66 skills · sorted by relevance
Automate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR capabilities. Use when scaling security operations or implementing DevSecOps.
The English summary is being prepared. Showing the original description.
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for SAST, DevSecOps, and compliance.
The English summary is being prepared. Showing the original description.
Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines. Use when building DevSecOps workflows, ensuring compliance, or establishing security gates for container deployments.
The English summary is being prepared. Showing the original description.
Autonomous AI code generation safety guardrail register: static AST analysis, forbidden import filters, and zero-day vulnerability checks.
The English summary is being prepared. Showing the original description.
Autonomous DevSecOps & FinOps Guardrails. Orchestrates Gemini 3 Flash to audit Linux Kernel patches, Terraform cost drifts, and K8s compliance.
The English summary is being prepared. Showing the original description.
Embed security into DevOps — pipeline security gates, guardrails, and culture that ships fast and safe.
The English summary is being prepared. Showing the original description.
Autonomous DevSecOps & FinOps Guardrails. Orchestrates Gemini 3 Flash to audit Linux Kernel patches, Terraform cost drifts, and K8s compliance.
The English summary is being prepared. Showing the original description.
Use for security review, audit, hardening, compliance, DevSecOps, network, infrastructure, or application security with focused references.
The English summary is being prepared. Showing the original description.
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
The English summary is being prepared. Showing the original description.
Autonomous DevSecOps & FinOps Guardrails. Orchestrates Gemini 3 Flash to audit Linux Kernel patches, Terraform cost drifts, and K8s compliance.
The English summary is being prepared. Showing the original description.
Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
The English summary is being prepared. Showing the original description.
Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.
The English summary is being prepared. Showing the original description.
Deploy DefectDojo as a centralized vulnerability management dashboard with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows.
The English summary is being prepared. Showing the original description.
Use when performing cybersecurity operations - offensive or defensive - including threat detection and hunting, SOC operations, incident response, digital forensics and DFIR, malware analysis and reverse engineering, threat intelligence, cloud/container/network/application/API security, identity-access and zero-trust, OT/ICS and endpoint security, vulnerability and supply-chain management, DevSecOps, cryptography, AI security, compliance and governance, and red-team or penetration testing under signed rules of engagement; routes to one of 800+ technique playbooks mapped to MITRE ATT&CK, D3FEND, and NIST CSF.
The English summary is being prepared. Showing the original description.
Knowledge base from DOE Systems Engineering Methodology (SEM) Version 3 — the DOE SDLC for IT investments. Use for staged systems lifecycle planning through maintenance, Stage Exits, Structured Walkthroughs, In-Stage Assessments, requirements traceability, and CMM-aligned process discipline. Covers SEM3 (2002) guidance only; does not replace modern DevSecOps tooling standards, DOE O 413.3B capital-asset directives, or current CIO policy supersessions.
The English summary is being prepared. Showing the original description.
Autonomous DevSecOps & FinOps Guardrails. Guide to reviewing Linux kernel patches, Terraform cost changes and Kubernetes policy with a separately reviewed upstream tool and configured model.
The English summary is being prepared. Showing the original description.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
The English summary is being prepared. Showing the original description.
Autonomous DevSecOps & FinOps Guardrails.
The English summary is being prepared. Showing the original description.
bu skill covers implementing Gitleaks for Tespit etme and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
The English summary is being prepared. Showing the original description.
bu skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.
The English summary is being prepared. Showing the original description.
bu skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing Rego policies, Dağıt:ing OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into Dağıt:ment pipelines.
The English summary is being prepared. Showing the original description.
bu skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses Tespit etme misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before Dağıt:ment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.
The English summary is being prepared. Showing the original description.
Write custom Semgrep SAST rules in YAML to tespit etmeapplication-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.
The English summary is being prepared. Showing the original description.
Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.
The English summary is being prepared. Showing the original description.