prodsec-skills-ge-core

Plugin prodsec-skills-ge-core from marketplace prodsec-skills in RedHatProductSecurity/prodsec-skills. Commands read from the repo's manifest — 1 month ago.

Skills (12)

• ai-code-review

  Security-focused review of AI-generated or AI-assisted code. Use when reviewing code produced by AI coding assistants, auditing AI-generated patches, verifying AI-assisted contributions before merge, or when a review needs to account for failure modes specific to AI code generation. category: securi

• ai-systems-security

  Secure AI-powered products and infrastructure. Use when integrating LLM APIs, deploying model-serving infrastructure, building agent workflows, connecting MCP servers, or reviewing AI system architecture for security gaps. category: secure_development subcategory: ai-systems

• authentication

  Enforce standard authentication for external data source connections. Use when integrating, configuring, or reviewing connections from AI systems to external databases, APIs, or data services.

• container-hardening

  Harden container images and runtime configuration. Use when building, reviewing, or auditing Containerfiles, Dockerfiles, container compose files, or Kubernetes pod security settings. category: secure_development subcategory: kubernetes

• dependency-vulnerability-audit

  Supply chain security audit using CLI vulnerability scanners, license compliance checks, and supply chain risk assessment. Use when auditing project dependencies for known CVEs, license concerns, and supply chain health. category: secure_development subcategory: supply-chain

• input-validation-injection

  Apply when reviewing or writing code that processes untrusted input, constructs queries or commands, or handles user-supplied data. Covers SQL, LDAP, OS command injection, prototype pollution, and general validation strategy. origin: "Adapted from CoSAI Project CodeGuard (https://github.com/cosai-oa

• logging

  Enforce logging of access to sensitive external data sources in AI systems. Use when designing, building, or reviewing audit and logging capabilities for AI systems accessing external databases or data services.

• pod-access-control

  Configure Kubernetes RBAC bindings, service accounts, namespaces, resource quotas, and service types for pods. Use when writing, reviewing, or auditing Deployments, ServiceAccounts, Roles, RoleBindings, ResourceQuotas, or Services for least-privilege access control. category: secure_development subc

• scc-security

  Review OpenShift Security Context Constraints for correct privilege levels. Use when auditing pod security, reviewing SCC assignments, or configuring container runtime permissions on OpenShift clusters. category: secure_development subcategory: kubernetes

• secrets-detection-patterns

  Detect hardcoded secrets in source code using pattern-based scanning for API keys, tokens, passwords, private keys, and connection strings. Use before committing, during code review, or for post-incident history scanning. Self-contained — no external tools required. category: secure_development subc

• secure-by-design

  Apply Secure by Design, by Default, and in Deployment (SD3) principles. Use when reviewing default configurations, setup processes, update mechanisms, or evaluating whether a system fails open or closed. category: secure_development subcategory: security-principles

• web-application-security

  Review web application security controls against OWASP-aligned risks. Use when building, auditing, or reviewing server-side web applications that handle user input, sessions, authentication, or access control. category: secure_development subcategory: web-security

Similar plugins