Agent skill

Apex Azure Defaults

by jonathan-vella in jonathan-vella/apex

UTILITY SKILL — Applies canonical Azure defaults through an IaC workflow covering governance precedence, CAF naming, AVM-first composition, unique suffixes, cost monitoring, VNet planning, and…

MITAuto-check passedDevOps & Cloud

Install Apex Azure Defaults

skills CLI

$ npx skills add jonathan-vella/apex --skill apex-azure-defaults -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install jonathan-vella/apex apex-azure-defaults --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/apex-azure-defaults .claude/skills/apex-azure-defaults && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "apex-azure-defaults" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-defaults into .claude/skills/apex-azure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-defaults", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-defaults

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add jonathan-vella/apex --skill apex-azure-defaults -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install jonathan-vella/apex apex-azure-defaults --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/skills/apex-azure-defaults .agents/skills/apex-azure-defaults && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "apex-azure-defaults" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-defaults into .agents/skills/apex-azure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-defaults", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add jonathan-vella/apex --skill apex-azure-defaults -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install jonathan-vella/apex apex-azure-defaults --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/skills/apex-azure-defaults .cursor/skills/apex-azure-defaults && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "apex-azure-defaults" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-defaults into .cursor/skills/apex-azure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-defaults", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/jonathan-vella/apex.git --path .github/skills/apex-azure-defaults

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add jonathan-vella/apex --skill apex-azure-defaults -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install jonathan-vella/apex apex-azure-defaults --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/skills/apex-azure-defaults .gemini/skills/apex-azure-defaults && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "apex-azure-defaults" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-defaults into .gemini/skills/apex-azure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-defaults", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install jonathan-vella/apex apex-azure-defaults

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add jonathan-vella/apex --skill apex-azure-defaults -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/skills/apex-azure-defaults .github/skills/apex-azure-defaults && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "apex-azure-defaults" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-defaults into .github/skills/apex-azure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-defaults", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add jonathan-vella/apex --skill apex-azure-defaults -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install jonathan-vella/apex apex-azure-defaults --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/skills/apex-azure-defaults .opencode/skills/apex-azure-defaults && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "apex-azure-defaults" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-defaults into .opencode/skills/apex-azure-defaults/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-defaults", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: apex-azure-defaults
GitHub stars: 217
Token cost: ~1.5k tokens
SKILL.md length: 495 words
Files: 27 (incl. references)
Skills in repo: 39
Repo updated: Oct 10, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

UTILITY SKILL — Applies canonical Azure defaults through an IaC workflow covering governance precedence, CAF naming, AVM-first composition, unique suffixes, cost monitoring, VNet planning, and…

Works in 8 steps: Resolve governance precedence — apply… → Generate one stable suffix — derive it… → Apply CAF naming — use resource-specific… → …
: artifact templates
SKILL.md covers Prerequisites, IaC Workflow, IaC-Specific Invariants and Validation, plus 1 more section
Calls npm and terraform

What it does

Apex Azure Defaults is an agent skill from jonathan-vella/apex. UTILITY SKILL — Applies canonical Azure defaults through an IaC workflow covering governance precedence, CAF naming, AVM-first composition, unique suffixes, cost monitoring, VNet planning, and lifecycle checks. WHEN: "Azure naming convention", "CAF naming", "resource tags", "AVM module", "security baseline", "region default". DO NOT USE FOR: artifact templates or pricing lookups.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 27 other files, including reference files (for example `references/adversarial-checklists.md`, `references/adversarial-review-deep.md` and `references/adversarial-review-protocol.md`). Compatibility notes: Works with Claude Code, GitHub Copilot, VS Code, and any Agent Skills compatible tool.

It sits in DevOps & Cloud, covering Infrastructure as code. It works with Microsoft Azure. The repository describes itself as: APEX turns Azure platform engineering requirements into verified, deploy-ready IaC — powered by GitHub Copilot agents, real-time pricing, and built-in compliance. The licence is MIT.

When your agent uses it

: artifact templates
Pricing lookups

Example prompts

“Azure naming convention”
“CAF naming”
“resource tags”
“/apex-azure-defaults”

Requirements

Compatibility (from SKILL.md): Works with Claude Code, GitHub Copilot, VS Code, and any Agent Skills compatible tool.

Workflow steps

8 steps, taken from the first numbered list in SKILL.md.

Resolve governance precedence — apply live policy constraints before
Generate one stable suffix — derive it once from deployment scope and
Apply CAF naming — use resource-specific abbreviations and length limits;
Resolve AVM modules live — prefer AVM, pin the latest stable version at
Apply canonical security defaults — load the
Run conditional planning gates — apply VNet and cost-monitoring workflows
Check service lifecycle — use the latest supported GA LTS runtime and
Validate the output — run the stack validator and the security, AVM pin,

What it can do on your machine

Read from SKILL.md and the folder at commit b8e5908. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- npm
- terraform
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Works with Claude Code, GitHub Copilot, VS Code, and any Agent Skills compatible tool.
From compatibility in the SKILL.md frontmatter.

Context cost

Apex Azure Defaults loads about 1.5k tokens when it runs, and up to ~56k if it reads all its reference files. Until then it costs about 102 tokens; SKILL.md has 495 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~102
When it runs · the whole SKILL.md, loaded when a task matches: ~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~56k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jonathan-vella/apex at commit b8e5908, republished under its MIT licence (© jonathan-vella). 495 words, ~1,472 tokens.

Download SKILL.mdSave it as .claude/skills/apex-azure-defaults/SKILL.md (or your agent's skills folder). This skill also uses 26 other files; get the full folder from GitHub.

name: apex-azure-defaults
description: **UTILITY SKILL** — Applies canonical Azure defaults through an IaC workflow covering governance precedence, CAF naming, AVM-first composition, unique suffixes, cost monitoring, VNet planning, and lifecycle checks. WHEN: "Azure naming convention", "CAF naming", "resource tags", "AVM module", "security baseline", "region default". DO NOT USE FOR: artifact templates or pricing lookups.
compatibility: Works with Claude Code, GitHub Copilot, VS Code, and any Agent Skills compatible tool.
user-invocable: false
disable-model-invocation: false
license: MIT
metadata.author: jonathan-vella
metadata.version: 3.0
metadata.category: azure-infrastructure

Azure Defaults

Apply the canonical defaults from .github/copilot-instructions.md without duplicating them here. Live governance discovered for the target scope always overrides repository defaults.

Prerequisites

Reuse the canonical Azure Defaults section while current and available; reload missing required guidance after edits, compaction or a new chat.
Read 04-governance-constraints.json when it exists.
Read sku-manifest.json for creative SKU decisions; do not derive SKUs from artifact prose.
Load only the reference needed for the current decision.

IaC Workflow

Resolve governance precedence — apply live policy constraints before fallback regions, tags, networking, cost, or security defaults.
Generate one stable suffix — derive it once from deployment scope and pass it to every globally unique resource name.
Apply CAF naming — use resource-specific abbreviations and length limits; load naming examples when constraints differ by service.
Resolve AVM modules live — prefer AVM, pin the latest stable version at plan time, and record justified stale-pin exceptions in the IaC contract.
Apply canonical security defaults — load the networking and security baseline before security elicitation or design; do not offer baseline opt-outs. Load AVM pitfalls only when module parameters or lifecycle constraints require detail.
Run conditional planning gates — apply VNet and cost-monitoring workflows when their triggers hold; governance remains authoritative.
Check service lifecycle — use the latest supported GA LTS runtime and reject retired, classic, preview, or short-lifecycle choices for durable production workloads unless explicitly approved.
Validate the output — run the stack validator and the security, AVM pin, SKU coverage, and governance checks relevant to the produced IaC.

Show full SKILL.md (243 more words)Show less

IaC-Specific Invariants

Unique suffix: generate one deterministic suffix per deployment scope and pass it into modules rather than recomputing it independently.
AVM-first: do not hand-roll a resource with an applicable stable AVM module.
Live pins: resolve module versions at plan time; training-data pins are not evidence of currency.
Governance wins: discovered policy overrides every fallback in the canonical defaults and this workflow.
Security is a floor: missing policy does not relax the baseline. Conflicting policy/security requirements block the affected design for human resolution.
VNet planning is interactive: confirm CIDRs when a workload requires VNet integration, private endpoints, or a VNet-attached service. Production cannot defer the gate.
Cost monitoring is explicit: production requires the governed budget, notification, and anomaly-monitoring contract; non-production exceptions must use a documented mode.
Lifecycle is verified live: selectable engine and runtime versions require current support-policy evidence.

Validation

bash

npm run validate:region-canonical
npm run validate:iac-security-baseline
npm run validate:avm-versions:freeze
npm run validate:sku-iac-coverage

Then run bicep build and bicep lint, or terraform fmt -check and terraform validate, for the selected stack.

Reference Index

Load references progressively; do not read the directory wholesale.

Decision area	References
Naming and tags	Naming examples, tag strategy
AVM and security	AVM modules, security and AVM pitfalls
Networking	VNet planning, identity resolution
Cost and sizing	Cost baseline, Bicep, Terraform, pricing, service matrices
Governance and lifecycle	Governance discovery, policy effects, deprecated services, workflow gates
Architecture and review	WAF criteria, research workflow, review protocol, deep review
IaC implementation	Terraform conventions, plan decisions, Azure CLI auth
Artifact integration	Artifact categories, cost delegation, service class menu

Files

SKILL.md and 26 other files (references) in .github/skills/apex-azure-defaults of jonathan-vella/apex.

SKILL.md
references/adversarial-checklists.md
references/adversarial-review-deep.md
references/adversarial-review-protocol.md
references/artifact-type-categories.md
references/avm-modules.md
references/azure-cli-auth-validation.md
references/cost-alerts-baseline.md
references/cost-alerts-bicep.md
references/cost-alerts-terraform.md
references/cost-estimate-parent-contract.md
references/deprecated-services.md
references/governance-discovery.md
references/identity-resolution.md
references/naming-full-examples.md
references/plan-design-decisions.md
references/policy-effect-decision-tree.md
references/pricing-guidance.md
references/research-workflow.md
references/security-baseline-full.md
… and 7 more

Open the folder on GitHubat commit b8e5908

Compare with similar skills

Apex Azure Defaults next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Apex Azure Defaults compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Apex Azure Defaults this skilljonathan-vella/apex	217	—	~1.5k	Automated safety check: Pass	MIT	today
Terravision Cloud Diagramspatrickchugh/terravision	1.6k	—	~5.6k	Automated safety check: Notes	AGPL-3.0-only	4 days ago
Azure Architecture Autopilotgithub/awesome-copilot	40k	1 repos	~1.9k	Automated safety check: Pass	MIT	yesterday
TerrasharkLukasNiessen/terrashark	716	—	~843	Automated safety check: Pass	MIT	8 days ago
Azure AI Agent App DeploymentAzure-Samples/get-started-with-ai-agents	374	—	~4.7k	Automated safety check: Notes	MIT	2 days ago
FrugalyuanboP/frugal	198	—	~2.1k	Automated safety check: Pass	MIT	2 mo ago

Similar skills

Terravision Cloud Diagrams
patrickchugh/terravision
Draw cloud architecture diagrams for AWS, Azure or GCP with the official provider icon sets, using TerraVision.
1.6k GitHub stars~5.6k tokensUpdated 4 days ago
DevOps & CloudAuto-check: notes
Azure Architecture Autopilot
github/awesome-copilot
Official
Designs Azure infrastructure from a natural-language description, or diagrams an existing resource group, then refines the design through conversation and deploys it with Bicep.
40k GitHub starsUsed in 1 repo~1.9k tokens
DevOps & CloudAuto-check passed
Terrashark
LukasNiessen/terrashark
Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps.
716 GitHub stars~843 tokensUpdated 8 days ago
DevOps & CloudAuto-check passed
Azure AI Agent App Deployment
Azure-Samples/get-started-with-ai-agents
Official
Creates an azd environment, checks RBAC and model quota, provisions an AI agent app on Azure with azd up and health-checks the deployed app.
374 GitHub stars~4.7k tokensUpdated 2 days ago
DevOps & CloudAuto-check: notes
Frugal
yuanboP/frugal
Cloud cost awareness for agents. An agent skill from yuanboP/frugal.
198 GitHub stars~2.1k tokensUpdated 2 mo ago
DevOps & CloudAuto-check passed
Azure Bicep Skill
timothywarner-org/claude-code
A skill your agent uses when authoring, reviewing, or refactoring Azure Bicep code.
224 GitHub stars~2.9k tokensUpdated 2 mo ago
DevOps & CloudAuto-check passed

Questions about Apex Azure Defaults

What does Apex Azure Defaults do?

UTILITY SKILL — Applies canonical Azure defaults through an IaC workflow covering governance precedence, CAF naming, AVM-first composition, unique suffixes, cost monitoring, VNet planning, and…. Apex Azure Defaults is an agent skill from jonathan-vella/apex. UTILITY SKILL — Applies canonical Azure defaults through an IaC workflow covering governance precedence, CAF naming, AVM-first composition, unique suffixes, cost monitoring, VNet planning, and lifecycle checks.

When should I use Apex Azure Defaults?

Apex Azure Defaults fits situations like: : artifact templates; pricing lookups.

How do I install Apex Azure Defaults in Claude Code?

Run `npx skills add jonathan-vella/apex --skill apex-azure-defaults -a claude-code`. Or copy the skill folder (.github/skills/apex-azure-defaults in jonathan-vella/apex) into .claude/skills/apex-azure-defaults in your project. Claude Code loads it when a task matches its description.

How do I install Apex Azure Defaults in Codex?

Run `npx skills add jonathan-vella/apex --skill apex-azure-defaults -a codex`. Or copy the skill folder (.github/skills/apex-azure-defaults in jonathan-vella/apex) into .agents/skills/apex-azure-defaults in your project. Codex loads it when a task matches its description.

Can I use Apex Azure Defaults in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jonathan-vella/apex --skill apex-azure-defaults -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/apex-azure-defaults, .gemini/skills/apex-azure-defaults, .github/skills/apex-azure-defaults and .opencode/skills/apex-azure-defaults in your project.

What does Apex Azure Defaults need to run?

Going by SKILL.md and its folder, Apex Azure Defaults needs the command-line tools its instructions call (npm and terraform). Compatibility (from SKILL.md): Works with Claude Code, GitHub Copilot, VS Code, and any Agent Skills compatible tool..

Does Apex Azure Defaults access the network?

SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Apex Azure Defaults safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Apex Azure Defaults use?

Apex Azure Defaults is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Apex Azure Defaults use?

About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 54k tokens, read only when the agent opens those files.

What are the alternatives to Apex Azure Defaults?

Skills that share tags, products or a category with Apex Azure Defaults: Terravision Cloud Diagrams (patrickchugh/terravision, 1.6k stars), Azure Architecture Autopilot (github/awesome-copilot, 40k stars), Terrashark (LukasNiessen/terrashark, 716 stars) and Azure AI Agent App Deployment (Azure-Samples/get-started-with-ai-agents, 374 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Apex Azure Defaults?

jonathan-vella (a GitHub user) maintains it in jonathan-vella/apex, which has 217 GitHub stars. The repository holds 39 skills in this directory. The repository was last updated on October 10, 2026.

Source: jonathan-vella/apex on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Apex Azure Defaults

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Compatibility

Context cost

Safety

SKILL.md

Azure Defaults

Prerequisites

IaC Workflow

IaC-Specific Invariants

Validation

Reference Index

Files

Compare with similar skills

Similar skills

More from jonathan-vella/apex

Related

Questions about Apex Azure Defaults