'sbom' 검색 결과

Expert en sécurité des conteneurs (Trivy, Snyk, image scanning, SBOM, runtime security, DZ)

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the target has a public GitHub org, when their build artifacts/SBOMs are reachable, when their docker images are on Docker Hub/GHCR, or when you find internal package names in their JS bundles.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Prepare and publish a Plannotator release with contributor credits, coordinated version updates, ordered builds, and tag-triggered publishing. The workflow also checks package contents, security scan results, and evidence showing how release files were built.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Draft release notes with contributor credits
• Update versions consistently across package files
• Check builds and package contents before release

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert knowledge for Azure Firmware Analysis development including best practices, security, integrations & coding patterns, and deployment. Use when configuring RBAC/service principals, uploading firmware via CLI/PowerShell/Python, mapping results to Device Registry, reading SBOM paths, or deploying workspaces with ARM/Bicep/Terraform, and other Azure Firmware Analysis related development tasks. Not for Azure Defender For Iot (use azure-defender-for-iot), Azure IoT Edge (use azure-iot-edge), Azure IoT Hub (use azure-iot-hub), Azure Confidential Computing (use azure-confidential-computing).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines. Use when building DevSecOps workflows, ensuring compliance, or establishing security gates for container deployments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when reviewing, designing, or modifying Java enterprise products, services, libraries, agents, plugins, connected components, or platform modules that may qualify as products with digital elements and need EU Cyber Resilience Act secure-by-design, vulnerability handling, security update, SBOM, product documentation, or release-readiness controls. Part of Plinth Toolkit

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when you need framework-agnostic Docker and container image guidance for Java projects - Dockerfile design, multi-stage Maven builds, jlink custom runtimes, micro runtime distributions such as Alpaquita, JVM container ergonomics, non-root execution, image metadata, .dockerignore, reproducible builds, vulnerability scanning, SBOM awareness, and production-safe container defaults. This should trigger for requests such as Review Java Dockerfile; Improve Docker image security; Add jlink runtime to a Java container; Add containerization to a Java project; Optimize Java container image size; Review Docker build reproducibility. Part of Plinth Toolkit

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit. Use for CI/CD security gates, pre-deployment audits, compliance requirements, or encountering CVE detection, outdated packages, license compliance, SBOM generation errors.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Guides dependency audits and upgrades. Use when auditing dependencies, upgrading vulnerable packages, managing lockfiles or package managers, SBOMs, or update and monorepo policy.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

供应链安全时使用。适用于依赖漏洞扫描 / 镜像安全 / CI 投毒防护 / SBOM。融合 SLSA + Sigstore + Snyk + Trivy。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

DevSecOps skill for securing CI/CD pipelines, infrastructure as code, containers, Kubernetes, cloud deployments, secrets handling, dependency management, SAST/DAST/SCA, release gates, supply-chain controls, SBOMs, policy-as-code, and secure SDLC workflows. Use for pipeline hardening, deployment risk reviews, security automation, and remediation planning.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Manage software composition analysis — SBOMs, vulnerability triage, and remediation of third-party dependencies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Meet EU Cyber Resilience Act vulnerability duties — coordinated disclosure, SBOMs, and lifecycle security for digital products.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build native Linux packages (.deb / .rpm / .apk / .pkg.tar.zst) from a PKGBUILD or yap.json project using the yap-mcp Model Context Protocol server. Use this skill whenever the user asks to "build a package", "make a deb/rpm", "cross-compile for arm64/aarch64", "sign a release", generate SBOMs, install a built artifact, or diagnose why a yap build failed. The yap MCP server exposes async builds with buildID polling, validation, dependency-graph inspection, and artifact discovery.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.