[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6XD3AMHXTNJ26KTP696FZAF":3,"skill-same:01M6XD3AMHXTNJ26KTP696FZAF":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":14,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":56,"updatedAt":57,"install":58,"resources":70},"01M6XD3AMHXTNJ26KTP696FZAF","flyctl",null,"Explicit-invocation Fly.io operations wrapper. Run `\u002Fflyctl \u003Csubcommand>` to deploy (with --image), tail logs, manage secrets, inspect machines, scale, SSH, proxy, check health, list releases, and show status. Auto-discovers the app from fly.toml in the current directory. Side-effectful ops on prod-flavored apps require typed confirmation matching the app name. Rollback is delegated to \u002Frollback-prod; cross-provider SHA reporting is delegated to \u002Fdeploy-status. Unlisted subcommands require `flyctl \u003Csubcommand> --help` first.","kaiohenricunha\u002Fdotbabel","kaiohenricunha","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F69804490?v=4","01M6XCZD37W0KPCDGEA40Y610V","Kaio Cunha","01M6XCZD7SX714D114H3ZPNW09",0,"MIT","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[5,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"list","inspect","apps","io","app","show","releases","Wrapper","auto","image","confirmation","fly","secrets","reporting","logs","proxy","run","status","directory","2026-11-10 10:12:30",false,"---\n# dotbabel:generated projection=sha256:36eaf631caa59d4e8e2318a11f224a25d9571863f43d59d4c27720d1917c4d37 source=skills\u002Fflyctl\u002FSKILL.md — do not edit directly\nargument-hint: \u003Csubcommand> [-a \u003Capp>] [--no-confirm] [...]\ndescription: |\n Explicit-invocation Fly.io operations wrapper. Run `\u002Fflyctl \u003Csubcommand>` to deploy (with --image), tail logs, manage secrets, inspect machines, scale, SSH, proxy, check health, list releases, and show status. Auto-discovers the app from fly.toml in the current directory. Side-effectful ops on prod-flavored apps require typed confirmation matching the app name. Rollback is delegated to \u002Frollback-prod; cross-provider SHA reporting is delegated to \u002Fdeploy-status. Unlisted subcommands require `flyctl \u003Csubcommand> --help` first.\ndisable-model-invocation: true\nname: flyctl\nuser-invocable: true\n---\n\n# flyctl\n\nPortable Fly.io operations wrapper. Invoke as `\u002Fflyctl \u003Csubcommand>`.\n\n## When to Use\n\nThis skill is **explicit-invocation only** (`disable-model-invocation: true`).\nThe operator must type `\u002Fflyctl \u003Csubcommand>` directly; the model must not\nauto-route phrases like \"tail fly logs\" or \"fly deploy\" to this side-effectful\nskill.\n\nUse `\u002Fflyctl` from a Fly.io app directory containing `fly.toml`, or pass\n`-a \u003Capp>` to override auto-discovery.\n\n## Out of Scope\n\nThis skill does **not** perform rollback or cross-provider release reporting.\n\n- For rollback to the previous release, use `\u002Frollback-prod`.\n- For deployed git-SHA reporting across Vercel\u002FFly\u002FAWS, use `\u002Fdeploy-status`.\n- For app provisioning (`fly launch`, region setup), use the Fly UI or your IaC layer.\n- For any subcommand not listed in the table or reference files, run\n `flyctl \u003Csubcommand> --help` for canonical reference. Read-only verbs (list,\n show, status, info, history, version) may proceed without confirmation;\n mutating verbs (create, destroy, delete, scale, restart, update, set, unset,\n deploy, suspend, resume, regions add\u002Fremove, and any verb whose `--help` text\n mentions \"destructive\", \"irreversible\", or \"will redeploy\") MUST be presented\n to the operator with the exact command and require explicit y\u002FN approval before\n executing.\n\n## Auto-Discovery\n\nEvery subcommand begins by resolving the CLI binary and the target app. The\noperator may override the app with `-a \u003Capp>`; otherwise the skill reads the\nroot `fly.toml` in the current working directory. Multi-app monorepos require\nthe operator to `cd` into the per-app directory first — this skill refuses to\nguess across nested `fly.toml` files.\n\n```bash\n# CLI: prefer flyctl, fall back to fly\nFLY=\"$(command -v flyctl || command -v fly || true)\"\nif [ -z \"$FLY\" ]; then\n echo \"flyctl\u002Ffly not on PATH; see https:\u002F\u002Ffly.io\u002Fdocs\u002Fflyctl\u002Finstall\u002F\" >&2\n exit 2\nfi\n\n# App: -a flag wins; otherwise parse root fly.toml only.\n# Mirrors parseFlyApp() in deploy-ops.mjs — supports leading whitespace\n# around the key, optional whitespace around '=', and BOTH double- and\n# single-quoted values.\nAPP=\"${ARG_APP:-}\"\nif [ -z \"$APP\" ]; then\n if [ ! -f fly.toml ]; then\n echo \"no fly.toml in $(pwd); pass -a \u003Capp> or cd into the app directory\" >&2\n exit 2\n fi\n APP=\"$(sed -nE \"s\u002F^[[:space:]]*app[[:space:]]*=[[:space:]]*['\\\"]([^'\\\"]+)['\\\"].*\u002F\\1\u002Fp\" fly.toml | head -n 1)\"\nfi\n[ -z \"$APP\" ] && { echo \"could not resolve app name from fly.toml; pass -a \u003Capp>\" >&2; exit 2; }\n\n# Auth: existing CLI session only — never prompt\n\"$FLY\" auth whoami >\u002Fdev\u002Fnull 2>&1 \\\n || { echo \"not authenticated; run: $FLY auth login\" >&2; exit 2; }\n```\n\n## Subcommands\n\n| Sub | Args | Invocation | Confirm? | Reference |\n| ----------------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | --------------------------------------- |\n| `status` | `[-a $APP]` | `flyctl status -a $APP` | no | – |\n| `logs` | `[-a $APP] [-i ID] [--region R]` | `flyctl logs -a $APP $EXTRA` | no | [`logs.md`](references\u002Flogs.md) |\n| `releases` | `[-a $APP] [--image]` | `flyctl releases -a $APP --json` | no | [`releases.md`](references\u002Freleases.md) |\n| `deploy` | `[-a $APP] [--image REF] [--strategy S]` | `flyctl deploy -a $APP --image $REF` | **YES if prod** | [`deploy.md`](references\u002Fdeploy.md) |\n| `secrets list` | `[-a $APP]` | `flyctl secrets list -a $APP` | no | [`secrets.md`](references\u002Fsecrets.md) |\n| `secrets set` | `[-a $APP] [--stage] K=V...` | `flyctl secrets set -a $APP $KV` | **YES if prod** | [`secrets.md`](references\u002Fsecrets.md) |\n| `secrets unset` | `[-a $APP] K...` | `flyctl secrets unset -a $APP $K` | **YES if prod** | [`secrets.md`](references\u002Fsecrets.md) |\n| `machines list` | `[-a $APP]` | `flyctl machines list -a $APP --json` | no | [`machines.md`](references\u002Fmachines.md) |\n| `machines restart \u003Cid>` | `[-a $APP]` | `flyctl machines restart $ID -a $APP` | no | [`machines.md`](references\u002Fmachines.md) |\n| `machines stop \u003Cid>` | `[-a $APP]` | `flyctl machines stop $ID -a $APP` | **YES if prod** | [`machines.md`](references\u002Fmachines.md) |\n| `machines start \u003Cid>` | `[-a $APP]` | `flyctl machines start $ID -a $APP` | no | [`machines.md`](references\u002Fmachines.md) |\n| `machines destroy \u003Cid>` | `[-a $APP]` | `flyctl machines destroy $ID --force -a $APP` | **YES if prod** | [`machines.md`](references\u002Fmachines.md) |\n| `scale show` | `[-a $APP]` | `flyctl scale show -a $APP` | no | [`scale.md`](references\u002Fscale.md) |\n| `scale count \u003Cn>` | `[-a $APP]` | `flyctl scale count $N -a $APP` | **YES if prod or n=0** | [`scale.md`](references\u002Fscale.md) |\n| `scale vm \u003Cpreset>` | `[-a $APP] [--memory MB]` | `flyctl scale vm $P -a $APP` | **YES if prod** | [`scale.md`](references\u002Fscale.md) |\n| `scale memory \u003Cmb>` | `[-a $APP]` | `flyctl scale memory $MB -a $APP` | **YES if prod** | [`scale.md`](references\u002Fscale.md) |\n| `ssh console` | `[-a $APP] [-s ID]` | `flyctl ssh console -a $APP` | no (interactive) | [`ssh.md`](references\u002Fssh.md) |\n| `ssh console -C \u003Ccmd>` | `[-a $APP] [-s ID]` | `flyctl ssh console -C \"$CMD\" -a $APP` | **YES if prod** | [`ssh.md`](references\u002Fssh.md) |\n| `ssh sftp` | `[-a $APP]` | `flyctl ssh sftp shell -a $APP` | no | [`ssh.md`](references\u002Fssh.md) |\n| `proxy` | `\u003Clocal:remote> [-a $APP]` | `flyctl proxy $P -a $APP` | no | [`proxy.md`](references\u002Fproxy.md) |\n| `health` | `[-a $APP] [--path P]` | discover endpoints from `fly.toml`, proxy + curl | no | [`health.md`](references\u002Fhealth.md) |\n| _any other_ | – | run `flyctl \u003Ccmd> --help`, classify the verb, **stop and prompt for explicit operator approval before executing any mutating verb** | per-op | – |\n\n## Confirmation Contract\n\nDestructive ops on prod-flavored apps require the operator to type the exact app\nname. The heuristic for \"prod-flavored\" is: app name does NOT match\n`*-staging*`, `*-preview*`, `*-pr-*`, `*-dev*`, or `*-test*`.\n\n> **Heuristic is best-effort.** App names that _contain_ these substrings but\n> are nonetheless prod (e.g. `my-developer-portal`, `payments-test-of-record`)\n> will silently skip the confirmation gate. Until v1.1 ships `confirm_always`\n> config, use `--no-confirm` deliberately for known non-prod apps with unusual\n> names, and add a comment in your runbook for prod apps that would false-match.\n\n```bash\n# no_confirm_flag MUST be derived ONLY from an explicitly parsed --no-confirm\n# flag in $@. The skill never reads any environment variable (e.g. NO_CONFIRM)\n# as a bypass — operator intent must be on the command line for each invocation.\nconfirm_if_prod() {\n local app=\"$1\" op=\"$2\" no_confirm_flag=\"$3\"\n [ \"$no_confirm_flag\" = \"1\" ] && return 0\n case \"$app\" in\n *-staging*|*-preview*|*-pr-*|*-dev*|*-test*) return 0 ;;\n esac\n printf 'About to run %s on PROD app %s.\\nType the app name to confirm: ' \"$op\" \"$app\" >&2\n read -r reply \u003C \u002Fdev\u002Ftty || { echo \"no interactive TTY; pass --no-confirm explicitly or run interactively\" >&2; exit 2; }\n [ \"$reply\" = \"$app\" ] || { echo \"confirmation failed\" >&2; exit 1; }\n}\n\n# Argument-parsing stub the skill MUST follow before calling confirm_if_prod:\nno_confirm_flag=0\nparsed=()\nfor arg in \"$@\"; do\n case \"$arg\" in\n --no-confirm) no_confirm_flag=1 ;;\n *) parsed+=(\"$arg\") ;;\n esac\ndone\nset -- \"${parsed[@]}\"\n```\n\nLighter than `\u002Frollback-prod`'s `ROLLBACK PROD` literal because deploy\u002Fscale are\nless catastrophic than rollback; typing the app name is harder to muscle-memory\nthan a fixed string and is context-aware. Confirmation bypass derives from the\nparsed CLI flag only — env vars cannot grant it.\n\n## Rules\n\n- Auto-discover `app` from root `fly.toml`; never hardcode names, regions, VM presets, or secret names.\n- Resolve CLI as `flyctl` first, `fly` second; never re-install.\n- Use existing CLI auth (`flyctl auth whoami`); never prompt for tokens.\n- Destructive ops on prod-flavored apps require typed confirmation matching the app name.\n- `--no-confirm` is honored only when passed explicitly as a deliberate operator flag; never via env, templates, or instructions that may reach automated invocations.\n- Print the exact `flyctl ...` command before executing (audit trail — terminal scrollback only, not durable).\n- Preserve flyctl native exit codes; remap only discovery\u002Fauth failures to `2`.\n- Multi-app monorepos: refuse to guess — operator must `cd` into the app dir or pass `-a \u003Capp>`.\n- Never echo secret values to chat — only names.\n- For unlisted subcommands: run `flyctl \u003Csubcommand> --help` first, classify mutability from the verb and the help text, and **require explicit operator y\u002FN approval before executing any mutating op**. Read-only verbs (`list`, `show`, `status`, `info`, `history`, `version`) may run without prompting.\n\n## Failure Modes\n\n| Condition | Exit | Behavior |\n| ---------------------------------------- | ---- | ----------------------------------------------------------------------------- |\n| Success | `0` | preserve flyctl exit |\n| Confirmation declined \u002F flyctl exit 1 | `1` | preserve |\n| No `fly.toml` in cwd and no `-a` | `2` | print: \"no fly.toml in `\u003Cpwd>`; pass -a `\u003Capp>` or cd into the app directory\" |\n| `flyctl`\u002F`fly` not on PATH | `2` | print install URL |\n| `auth whoami` fails | `2` | print `flyctl auth login` |\n| `fly.toml` exists but `app` line missing | `2` | print: \"could not resolve app name from fly.toml; pass -a `\u003Capp>`\" |\n| Invalid `--image` ref (pre-flight regex) | `2` | print expected format |\n\n## Optional Config\n\n**This file is NOT consumed by v1.0.0.** It documents the v1.1 config surface\nso contributors can preview it. Operators whose prod apps don't match\n`*-staging*` \u002F `*-preview*` \u002F `*-pr-*` \u002F `*-dev*` \u002F `*-test*` will get\ntyped-confirmation prompts on every mutating op until v1.1 wires `confirm_never`\nto override the heuristic; pass `--no-confirm` per-invocation until then.\n\nSee [`examples\u002Ffly-targets.example.json`](examples\u002Ffly-targets.example.json).\n\nPlanned v1.1 config schema (not yet wired — for preview only):\n\n| Key | Type | Semantics |\n| ----------------------- | ---------- | ------------------------------------------------------------------------------------------------ |\n| `confirm_always` | `string[]` | App names that always require typed confirmation, regardless of the prod-name heuristic. |\n| `confirm_never` | `string[]` | App names that never require typed confirmation (overrides heuristic for known non-prod apps). |\n| `deploy.strategy` | `string` | Default `--strategy` value for `flyctl deploy` (e.g. `bluegreen`). Overridable per-invocation. |\n| `deploy.require_digest` | `boolean` | If `true`, reject `--image` refs without a `@sha256:` digest suffix (enforce immutable deploys). |\n\nWhen v1.1 wires this file, it will be read via `jq` from `.claude\u002Fflyctl.json` at skill startup.\n\n## See also\n\n- [`\u002Fdeploy-status`](..\u002Fdeploy-status\u002FSKILL.md) — read-only SHA \u002F release status across all configured deploy targets (use this when you want a snapshot, not an action).\n- [`\u002Frollback-prod`](..\u002Frollback-prod\u002FSKILL.md) — confirmation-gated rollback across all targets (use this for incident response; `\u002Fflyctl` is for non-incident, fly-only ops).\n","# flyctl\n\nPortable Fly.io operations wrapper. Invoke as `\u002Fflyctl \u003Csubcommand>`.\n\n## When to Use\n\nThis skill is **explicit-invocation only** (`disable-model-invocation: true`).\nThe operator must type `\u002Fflyctl \u003Csubcommand>` directly; the model must not\nauto-route phrases like \"tail fly logs\" or \"fly deploy\" to this side-effectful\nskill.\n\nUse `\u002Fflyctl` from a Fly.io app directory containing `fly.toml`, or pass\n`-a \u003Capp>` to override auto-discovery.\n\n## Out of Scope\n\nThis skill does **not** perform rollback or cross-provider release reporting.\n\n- For rollback to the previous release, use `\u002Frollback-prod`.\n- For deployed git-SHA reporting across Vercel\u002FFly\u002FAWS, use `\u002Fdeploy-status`.\n- For app provisioning (`fly launch`, region setup), use the Fly UI or your IaC layer.\n- For any subcommand not listed in the table or reference files, run\n `flyctl \u003Csubcommand> --help` for canonical reference. Read-only verbs (list,\n show, status, info, history, version) may proceed without confirmation;\n mutating verbs (create, destroy, delete, scale, restart, update, set, unset,\n deploy, suspend, resume, regions add\u002Fremove, and any verb whose `--help` text\n mentions \"destructive\", \"irreversible\", or \"will redeploy\") MUST be presented\n to the operator with the exact command and require explicit y\u002FN approval before\n executing.\n\n## Auto-Discovery\n\nEvery subcommand begins by resolving the CLI binary and the target app. The\noperator may override the app with `-a \u003Capp>`; otherwise the skill reads the\nroot `fly.toml` in the current working directory. Multi-app monorepos require\nthe operator to `cd` into the per-app directory first — this skill refuses to\nguess across nested `fly.toml` files.\n\n```bash\n# CLI: prefer flyctl, fall back to fly\nFLY=\"$(command -v flyctl || command -v fly || true)\"\nif [ -z \"$FLY\" ]; then\n echo \"flyctl\u002Ffly not on PATH; see https:\u002F\u002Ffly.io\u002Fdocs\u002Fflyctl\u002Finstall\u002F\" >&2\n exit 2\nfi\n\n# App: -a flag wins; otherwise parse root fly.toml only.\n# Mirrors parseFlyApp() in deploy-ops.mjs — supports leading whitespace\n# around the key, optional whitespace around '=', and BOTH double- and\n# single-quoted values.\nAPP=\"${ARG_APP:-}\"\nif [ -z \"$APP\" ]; then\n if [ ! -f fly.toml ]; then\n echo \"no fly.toml in $(pwd); pass -a \u003Capp> or cd into the app directory\" >&2\n exit 2\n fi\n APP=\"$(sed -nE \"s\u002F^[[:space:]]*app[[:space:]]*=[[:space:]]*['\\\"]([^'\\\"]+)['\\\"].*\u002F\\1\u002Fp\" fly.toml | head -n 1)\"\nfi\n[ -z \"$APP\" ] && { echo \"could not resolve app name from fly.toml; pass -a \u003Capp>\" >&2; exit 2; }\n\n# Auth: existing CLI session only — never prompt\n\"$FLY\" auth whoami >\u002Fdev\u002Fnull 2>&1 \\\n || { echo \"not authenticated; run: $FLY auth login\" >&2; exit 2; }\n```\n\n## Subcommands\n\n| Sub | Args | Invocation | Confirm? | Reference |\n| ----------------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | --------------------------------------- |\n| `status` | `[-a $APP]` | `flyctl status -a $APP` | no | – |\n| `logs` | `[-a $APP] [-i ID] [--region R]` | `flyctl logs -a $APP $EXTRA` | no | [`logs.md`](references\u002Flogs.md) |\n| `releases` | `[-a $APP] [--image]` | `flyctl releases -a $APP --json` | no | [`releases.md`](references\u002Freleases.md) |\n| `deploy` | `[-a $APP] [--image REF] [--strategy S]` | `flyctl deploy -a $APP --image $REF` | **YES if prod** | [`deploy.md`](references\u002Fdeploy.md) |\n| `secrets list` | `[-a $APP]` | `flyctl secrets list -a $APP` | no | [`secrets.md`](references\u002Fsecrets.md) |\n| `secrets set` | `[-a $APP] [--stage] K=V...` | `flyctl secrets set -a $APP $KV` | **YES if prod** | [`secrets.md`](references\u002Fsecrets.md) |\n| `secrets unset` | `[-a $APP] K...` | `flyctl secrets unset -a $APP $K` | **YES if prod** | [`secrets.md`](references\u002Fsecrets.md) |\n| `machines list` | `[-a $APP]` | `flyctl machines list -a $APP --json` | no | [`machines.md`](references\u002Fmachines.md) |\n| `machines restart \u003Cid>` | `[-a $APP]` | `flyctl machines restart $ID -a $APP` | no | [`machines.md`](references\u002Fmachines.md) |\n| `machines stop \u003Cid>` | `[-a $APP]` | `flyctl machines stop $ID -a $APP` | **YES if prod** | [`machines.md`](references\u002Fmachines.md) |\n| `machines start \u003Cid>` | `[-a $APP]` | `flyctl machines start $ID -a $APP` | no | [`machines.md`](references\u002Fmachines.md) |\n| `machines destroy \u003Cid>` | `[-a $APP]` | `flyctl machines destroy $ID --force -a $APP` | **YES if prod** | [`machines.md`](references\u002Fmachines.md) |\n| `scale show` | `[-a $APP]` | `flyctl scale show -a $APP` | no | [`scale.md`](references\u002Fscale.md) |\n| `scale count \u003Cn>` | `[-a $APP]` | `flyctl scale count $N -a $APP` | **YES if prod or n=0** | [`scale.md`](references\u002Fscale.md) |\n| `scale vm \u003Cpreset>` | `[-a $APP] [--memory MB]` | `flyctl scale vm $P -a $APP` | **YES if prod** | [`scale.md`](references\u002Fscale.md) |\n| `scale memory \u003Cmb>` | `[-a $APP]` | `flyctl scale memory $MB -a $APP` | **YES if prod** | [`scale.md`](references\u002Fscale.md) |\n| `ssh console` | `[-a $APP] [-s ID]` | `flyctl ssh console -a $APP` | no (interactive) | [`ssh.md`](references\u002Fssh.md) |\n| `ssh console -C \u003Ccmd>` | `[-a $APP] [-s ID]` | `flyctl ssh console -C \"$CMD\" -a $APP` | **YES if prod** | [`ssh.md`](references\u002Fssh.md) |\n| `ssh sftp` | `[-a $APP]` | `flyctl ssh sftp shell -a $APP` | no | [`ssh.md`](references\u002Fssh.md) |\n| `proxy` | `\u003Clocal:remote> [-a $APP]` | `flyctl proxy $P -a $APP` | no | [`proxy.md`](references\u002Fproxy.md) |\n| `health` | `[-a $APP] [--path P]` | discover endpoints from `fly.toml`, proxy + curl | no | [`health.md`](references\u002Fhealth.md) |\n| _any other_ | – | run `flyctl \u003Ccmd> --help`, classify the verb, **stop and prompt for explicit operator approval before executing any mutating verb** | per-op | – |\n\n## Confirmation Contract\n\nDestructive ops on prod-flavored apps require the operator to type the exact app\nname. The heuristic for \"prod-flavored\" is: app name does NOT match\n`*-staging*`, `*-preview*`, `*-pr-*`, `*-dev*`, or `*-test*`.\n\n> **Heuristic is best-effort.** App names that _contain_ these substrings but\n> are nonetheless prod (e.g. `my-developer-portal`, `payments-test-of-record`)\n> will silently skip the confirmation gate. Until v1.1 ships `confirm_always`\n> config, use `--no-confirm` deliberately for known non-prod apps with unusual\n> names, and add a comment in your runbook for prod apps that would false-match.\n\n```bash\n# no_confirm_flag MUST be derived ONLY from an explicitly parsed --no-confirm\n# flag in $@. The skill never reads any environment variable (e.g. NO_CONFIRM)\n# as a bypass — operator intent must be on the command line for each invocation.\nconfirm_if_prod() {\n local app=\"$1\" op=\"$2\" no_confirm_flag=\"$3\"\n [ \"$no_confirm_flag\" = \"1\" ] && return 0\n case \"$app\" in\n *-staging*|*-preview*|*-pr-*|*-dev*|*-test*) return 0 ;;\n esac\n printf 'About to run %s on PROD app %s.\\nType the app name to confirm: ' \"$op\" \"$app\" >&2\n read -r reply \u003C \u002Fdev\u002Ftty || { echo \"no interactive TTY; pass --no-confirm explicitly or run interactively\" >&2; exit 2; }\n [ \"$reply\" = \"$app\" ] || { echo \"confirmation failed\" >&2; exit 1; }\n}\n\n# Argument-parsing stub the skill MUST follow before calling confirm_if_prod:\nno_confirm_flag=0\nparsed=()\nfor arg in \"$@\"; do\n case \"$arg\" in\n --no-confirm) no_confirm_flag=1 ;;\n *) parsed+=(\"$arg\") ;;\n esac\ndone\nset -- \"${parsed[@]}\"\n```\n\nLighter than `\u002Frollback-prod`'s `ROLLBACK PROD` literal because deploy\u002Fscale are\nless catastrophic than rollback; typing the app name is harder to muscle-memory\nthan a fixed string and is context-aware. Confirmation bypass derives from the\nparsed CLI flag only — env vars cannot grant it.\n\n## Rules\n\n- Auto-discover `app` from root `fly.toml`; never hardcode names, regions, VM presets, or secret names.\n- Resolve CLI as `flyctl` first, `fly` second; never re-install.\n- Use existing CLI auth (`flyctl auth whoami`); never prompt for tokens.\n- Destructive ops on prod-flavored apps require typed confirmation matching the app name.\n- `--no-confirm` is honored only when passed explicitly as a deliberate operator flag; never via env, templates, or instructions that may reach automated invocations.\n- Print the exact `flyctl ...` command before executing (audit trail — terminal scrollback only, not durable).\n- Preserve flyctl native exit codes; remap only discovery\u002Fauth failures to `2`.\n- Multi-app monorepos: refuse to guess — operator must `cd` into the app dir or pass `-a \u003Capp>`.\n- Never echo secret values to chat — only names.\n- For unlisted subcommands: run `flyctl \u003Csubcommand> --help` first, classify mutability from the verb and the help text, and **require explicit operator y\u002FN approval before executing any mutating op**. Read-only verbs (`list`, `show`, `status`, `info`, `history`, `version`) may run without prompting.\n\n## Failure Modes\n\n| Condition | Exit | Behavior |\n| ---------------------------------------- | ---- | ----------------------------------------------------------------------------- |\n| Success | `0` | preserve flyctl exit |\n| Confirmation declined \u002F flyctl exit 1 | `1` | preserve |\n| No `fly.toml` in cwd and no `-a` | `2` | print: \"no fly.toml in `\u003Cpwd>`; pass -a `\u003Capp>` or cd into the app directory\" |\n| `flyctl`\u002F`fly` not on PATH | `2` | print install URL |\n| `auth whoami` fails | `2` | print `flyctl auth login` |\n| `fly.toml` exists but `app` line missing | `2` | print: \"could not resolve app name from fly.toml; pass -a `\u003Capp>`\" |\n| Invalid `--image` ref (pre-flight regex) | `2` | print expected format |\n\n## Optional Config\n\n**This file is NOT consumed by v1.0.0.** It documents the v1.1 config surface\nso contributors can preview it. Operators whose prod apps don't match\n`*-staging*` \u002F `*-preview*` \u002F `*-pr-*` \u002F `*-dev*` \u002F `*-test*` will get\ntyped-confirmation prompts on every mutating op until v1.1 wires `confirm_never`\nto override the heuristic; pass `--no-confirm` per-invocation until then.\n\nSee [`examples\u002Ffly-targets.example.json`](examples\u002Ffly-targets.example.json).\n\nPlanned v1.1 config schema (not yet wired — for preview only):\n\n| Key | Type | Semantics |\n| ----------------------- | ---------- | ------------------------------------------------------------------------------------------------ |\n| `confirm_always` | `string[]` | App names that always require typed confirmation, regardless of the prod-name heuristic. |\n| `confirm_never` | `string[]` | App names that never require typed confirmation (overrides heuristic for known non-prod apps). |\n| `deploy.strategy` | `string` | Default `--strategy` value for `flyctl deploy` (e.g. `bluegreen`). Overridable per-invocation. |\n| `deploy.require_digest` | `boolean` | If `true`, reject `--image` refs without a `@sha256:` digest suffix (enforce immutable deploys). |\n\nWhen v1.1 wires this file, it will be read via `jq` from `.claude\u002Fflyctl.json` at skill startup.\n\n## See also\n\n- [`\u002Fdeploy-status`](..\u002Fdeploy-status\u002FSKILL.md) — read-only SHA \u002F release status across all configured deploy targets (use this when you want a snapshot, not an action).\n- [`\u002Frollback-prod`](..\u002Frollback-prod\u002FSKILL.md) — confirmation-gated rollback across all targets (use this for incident response; `\u002Fflyctl` is for non-incident, fly-only ops).\n",{"name":5,"description":48,"argument-hint":49,"user-invocable":50,"disable-model-invocation":50},"Explicit-invocation Fly.io operations wrapper. Run `\u002Fflyctl \u003Csubcommand>` to deploy (with --image), tail logs, manage secrets, inspect machines, scale, SSH, proxy, check health, list releases, and show status. Auto-discovers the app from fly.toml in the current directory. Side-effectful ops on prod-flavored apps require typed confirmation matching the app name. Rollback is delegated to \u002Frollback-prod; cross-provider SHA reporting is delegated to \u002Fdeploy-status. Unlisted subcommands require `flyctl \u003Csubcommand> --help` first.\n","\u003Csubcommand> [-a \u003Capp>] [--no-confirm] [...]",true,"main","91c337164997b99943fbcc64e8e362577b67bc81","examples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha","I'm a Platform\u002FInfra engineer who happens to work in cybersec and write Go code.","2026-10-26 14:12:51",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":50},[60,63,66],{"tool":61,"command":62},"npx","npx skills add kaiohenricunha\u002Fdotbabel --skill flyctl",{"tool":64,"command":65},"bunx","bunx skills add kaiohenricunha\u002Fdotbabel --skill flyctl",{"tool":67,"command":68},"pnpm","pnpm dlx skills add kaiohenricunha\u002Fdotbabel --skill flyctl","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002FSKILL.md",[71,77,81,85,89,93,97,101,105,109],{"path":72,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"examples\u002Ffly-targets.example.json","REFERENCE","参考文档",296,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Fexamples\u002Ffly-targets.example.json",{"path":78,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fdeploy.md",4937,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Fdeploy.md",{"path":82,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fhealth.md",3485,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Fhealth.md",{"path":86,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Flogs.md",2022,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Flogs.md",{"path":90,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fmachines.md",2802,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Fmachines.md",{"path":94,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fproxy.md",2341,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Fproxy.md",{"path":98,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Freleases.md",2521,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Freleases.md",{"path":102,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fscale.md",2935,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Fscale.md",{"path":106,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fsecrets.md",3533,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Fsecrets.md",{"path":110,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fssh.md",2315,"https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fexamples\u002Fminimal-consumer\u002F.claude\u002Fskills\u002Fflyctl\u002Freferences\u002Fssh.md",[114,144,176,197,217,240],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":125,"publishedAt":43},"01M6XDQ7QMASPFZ355MYKCD06T","yolo","Start temporary autonomy for the current task or an explicit scope with a required --for expiry. Codex permits scoped pushes, merges, deploys, and releases after strict testing and validation; Full access is a separate runtime setting. Claude Code uses a session permission hook with a protected-action denylist.","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fyolo\u002FSKILL.md",[120],{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[116,126,127,128,129,130,131,132,133,30,134,135,136,137,138,139,140,141,142,143],"testing","merge","code","start","access","session","ops","autonomy","permission","full","runtime","scope","devex","hook","true","action","for","scoped",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":156,"publishedAt":43},"01M6XDQ1N21VE4KH98JWGZ7GN9","veracity-audit","Audit a data pipeline for Veracity and Value. Dispatches data-scientist, compliance-auditor, and data-engineer agents with project context injected at dispatch time. All source paths are supplied via flags — no defaults, no project assumptions. Subcommands: audit (full pipeline walk), score-check (scoring math only), gate-check (gate coverage only), source-trace \u003Clabel> (single source end-to-end). Invoke when: \"audit pipeline\", \"veracity check\", \"scoring math correct?\", \"check gates\", \"trace source\", \"verify quality gates\", \"formula correct?\".","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fveracity-audit\u002FSKILL.md",[150,153],{"categoryNo":151,"categoryName":152,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":154,"categoryName":155,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000037","律师与法务",[157,158,126,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175],"audit","veracity audit","review","data pipeline","pipeline","Bash","math","coverage","only","engineer","formula","scoring","time","project","worker","end","at","invoke","when",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":43},"01M6XDPVDKBR376C06CEK9BC5S","validate-spec","Audit an already-implemented spec against the codebase. Walks each constraint (ARCH-N, PERF-N, KD-N, etc.) and acceptance criterion, grounds findings in file:line evidence, runs the spec.json acceptance_commands, and writes a single audit doc to docs\u002Faudits\u002F. Use whenever the user asks to \"validate a spec\", \"audit a spec\", \"check if spec is implemented\", \"verify the spec is done\", \"is this spec really done\", or otherwise wants closure on spec-driven work. Read-only against the spec — produces an audit, never modifies the spec itself.","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fvalidate-spec\u002FSKILL.md",[],[183,184,185,126,159,40,186,157,162,187,188,189,165,190,191,192,193,194,195,196],"spec","validate","validate spec","acceptance","work","read","never","max","done","arch","line","2025","spec-driven","closure",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":43},"01M6XDPMMECH82RAW553Y94HDS","terragrunt-specialist","Deep-dive Terragrunt hierarchy review, DRY pattern audits, and run-all orchestration analysis. Use for structured investigations of multi-environment Terragrunt layouts, dependency graphs, remote state config, and hook correctness. Triggers on: \"Terragrunt audit\", \"run-all review\", \"dependency block\", \"DRY pattern review\", \"env hierarchy audit\", \"mock_outputs\", \"terragrunt hooks\".","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fterragrunt-specialist\u002FSKILL.md",[203],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[205,206,207,159,208,209,40,157,210,162,188,211,212,190,213,214,194,215,173,216],"terragrunt","specialist","terragrunt specialist","orchestration","debugging","analysis","dependency","hooks","deep","dry","remote","hierarchy",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":230,"publishedAt":43},"01M6XDPFJS2HGSE13RXF1HV8S7","terraform-specialist","Deep-dive Terraform architecture review, module design, state management, and migration. Use for structured investigations of Terraform workspaces, provider configuration, module coupling, import workflows, and test coverage. Triggers on: \"Terraform audit\", \"module review\", \"state management\", \"Terraform import\", \"workspace design\", \"provider config review\", \"Terraform testing\".","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fterraform-specialist\u002FSKILL.md",[223,226,227],{"categoryNo":224,"categoryName":225,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":228,"categoryName":229,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",[231,232,206,126,233,159,234,235,236,209,157,162,188,164,237,238,213,239,194,173],"terraform","terraform specialist","design","workflows","architecture","architecture review","test coverage","workspaces","problem",{"skillNo":241,"name":183,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":249,"publishedAt":43},"01M6XDP7V6H8WYPSXVEKYE6HJ6","Create structured engineering specs through interactive pairing. Use when the user wants to create a spec, design doc, technical specification, architecture document, RFC, or engineering plan. Triggers on \"let's spec this out\", \"create a spec\", \"design doc\", \"write a technical plan\", \"plan the architecture\". Works for greenfield and brownfield projects. Outputs to docs\u002Fspecs\u002F.","https:\u002F\u002Fgithub.com\u002Fkaiohenricunha\u002Fdotbabel\u002Fblob\u002Fmain\u002Fskills\u002Fspec\u002FSKILL.md",[245,246],{"categoryNo":228,"categoryName":229,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":247,"categoryName":248,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000032","设计师",[183,233,250,235,251,252,253,254,255,256,257,258,259,260,261,142,262,263,264,265],"component","create","plan","projects","write","interactive","use","document","specification","triggers","opus","technical specification","trade-offs","technical plan","outputs","frontier"]