731 skills · sorted by relevance
Manage API keys, passwords, and certificates used in CI/CD, the automated process for testing and deploying software. Connect secret stores, plan credential rotation, restrict access, and prevent sensitive values from appearing in logs.
Design CI/CD pipelines that move applications through development, staging, and production. Define approval and security checks, gradual release strategies, health checks, and rollback procedures, and investigate gates or deployments that fail to progress.
Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.
Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.
Explore and configure an Nx monorepo, where multiple projects share one repository. Inspect resolved project settings, identify projects affected by changes, and improve project boundaries, build caching, and CI/CD pipelines.
Helps prepare web applications for production with automated testing and deployment workflows, Docker packaging, health checks, and rollback plans. Provides examples and checklists for choosing release strategies and reviewing readiness before launch.
Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.
Write more reliable Bash scripts for production automation, CI/CD pipelines, and system administration. Covers input validation, error handling, structured logs, safe temporary files, dry runs to preview changes, and scripts designed for safe reruns.
Create, review, migrate, or troubleshoot Azure Developer CLI projects. Align application settings, infrastructure definitions, deployment environments, secrets, and automated delivery workflows while checking that configuration files and deployment requirements agree.
Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.
Build and review Bash scripts for automation and CI/CD, the pipelines that test and deliver software. Add input validation, error handling, safe file operations, tests, and platform checks to make script behavior easier to verify.
Checks application code, dependencies, and security controls to identify vulnerabilities and plan fixes. Includes Python scanners, reports, incident response workflows, and guidance for adding security checks to CI/CD, the automated build and deployment process.
Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.
Submit groups of AI requests as batch jobs with the OmniRoute command line. Manage input files, monitor or cancel jobs, save results and errors, and incorporate batch processing into automated build and deployment workflows.
Organize GitHub work through task-specific modes for pull request reviews, issue tracking, releases, and branch management. Coordinate repository synchronization and CI/CD, the workflows that test and deploy changes, with support for multiple agents.
Set up ESLint, a tool that checks JavaScript for errors and coding rule violations. Configure shared rules, connect checks to editors and automated workflows, and review flagged code alongside its behavior in the browser.
Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.
Learn how to check Claude Code tool calls against a policy and create digitally signed execution records. This walkthrough covers setup, offline verification, tamper demonstrations, and CI/CD integration before adopting the protect-mcp runtime plugin.
Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.
Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.
Design automated build, test, and deployment workflows for GitHub Actions, GitLab CI/CD, and Jenkins. Covers job ordering, dependency caching, secret handling, and gradual releases that use health checks before expanding deployment.
Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.
Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.
Find the relevant DevOps guidance for version control, testing, delivery security, databases, performance, monitoring, and costs. This skill acts as an index, directing development and operations questions to the corresponding topic files.