security issues were found, you MUST read:**\n```\nRead references\u002Fhelm_best_practices.md\nRead references\u002Fk8s_best_practices.md\n```\n\nUse these references to provide context and recommendations for each issue found.\n\n#### Step 2: Present Validation Summary\n\n**Always present a validation summary** formatted as a table showing:\n- Each validation stage executed (Stages 1-9)\n- Status of each stage (✅ Passed, ⚠️ Warning, ❌ Failed)\n- Count of issues found per stage\n\nExample:\n```\n| Stage | Status | Issues |\n|-------|--------|--------|\n| 1. Tool Check | ✅ Passed | All tools available |\n| 2. Structure | ⚠️ Warning | Missing: .helmignore, NOTES.txt |\n| 3. Helm Lint | ✅ Passed | 0 errors |\n| 4. Template Render | ✅ Passed | 5 templates rendered |\n| 5. YAML Syntax | ✅ Passed | No yamllint errors |\n| 6. CRD Detection | ✅ Passed | 1 CRD documented |\n| 7. Schema Validation | ✅ Passed | All resources valid |\n| 8. Dry-Run | ✅ Passed | No cluster errors |\n| 9. Security Check | ⚠️ Warning | Missing securityContext |\n```\n\n#### Step 3: Categorize All Issues\n\nGroup findings by severity:\n\n**❌ Errors (must fix):**\n- Template syntax errors\n- Missing required fields\n- Schema validation failures\n- Dry-run failures\n\n**⚠️ Warnings (should fix):**\n- Deprecated Kubernetes APIs\n- Missing securityContext\n- Missing resource limits\u002Frequests\n- Using `:latest` image tag\n- Missing recommended files (_helpers.tpl, .helmignore, NOTES.txt)\n\n**ℹ️ Info (recommendations):**\n- Missing values.schema.json\n- Missing README.md\n- Optimization opportunities\n\n#### Step 4: List Proposed Changes (DO NOT APPLY)\n\nFor each issue, provide a **proposed fix** with:\n- File path and line number (if applicable)\n- Before\u002Fafter code blocks\n- Explanation of why this change is recommended\n\nExample format:\n```\n## Proposed Changes\n\n### 1. Add securityContext to Deployment\n**File:** templates\u002Fdeployment.yaml:25\n**Severity:** ⚠️ Warning\n**Reason:** Running containers as root is a security risk\n\n**Current:**\n```yaml\nspec:\n  containers:\n    - name: app\n      image: nginx:1.21\n```\n\n**Proposed:**\n```yaml\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    fsGroup: 2000\n  containers:\n    - name: app\n      image: nginx:1.21\n      securityContext:\n        allowPrivilegeEscalation: false\n        readOnlyRootFilesystem: true\n        capabilities:\n          drop:\n            - ALL\n```\n\n### 2. Add .helmignore file\n**File:** .helmignore (new file)\n**Severity:** ⚠️ Warning\n**Reason:** Excludes unnecessary files from chart packaging\n\n**Proposed:** Copy from `assets\u002F.helmignore`\n```\n\n#### Step 5: Automation Opportunities\n\nList all detected automation opportunities:\n- If `_helpers.tpl` is missing → Recommend: `bash scripts\u002Fgenerate_helpers.sh \u003Cchart>`\n- If `.helmignore` is missing → Recommend: Copy from `assets\u002F.helmignore`\n- If `values.schema.json` is missing → Recommend: Copy and customize from `assets\u002Fvalues.schema.json`\n- If `NOTES.txt` is missing → Recommend: Create post-install notes template\n- If `README.md` is missing → Recommend: Create chart documentation\n\n#### Step 6: Final Summary\n\nProvide a final summary:\n```\n## Validation Summary\n\n**Chart:** \u003Cchart-name>\n**Status:** ⚠️ Warnings Found (or ✅ Ready for Deployment)\n\n**Issues Found:**\n- Errors: X\n- Warnings: Y\n- Info: Z\n\n**Proposed Changes:** N changes recommended\n\n**Next Steps:**\n1. Review proposed changes above\n2. Apply changes manually or use helm-generator skill\n3. Re-run validation to confirm fixes\n```\n\n## Workflow Done Criteria\n\nValidation is complete only when all of the following are true:\n- A Stage 1 to Stage 10 status table is present with `✅ Passed`, `⚠️ Warning`, `❌ Failed`, or `⏭️ Skipped` for each stage.\n- Every skipped stage includes a concrete tool or environment reason.\n- Stage 7 and Stage 8 are evaluated against their explicit success criteria above.\n- Severity totals are reported (`Errors`, `Warnings`, `Info`) with proposed remediation actions.\n- Role boundary is respected: no file edits unless explicitly requested by the user.\n\n## Helm Templating Automation & Best Practices\n\nThis section covers advanced Helm templating techniques, helper functions, and automation strategies.\n\n### Template Helpers (`_helpers.tpl`)\n\nTemplate helpers are reusable functions defined in `templates\u002F_helpers.tpl`. They promote DRY principles and consistency.\n\n**Standard helper patterns:**\n\n1. **Chart name helper:**\n```yaml\n{{\u002F*\nExpand the name of the chart.\n*\u002F}}\n{{- define \"mychart.name\" -}}\n{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n```\n\n2. **Fullname helper:**\n```yaml\n{{\u002F*\nCreate a default fully qualified app name.\n*\u002F}}\n{{- define \"mychart.fullname\" -}}\n{{- if .Values.fullnameOverride }}\n{{- .Values.fullnameOverride | trunc 63 | trimSuffix \"-\" }}\n{{- else }}\n{{- $name := default .Chart.Name .Values.nameOverride }}\n{{- if contains $name .Release.Name }}\n{{- .Release.Name | trunc 63 | trimSuffix \"-\" }}\n{{- else }}\n{{- printf \"%s-%s\" .Release.Name $name | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n{{- end }}\n{{- end }}\n```\n\n3. **Chart reference helper:**\n```yaml\n{{\u002F*\nCreate chart name and version as used by the chart label.\n*\u002F}}\n{{- define \"mychart.chart\" -}}\n{{- printf \"%s-%s\" .Chart.Name .Chart.Version | replace \"+\" \"_\" | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n```\n\n4. **Standard labels helper:**\n```yaml\n{{\u002F*\nCommon labels\n*\u002F}}\n{{- define \"mychart.labels\" -}}\nhelm.sh\u002Fchart: {{ include \"mychart.chart\" . }}\n{{ include \"mychart.selectorLabels\" . }}\n{{- if .Chart.AppVersion }}\napp.kubernetes.io\u002Fversion: {{ .Chart.AppVersion | quote }}\n{{- end }}\napp.kubernetes.io\u002Fmanaged-by: {{ .Release.Service }}\n{{- end }}\n```\n\n5. **Selector labels helper:**\n```yaml\n{{\u002F*\nSelector labels\n*\u002F}}\n{{- define \"mychart.selectorLabels\" -}}\napp.kubernetes.io\u002Fname: {{ include \"mychart.name\" . }}\napp.kubernetes.io\u002Finstance: {{ .Release.Name }}\n{{- end }}\n```\n\n6. **ServiceAccount name helper:**\n```yaml\n{{\u002F*\nCreate the name of the service account to use\n*\u002F}}\n{{- define \"mychart.serviceAccountName\" -}}\n{{- if .Values.serviceAccount.create }}\n{{- default (include \"mychart.fullname\" .) .Values.serviceAccount.name }}\n{{- else }}\n{{- default \"default\" .Values.serviceAccount.name }}\n{{- end }}\n{{- end }}\n```\n\n**When to create helpers:**\n- Values used in multiple templates\n- Complex logic that's repeated\n- Label sets that should be consistent\n- Name generation patterns\n- Conditional resource inclusion\n\n### Essential Template Functions\n\nReference and use these Helm template functions for robust charts:\n\n1. **`required` - Enforce required values:**\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: {{ required \"A valid service name is required!\" .Values.service.name }}\n```\n\n2. **`default` - Provide fallback values:**\n```yaml\nreplicas: {{ .Values.replicaCount | default 1 }}\n```\n\n3. **`quote` - Safely quote string values:**\n```yaml\nenv:\n  - name: DATABASE_HOST\n    value: {{ .Values.database.host | quote }}\n```\n\n4. **`include` - Use helpers with pipeline:**\n```yaml\nmetadata:\n  labels:\n    {{- include \"mychart.labels\" . | nindent 4 }}\n```\n\n5. **`tpl` - Render strings as templates:**\n```yaml\n{{- tpl .Values.customConfig . }}\n```\n\n6. **`toYaml` - Convert objects to YAML:**\n```yaml\n{{- with .Values.resources }}\nresources:\n  {{- toYaml . | nindent 2 }}\n{{- end }}\n```\n\n7. **`fromYaml` - Parse YAML strings:**\n```yaml\n{{- $config := .Values.configYaml | fromYaml }}\n```\n\n8. **`merge` - Merge maps:**\n```yaml\n{{- $merged := merge .Values.override .Values.defaults }}\n```\n\n9. **`lookup` - Query cluster resources (use carefully):**\n```yaml\n{{- $secret := lookup \"v1\" \"Secret\" .Release.Namespace \"my-secret\" }}\n{{- if $secret }}\n  # Secret exists, use it\n{{- else }}\n  # Create new secret\n{{- end }}\n```\n\n### Advanced Template Patterns\n\n1. **Conditional resource creation:**\n```yaml\n{{- if .Values.ingress.enabled -}}\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\n# ... ingress definition\n{{- end }}\n```\n\n2. **Range over lists:**\n```yaml\n{{- range .Values.extraEnvVars }}\n- name: {{ .name }}\n  value: {{ .value | quote }}\n{{- end }}\n```\n\n3. **Range over maps:**\n```yaml\n{{- range $key, $value := .Values.configMap }}\n{{ $key }}: {{ $value | quote }}\n{{- end }}\n```\n\n4. **With blocks for scoping:**\n```yaml\n{{- with .Values.nodeSelector }}\nnodeSelector:\n  {{- toYaml . | nindent 2 }}\n{{- end }}\n```\n\n5. **Named templates with custom context:**\n```yaml\n{{- include \"mychart.container\" (dict \"root\" . \"container\" .Values.mainContainer) }}\n```\n\n### Values Structure Best Practices\n\n**Prefer flat structures when possible:**\n\n```yaml\n# Good - Flat structure\nserverName: nginx\nserverPort: 80\n\n# Acceptable - Nested structure for related settings\nserver:\n  name: nginx\n  port: 80\n  replicas: 3\n```\n\n**Always provide defaults in values.yaml:**\n```yaml\nreplicaCount: 1\n\nimage:\n  repository: nginx\n  pullPolicy: IfNotPresent\n  tag: \"1.21.0\"\n\nservice:\n  type: ClusterIP\n  port: 80\n\nresources:\n  limits:\n    cpu: 100m\n    memory: 128Mi\n  requests:\n    cpu: 100m\n    memory: 128Mi\n```\n\n**Document all values:**\n```yaml\n# replicaCount is the number of pod replicas for the deployment\nreplicaCount: 1\n\n# image configures the container image\nimage:\n  # image.repository is the container image registry and name\n  repository: nginx\n  # image.tag overrides the image tag (default is chart appVersion)\n  tag: \"1.21.0\"\n```\n\n### Template Comments and Documentation\n\nUse Helm template comments for documentation:\n\n```yaml\n{{- \u002F*\nmychart.fullname generates the fullname for resources.\nIt supports nameOverride and fullnameOverride values.\nUsage: {{ include \"mychart.fullname\" . }}\n*\u002F -}}\n{{- define \"mychart.fullname\" -}}\n{{- if .Values.fullnameOverride }}\n{{- .Values.fullnameOverride | trunc 63 | trimSuffix \"-\" }}\n{{- else }}\n{{- printf \"%s-%s\" .Release.Name .Chart.Name | trunc 63 | trimSuffix \"-\" }}\n{{- end }}\n{{- end }}\n```\n\nUse YAML comments for user-facing notes:\n\n```yaml\n# WARNING: Changing the storage class will not migrate existing data\nstorageClass: \"standard\"\n```\n\n### Whitespace Management\n\nUse `-` to chomp whitespace in template directives:\n\n```yaml\n{{- if .Values.enabled }}\n  # Remove leading whitespace\n{{- end }}\n\n{{ .Values.name -}}\n  # Remove trailing whitespace\n```\n\nGood formatting:\n```yaml\n{{- if .Values.enabled }}\n  key: value\n{{- end }}\n```\n\nBad formatting:\n```yaml\n{{if .Values.enabled}}\nkey: value\n{{end}}\n```\n\n## Helper Patterns Reference\n\nWhen analyzing charts, identify opportunities for helper functions:\n\n1. **Identify repetition:**\n   - Same label sets across resources\n   - Repeated name generation logic\n   - Common conditional patterns\n\n2. **Common helper patterns to recommend:**\n   - Chart name helper (`.name`)\n   - Fullname helper (`.fullname`)\n   - Chart version label (`.chart`)\n   - Common labels (`.labels`)\n   - Selector labels (`.selectorLabels`)\n   - ServiceAccount name (`.serviceAccountName`)\n\n3. **When to recommend helpers:**\n   - Missing `_helpers.tpl` file\n   - Repeated code patterns across templates\n   - Inconsistent label usage\n   - Long resource names that need truncation\n\n## Best Practices Reference\n\nFor detailed Helm and Kubernetes best practices, load the references:\n\n```\nRead references\u002Fhelm_best_practices.md\nRead references\u002Fk8s_best_practices.md\n```\n\nThese references include:\n- Chart structure and metadata\n- Template conventions and patterns\n- Values file organization\n- Security best practices\n- Resource limits and requests\n- Common validation issues and fixes\n\n**When to load:** When validation reveals issues that need context, when implementing new features, or when the user asks about best practices.\n\n## Working with Chart Dependencies\n\nWhen a chart has dependencies (in `Chart.yaml` or `charts\u002F` directory):\n\n1. **Update dependencies:**\n```bash\nhelm dependency update \u003Cchart-directory>\n```\n\n2. **List dependencies:**\n```bash\nhelm dependency list \u003Cchart-directory>\n```\n\n3. **Validate dependencies:**\n   - Check that dependency versions are available\n   - Verify dependency values are properly scoped\n   - Test templates with dependency resources\n\n4. **Override dependency values:**\n```yaml\n# values.yaml\npostgresql:\n  enabled: true\n  postgresqlPassword: \"secret\"\n  persistence:\n    size: 10Gi\n```\n\n## Error Handling Strategies\n\n### Tool Not Available\n- Run `scripts\u002Fsetup_tools.sh` to check availability\n- Provide installation instructions\n- Skip optional stages but document what was skipped\n- Continue with available tools\n\n### Template Rendering Errors\n- Show the specific template file and line number\n- Check if values are defined in values.yaml\n- Verify template function syntax\n- Test with simpler value combinations\n- Use `--debug` flag for detailed error messages\n\n### Cluster Access Issues\n- Fall back to client-side validation\n- Use rendered templates with kubectl\n- Skip cluster validation if no kubectl config\n- Document limitations in validation report\n\n### CRD Documentation Not Found\n- Document that documentation lookup failed\n- Attempt validation with kubeconform CRD schemas\n- Suggest manual CRD inspection:\n  ```bash\n  kubectl get crd \u003Ccrd-name>.group -o yaml\n  kubectl explain \u003Ckind>\n  ```\n\n### Validation Stage Failures\n- Continue to next stage even if one fails\n- Collect all errors before presenting to user\n- Prioritize fixing Helm lint errors first\n- Then fix template errors\n- Finally fix schema\u002Fvalidation errors\n\n### macOS Extended Attributes Issue\n\n**Symptom:** Helm reports \"Chart.yaml file is missing\" even though the file exists and is readable.\n\n**Cause:** On macOS, files created programmatically (via Write tool, scripts, or certain editors) may have extended attributes (e.g., `com.apple.provenance`, `com.apple.quarantine`) that interfere with Helm's file detection.\n\n**Diagnosis:**\n```bash\n# Check for extended attributes\nxattr \u002Fpath\u002Fto\u002Fchart\u002FChart.yaml\n\n# If attributes are present, you'll see output like:\n# com.apple.provenance\n# com.apple.quarantine\n```\n\n**Solutions:**\n\n1. **Remove extended attributes:**\n   ```bash\n   # Remove all extended attributes from a file\n   xattr -c \u002Fpath\u002Fto\u002Fchart\u002FChart.yaml\n\n   # Remove all extended attributes recursively from chart directory\n   xattr -cr \u002Fpath\u002Fto\u002Fchart\u002F\n   ```\n\n2. **Create files using shell commands instead:**\n   ```bash\n   # Use cat with heredoc instead of direct file writes\n   cat > Chart.yaml \u003C\u003C 'EOF'\n   apiVersion: v2\n   name: mychart\n   version: 0.1.0\n   EOF\n   ```\n\n3. **Copy from helm-created chart:**\n   ```bash\n   # Create a fresh chart and copy structure\n   helm create temp-chart\n   cp -r temp-chart\u002F* \u002Fpath\u002Fto\u002Fyour\u002Fchart\u002F\n   rm -rf temp-chart\n   ```\n\n**Prevention:** When creating new chart files on macOS, prefer using `helm create` as a base or use shell heredocs (`cat > file \u003C\u003C 'EOF'`) rather than direct file creation tools.\n\n## Communication Guidelines\n\nWhen presenting validation results and fixes:\n\n1. **Be clear and concise** about what was found\n2. **Explain why issues matter** (e.g., \"This will cause pod creation to fail\")\n3. **Provide context** from Helm best practices when relevant\n4. **Group related issues** (e.g., all missing helper issues together)\n5. **Use file:line references** when available\n6. **Show confidence level** for auto-fixes (high confidence = syntax, low = logic changes)\n7. **Always provide a summary after proposing fixes** (and after applying fixes when explicitly requested) including:\n   - What was changed and why\n   - File and line references for each fix\n   - Total count of issues resolved\n   - Final validation status\n   - Any remaining warnings or recommendations\n\n## Version Awareness\n\nAlways consider Kubernetes and Helm version compatibility:\n- Check for deprecated Kubernetes APIs\n- Ensure Helm chart apiVersion is v2 (for Helm 3+)\n- For CRDs, ensure the apiVersion matches what's in the cluster\n- Use `kubectl api-versions` to list available API versions\n- Reference version-specific documentation when available\n- Set `kubeVersion` constraint in Chart.yaml if needed\n\n## Chart Testing\n\nFor comprehensive testing, use Helm test resources:\n\n1. **Create test resources:**\n```yaml\n# templates\u002Ftests\u002Ftest-connection.yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: \"{{ include \"mychart.fullname\" . }}-test-connection\"\n  annotations:\n    \"helm.sh\u002Fhook\": test\nspec:\n  containers:\n    - name: wget\n      image: busybox\n      command: ['wget']\n      args: ['{{ include \"mychart.fullname\" . }}:{{ .Values.service.port }}']\n  restartPolicy: Never\n```\n\n2. **Run tests:**\n```bash\nhelm test \u003Crelease-name>\n```\n\n## Automation Opportunities Reference\n\n**During Stage 10 (Final Report), list all detected automation opportunities in the summary.**\n\n**Do NOT ask user questions or modify files. Simply list recommendations.**\n\n**Automation opportunities to detect and list:**\n\n| Missing Item | Recommendation |\n|--------------|----------------|\n| `_helpers.tpl` | Run: `bash scripts\u002Fgenerate_helpers.sh \u003Cchart>` |\n| `.helmignore` | Copy from: `assets\u002F.helmignore` |\n| `values.schema.json` | Copy and customize from: `assets\u002Fvalues.schema.json` |\n| `NOTES.txt` | Create post-install notes template |\n| `README.md` | Create chart documentation |\n| Repeated patterns | Extract to helper functions |\n\n**Security recommendations to include when issues found:**\n\n| Issue | Recommendation |\n|-------|----------------|\n| Missing pod securityContext | Add `runAsNonRoot: true`, `runAsUser: 1000`, `fsGroup: 2000` |\n| Missing container securityContext | Add `allowPrivilegeEscalation: false`, `readOnlyRootFilesystem: true`, `capabilities.drop: [ALL]` |\n| Missing resource limits | Add CPU\u002Fmemory limits and requests |\n| Using `:latest` tag | Pin to specific image version |\n| Missing probes | Add liveness and readiness probes |\n\n**Template improvement recommendations:**\n\n| Issue | Recommendation |\n|-------|----------------|\n| Using `template` instead of `include` | Replace with `include` for pipeline support |\n| Missing `nindent` | Add `nindent` for proper YAML indentation |\n| No default values | Add `default` function for optional values |\n| Missing `required` function | Add `required` for critical values |\n\n## Resources\n\n### scripts\u002F\n\n**setup_tools.sh**\n- Checks for required validation tools (helm, yamllint, kubeconform, kubectl)\n- Provides installation instructions for missing tools\n- Verifies versions of installed tools\n- Usage: `bash scripts\u002Fsetup_tools.sh`\n\n**validate_chart_structure.sh**\n- Validates Helm chart directory structure\n- Checks for required files (Chart.yaml, values.yaml, templates\u002F)\n- Verifies file formats and syntax\n- Usage: `bash scripts\u002Fvalidate_chart_structure.sh \u003Cchart-directory>`\n\n**detect_crd_wrapper.sh**\n- Wrapper script that handles Python dependency management\n- Automatically creates temporary venv if PyYAML is not available\n- Calls detect_crd.py to parse YAML files\n- Usage: `bash scripts\u002Fdetect_crd_wrapper.sh \u003Cfile.yaml> [file2.yaml ...]`\n\n**detect_crd.py**\n- Parses YAML files to identify Custom Resource Definitions\n- Extracts kind, apiVersion, group, and version information\n- Outputs JSON for programmatic processing\n- Requires PyYAML (handled automatically by wrapper script)\n- Can be called directly: `python3 scripts\u002Fdetect_crd.py \u003Cfile.yaml> [file2.yaml ...]`\n\n**generate_helpers.sh**\n- Generates standard Helm helpers (_helpers.tpl) for a chart\n- Creates fullname, labels, and selector helpers\n- Usage: `bash scripts\u002Fgenerate_helpers.sh \u003Cchart-directory>`\n\n### references\u002F\n\n**helm_best_practices.md**\n- Comprehensive guide to Helm chart best practices\n- Covers template patterns, helper functions, values structure\n- Common validation issues and how to fix them\n- Security and performance recommendations\n- Load when providing context for Helm-specific issues\n\n**k8s_best_practices.md**\n- Comprehensive guide to Kubernetes YAML best practices\n- Covers metadata, labels, resource limits, security context\n- Common validation issues and how to fix them\n- Load when providing context for Kubernetes-specific issues\n\n**template_functions.md**\n- Reference guide for Helm template functions\n- Examples of all built-in functions\n- Sprig function library reference\n- Custom function patterns\n- Load when implementing complex templates\n\n### assets\u002F\n\n**.helmignore**\n- Standard .helmignore file for excluding files from packaging\n- Pre-configured with common patterns\n\n**.yamllint**\n- Pre-configured yamllint rules for Kubernetes YAML\n- Follows Kubernetes conventions (2-space indentation, line length, etc.)\n- Can be customized per project\n- Usage: `yamllint -c assets\u002F.yamllint \u003Cfile.yaml>`\n\n**values.schema.json**\n- Example JSON Schema for values validation\n- Can be copied and customized for specific charts\n- Provides type safety and validation\n",{"name":5,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fdevops\u002Fhelm-validator",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill helm-validator",{"tool":51,"command":52},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill helm-validator",{"tool":54,"command":55},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill helm-validator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002FSKILL.md",true,[59,65,71,75,79,85,89,93,99,103,107,111,115,119,123,127,131,135,138,142,146,150,154,158,161,165,169,173,177,181],{"path":60,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":64},".gitignore","OTHER","其他",304,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002F.gitignore",{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"assets\u002F.helmignore","ASSET","资产文件",796,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fassets\u002F.helmignore",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002F.yamllint",1241,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fassets\u002F.yamllint",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"assets\u002Fvalues.schema.json",10633,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fassets\u002Fvalues.schema.json",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fhelm_best_practices.md","REFERENCE","参考文档",15571,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Freferences\u002Fhelm_best_practices.md",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fk8s_best_practices.md",19858,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Freferences\u002Fk8s_best_practices.md",{"path":90,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Ftemplate_functions.md",21038,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Freferences\u002Ftemplate_functions.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fdetect_crd_wrapper.sh","SCRIPT","脚本",1524,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fscripts\u002Fdetect_crd_wrapper.sh",{"path":100,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fdetect_crd.py",5379,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fscripts\u002Fdetect_crd.py",{"path":104,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fgenerate_helpers.sh",5427,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fscripts\u002Fgenerate_helpers.sh",{"path":108,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fsetup_tools.sh",5040,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fscripts\u002Fsetup_tools.sh",{"path":112,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Fvalidate_chart_structure.sh",9779,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Fscripts\u002Fvalidate_chart_structure.sh",{"path":116,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":117,"sourceHtmlUrl":118},"test\u002Ftest_regression.sh",4871,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest_regression.sh",{"path":120,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":121,"sourceHtmlUrl":122},"test\u002Ftest_stage9_workload.sh",2768,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest_stage9_workload.sh",{"path":124,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":125,"sourceHtmlUrl":126},"test\u002Ftest-crd-chart\u002F.helmignore",360,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002F.helmignore",{"path":128,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":129,"sourceHtmlUrl":130},"test\u002Ftest-crd-chart\u002FChart.yaml",125,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002FChart.yaml",{"path":132,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":133,"sourceHtmlUrl":134},"test\u002Ftest-crd-chart\u002FREADME.md",1852,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002FREADME.md",{"path":136,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":133,"sourceHtmlUrl":137},"test\u002Ftest-crd-chart\u002Ftemplates\u002F_helpers.tpl","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002Ftemplates\u002F_helpers.tpl",{"path":139,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":140,"sourceHtmlUrl":141},"test\u002Ftest-crd-chart\u002Ftemplates\u002Fcertificate.yaml",347,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002Ftemplates\u002Fcertificate.yaml",{"path":143,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":144,"sourceHtmlUrl":145},"test\u002Ftest-crd-chart\u002Ftemplates\u002FNOTES.txt",1073,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002Ftemplates\u002FNOTES.txt",{"path":147,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":148,"sourceHtmlUrl":149},"test\u002Ftest-crd-chart\u002Ftemplates\u002Fservicemonitor.yaml",271,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002Ftemplates\u002Fservicemonitor.yaml",{"path":151,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":152,"sourceHtmlUrl":153},"test\u002Ftest-crd-chart\u002Fvalues.yaml",107,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-crd-chart\u002Fvalues.yaml",{"path":155,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":156,"sourceHtmlUrl":157},"test\u002Ftest-workload-chart\u002F.helmignore",361,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002F.helmignore",{"path":159,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":125,"sourceHtmlUrl":160},"test\u002Ftest-workload-chart\u002FChart.yaml","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002FChart.yaml",{"path":162,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":163,"sourceHtmlUrl":164},"test\u002Ftest-workload-chart\u002FREADME.md",3720,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002FREADME.md",{"path":166,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":167,"sourceHtmlUrl":168},"test\u002Ftest-workload-chart\u002Ftemplates\u002F_helpers.tpl",1576,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002Ftemplates\u002F_helpers.tpl",{"path":170,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":171,"sourceHtmlUrl":172},"test\u002Ftest-workload-chart\u002Ftemplates\u002Fdeployment.yaml",902,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002Ftemplates\u002Fdeployment.yaml",{"path":174,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":175,"sourceHtmlUrl":176},"test\u002Ftest-workload-chart\u002Ftemplates\u002FNOTES.txt",699,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002Ftemplates\u002FNOTES.txt",{"path":178,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":179,"sourceHtmlUrl":180},"test\u002Ftest-workload-chart\u002Fvalues-pinned-tag.yaml",23,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002Fvalues-pinned-tag.yaml",{"path":182,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":183,"sourceHtmlUrl":184},"test\u002Ftest-workload-chart\u002Fvalues.yaml",499,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fhelm-validator\u002Ftest\u002Ftest-workload-chart\u002Fvalues.yaml",[186,210,225,240,253,266],{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":203,"publishedAt":33},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[192,195,198],{"categoryNo":193,"categoryName":194,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":196,"categoryName":197,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":199,"categoryName":200,"taxonomyType":201,"taxonomyTypeDesc":202},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[204,205,206,207,208,209],"writing skills","writing","use","editing","work","deployment",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":218,"publishedAt":33},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[216,217],{"categoryNo":196,"categoryName":197,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":199,"categoryName":200,"taxonomyType":201,"taxonomyTypeDesc":202},[219,220,205,221,222,206,223,224],"plans","writing plans","requirements","task","code","spec",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":233,"publishedAt":33},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[231,232],{"categoryNo":196,"categoryName":197,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":199,"categoryName":200,"taxonomyType":201,"taxonomyTypeDesc":202},[234,235,236,237,238,239,205],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":246,"publishedAt":33},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[242,247,248,249,250,251,252],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":259,"publishedAt":33},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[260,261,262,263,223,264,265],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":267,"name":268,"nameZh":6,"description":269,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":270,"categories":271,"keywords":272,"publishedAt":33},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[273,261,274,208,206,275,276,277],"verification before completion","commands","evidence","claim","complete"]