The 8 Best Claude Code Skills for DevOps and CI/CD in 2026

The best Claude Code skills for DevOps and CI/CD in 2026 are the ones that force an agent to prove correctness before it declares a change done — not the ones that generate YAML fastest. Infrastructure is the most expensive place to be wrong: a bad migration or a broken pipeline blocks every engineer, not one PR. This guide covers eight real, verifiable skills from the public registry, organized by DevOps job, and shows how to inspect, install, and evaluate them with BuildBetter CLI (run as bb) so a skill only ships if it earned its tokens. BuildBetter CLI is the context layer that carries these skills across every agent your team uses.

Why DevOps Is the Riskiest Place to Run an Agent

Infrastructure mistakes are the most expensive class of agent error. A broken CI pipeline stalls every merge in the repo. A migration that holds a lock or drops a column mid-deploy can take down writes for the whole product. Unlike a bad application PR, these failures don't stay contained to one branch — they cascade.

The core thesis for DevOps agent work: review gates matter more than raw generation speed. The DORA State of DevOps research has consistently found that change failure rate and time-to-restore are the metrics most sensitive to process discipline — the exact dimension a review-gate skill targets. The 2024/2025 DORA findings went further, showing that AI adoption can increase throughput while degrading delivery stability if it isn't paired with strong review and testing discipline.

So what is a "skill" here? A skill is a scoped instruction pack that extends the AGENTS.md standard — a Markdown procedure file that loads into the agent's context only when relevant, encoding a repeatable process the agent must follow. It is not a static prompt. It's a conditional, composable playbook the agent executes.

This list was built from real, verifiable skills indexed by the open-source skillrank registry, organized by the job they do rather than by author. One honest caveat we return to at the end: a skill only helps if it actually runs in the agent each teammate uses, and if you can measure whether it improved outputs. Everything below assumes you'll verify, not trust.

How to Read This List: Skills Organized by DevOps Job

Four jobs cover most of the DevOps surface where agents do real work: pipeline authoring, branch and worktree hygiene, database migrations, and release/branch-finishing flow. Each skill below is grouped under the job it serves.

Every entry gives you four things:

• Author/slug reference — the exact author/slug you'd install.
• What it does — the procedure it encodes.
• When to load it — the trigger condition that should pull it into context.
• The review gate it sits behind — the human check that must happen regardless of the skill.

Before trusting any skill, inspect it. Running skillrank show <ref> returns the security scan rating, detected stacks, and eval results for a skill. Treat every skill as untrusted code until you've read that output and the actual skill file on GitHub.

Attribution matters: these are real skills by real authors — addyosmani (Addy Osmani), wshobson (Will Shobson), and obra — all with public GitHub repos. Always read the source before installing into an infra repo.

Pipeline Authoring: Building and Fixing CI/CD

Pipeline skills are where most teams start, because CI/CD YAML is verbose, provider-specific, and easy to get subtly wrong.

Skill 1 — addyosmani/ci-cd-and-automation

This is a general-purpose pipeline authoring and automation skill. It encodes broadly applicable guidance: stage ordering, artifact handling, when to parallelize, and how to structure automation steps. Reach for it when you're setting up or refactoring a pipeline and want sane defaults regardless of provider.

Its limit is provider-specific YAML. A general skill won't know the exact idioms of GitHub Actions matrix syntax or GitLab's DAG semantics. Use it for structure and strategy, not for the last-mile provider details.

Skill 2 — wshobson/gitlab-ci-patterns

This skill encodes GitLab-specific pipeline patterns — stages, caching keys, rules: conditions, and DAG needs: dependencies. Provider specificity is a feature, not a bug: it will produce real GitLab idioms a generic skill can't. It is also dead weight for a GitHub Actions shop, so load it only if you're standardized on GitLab CI.

Review gate: pipeline changes should never merge without a dry-run or pipeline-lint pass and a human check on any secrets or permissions scope the change touches. A concrete example: prompt the agent to add a caching layer for your dependency install. A bare prompt produces plausible YAML. With gitlab-ci-patterns loaded, the agent scopes the cache key to the lockfile hash, sets the correct policy, and flags where the cache invalidates — the difference between YAML that runs and YAML that's correct.

Read the skill files yourself in the authors' public GitHub repos before adopting either.

Branch and Worktree Hygiene

Once you run more than one agent session at a time, working-directory hygiene stops being optional.

Skill 3 — obra/using-git-worktrees

Git worktrees allow multiple checked-out working trees from a single repository, so parallel agent sessions operate in isolated directories without corrupting each other's index or working state. This skill teaches the agent to spin up and tear down worktrees correctly for concurrent tasks.

Worktrees are the correct primitive for multi-agent parallelism because they isolate the working directory and index per branch. Without them, two agent sessions on one clone will clobber each other's staged state — a subtle failure that's hard to debug after the fact. As multi-agent workflows become common, this skill moves from nice-to-have to load-bearing.

Skill 4 — obra/finishing-a-development-branch

This is the disciplined close-out procedure: rebase onto the target, squash where appropriate, verify CI is green, and clean up stale branches before declaring a branch done. Finishing a branch is exactly where agents cut corners — they'll happily call a branch "complete" with a red pipeline or unmerged conflicts.

Review gate: this skill makes the close-out checklist explicit and auditable, which is the point. A human still confirms the branch actually landed clean.

These two pair naturally: using-git-worktrees keeps concurrent work isolated during development, and finishing-a-development-branch enforces a clean, verified exit when each worktree's task is done.

Database Migrations: The Highest-Stakes Change

Schema migrations are consistently among the top causes of production incidents in postmortem datasets, because they're hard to roll back and can hold locks that block writes. This is the highest-stakes change an agent can make.

Skill 5 — wshobson/database-migration

This skill encodes safe migration authoring: backward-compatible steps, the expand/contract pattern, and explicit rollback planning. The expand/contract (or parallel change) pattern splits a schema change into additive (expand), migrate, and cleanup (contract) phases across multiple deploys, so the application is never broken during rollout.

A concrete example: renaming a column. An agent left to its own devices will do the rename in one atomic migration — which breaks any running old-version pod during a rolling deploy. A good migration skill forces additive-first ordering: add the new column, backfill and dual-write, cut reads over, then drop the old column in a later deploy. The expand/contract pattern exists precisely because both agents and humans love the one-shot rename.

Skill 6 — wshobson/sql-optimization-patterns

This skill catches N+1 query patterns, missing indexes, and expensive queries before they reach production during or after a migration. It pairs with the migration skill: a migration that adds a column often needs an index to go with it, and this skill surfaces that.

Non-negotiable review gate: migrations require a named human owner, a tested rollback, and ideally a staging replay against production-scale data. No agent should ship a migration unreviewed. The honest limit: these skills encode good patterns but cannot know your data volume or lock behavior. A skill can order the steps correctly; only a human knows whether a 200-million-row backfill will hold a lock too long. Human judgment stays in the loop.

Release Flow and Review Discipline

The most valuable agent skills in DevOps are the ones that make the agent stop and prove correctness. These two bracket the entire flow.

Skill 7 — obra/requesting-code-review

This skill governs how the agent packages a change for review: it forces the agent to write out context, call out risk explicitly, and attach test evidence. The goal is reviewer efficiency — a human should be able to assess risk in minutes, not reverse-engineer intent from a diff.

Skill 8 — obra/verification-before-completion

This forces the agent to prove the change works before claiming it's done: tests pass, pipeline green, migration applies cleanly. It's the single highest-value skill on this list for infrastructure work. The DORA data on AI degrading stability without review discipline is exactly the failure this skill prevents.

These two are the review gates that turn fast generation into safe delivery. A couple of adjacents worth knowing, described but not counted: mattpocock/setup-pre-commit for local gates that fail fast before CI, and addyosmani/security-and-hardening for release-time security checks.

The recurring theme across the whole list: in infrastructure, the verification skills earn their keep more than the generation skills. Speed is cheap; a rollback at 2 a.m. is not.

Comparison Table: The 8 Skills at a Glance

Skill (author/slug)	DevOps job	When to load	Review gate required	Provider/stack specificity
Managed via BuildBetter CLI (bb skills)	All four — cross-agent skill layer	Always: carries skills into every agent + saves sessions	Enables auditable review across teammates	Portable across Claude Code, Cursor, Codex, Copilot
addyosmani/ci-cd-and-automation	Pipeline authoring	Setting up or refactoring any pipeline	Dry-run + secrets/permissions check	Broadly portable
wshobson/gitlab-ci-patterns	Pipeline authoring	Working in a GitLab CI repo	pipeline-lint + secrets check	GitLab CI only
obra/using-git-worktrees	Branch/worktree hygiene	Running parallel agent sessions	None (isolation primitive)	Broadly portable (Git)
obra/finishing-a-development-branch	Release/branch flow	Closing out any branch	Human confirm CI green + clean land	Broadly portable (Git)
wshobson/database-migration	Database migrations	Authoring any schema change	Human owner + tested rollback + staging replay	Broadly portable (SQL)
wshobson/sql-optimization-patterns	Database migrations	Reviewing queries/indexes	Human owner (paired with migration gate)	Broadly portable (SQL)
obra/requesting-code-review	Release/branch flow	Preparing any change for review	The gate itself	Broadly portable
obra/verification-before-completion	Release/branch flow	Before declaring any change done	The gate itself	Broadly portable

If you only adopt three to start: verification-before-completion (the universal safety gate), database-migration (your highest-stakes change), and one pipeline skill matched to your CI provider — gitlab-ci-patterns for GitLab shops, ci-cd-and-automation otherwise.

Installing and Evaluating These Skills with skillrank

The workflow for adopting any skill has four steps, and in DevOps you should run all four. Start with skillrank recommend, which surfaces skills matched to your repo's detected stack — so a GitHub Actions repo won't get GitLab-only suggestions.

Next, inspect. skillrank show <ref> returns the security scan rating, detected stacks, and eval results. Read it, then read the skill file on GitHub. For an infra repo, you want to know exactly what an agent will be told to do before it does it.

Then install. skillrank install <ref> performs a hash-verified install into the repo — the exact contents of the skill are cryptographically verified, so you know precisely what got added. That verification matters most for infrastructure skills, where an unexpected instruction could reach production.

Finally, evaluate before standardizing. skillrank eval <ref> runs a local paired evaluation — with-skill versus without-skill — on your own agent and your own repo. This measures whether the skill actually improved outputs before you push it to the whole team.

Why eval matters most in DevOps: token cost for context-heavy agentic runs scales roughly linearly with loaded instruction size, so a skill that loads unconditionally inflates every session's cost. And false confidence is expensive — a skill that produces confident-but-wrong migrations is worse than no skill. Measure, don't assume.

skillrank is open source, and it's also available as bb skills <command> when BuildBetter CLI is installed, folding skill management into the broader context layer.

Making Skills Work Across Agents and Teammates

A skill file is only useful if it runs in whatever agent each engineer actually uses. Your CI expert might live in Claude Code, your platform lead in Cursor, a contractor in Codex. A skill installed for one of them doesn't help the other two — and in DevOps, inconsistent behavior across engineers is its own risk.

BuildBetter CLI (run as bb) is the context layer that solves this. It's not another AI coding agent — it sits underneath the agents you already run and carries the same release conventions into every one of them. Every coding session is saved and indexed, so an in-progress pipeline change or migration is auditable afterward.

For DevOps specifically, auditable sessions are the point. bb agent-sessions resume lets a teammate pick up an in-progress migration or pipeline change on their own machine, in their own agent, with a reviewable trace of exactly what the agent did and why. When a migration goes sideways, that trace is the difference between a fast rollback and a blind one.

The skills themselves live open-source in BB-Skills on GitHub (github.com/buildbetter-app/BB-Skills) — spec-workflow commands like /bb-review, /bb-specify, and /bb-plan, plus testing and core utility packs. They extend the AGENTS.md standard with composable, conditional skills that load only when relevant, and you can adopt, extend, or contribute back with no vendor lock-in. An optional BuildBetter API key even pulls customer evidence into specs, so what you ship maps to what customers actually asked for. BuildBetter CLI keeps your whole team's DevOps agents on the same playbook.

Frequently Asked Questions

What are the best Claude Code skills for CI/CD in 2026?

For pipeline authoring, addyosmani/ci-cd-and-automation gives general-purpose automation guidance, and wshobson/gitlab-ci-patterns gives GitLab-specific stage, caching, rules, and DAG-needs patterns for teams standardized on GitLab CI. Pair either with obra/verification-before-completion so the agent proves the pipeline is green before declaring the change done — the review gate matters as much as the generation.

Are these skills safe to run against production infrastructure?

Skills encode good procedures but do not replace human review. Database migrations and pipeline changes need a named human owner and a tested rollback before they ship. Always run skillrank show <ref> first to read the skill's security scan rating, detected stacks, and eval results, and read the actual skill file on GitHub. No agent should ship a migration or a secrets/permissions change unreviewed.

How do I install a Claude Code skill?

Run skillrank install <author/slug>, which performs a hash-verified install into your repo so you know exactly what was added — important for infra skills. Run skillrank show <ref> beforehand to inspect the security rating and eval results. skillrank is open source and also available as bb skills install <ref> when BuildBetter CLI is installed.

How do I know a skill actually helps rather than just costing tokens?

Run skillrank eval <ref>, which performs a local paired evaluation — with-skill versus without-skill — on your own agent and your own repo. This lets you measure a real improvement in output quality before standardizing across the team. It matters most in DevOps because both wasted tokens and false-confidence mistakes are expensive here.

Do these skills work in agents other than Claude Code?

Yes in principle — skill files extend the AGENTS.md standard, a cross-agent convention. In practice, portability requires that each engineer's agent actually loads the skill. BuildBetter CLI (bb) carries the same skills and release conventions across Claude Code, Cursor, Codex, and Copilot so the whole team gets consistent behavior, and it saves each session for later audit.

Why do review gates matter more in DevOps?

Because infrastructure errors block the whole team, not one PR. A broken pipeline stalls every merge; a bad migration can take down writes for the product. Verification and code-review skills earn their keep more here than raw generation speed — which the DORA data on AI degrading delivery stability without review discipline confirms.

Ship at the Speed of Insight

The eight skills above make individual agent sessions safer. BuildBetter CLI makes them consistent across every engineer and auditable after the fact — the layer that turns scattered skill files into a shared DevOps playbook. Install it, point your agents at BB-Skills, and evaluate every skill before you standardize on it.

Install BuildBetter CLI — ship at the speed of insight.