prodsec-skills

Plugin prodsec-skills from marketplace ai-helpers in openshift-eng/ai-helpers. Commands read from the repo's manifest — today.

Skills (145)

• secdevai-fix

  Apply suggested security fixes from a prior code review. Use when the user wants to remediate security findings with before/after code diffs, severity filtering, and explicit approval before modifying code.

• secdevai-oci-image-security

  Analyze OCI container images for security vulnerabilities, misconfigurations, supply chain risks, and hardening gaps. Use when reviewing container images from Red Hat, Quay.io, Docker Hub, or any OCI-compliant registry. Covers CVE analysis, config security, EOL component detection, credential exposu

• secdevai-review

  Use when performing security code review of source files, git commits, or entire codebases against OWASP Top 10 (2021), CWE/SANS Top 25, and OWASP WSTG v4.2 patterns; applicable to any language or framework.

• ai-code-review

  Security-focused review of AI-generated or AI-assisted code. Use when reviewing code produced by AI coding assistants, auditing AI-generated patches, verifying AI-assisted contributions before merge, or when a review needs to account for failure modes specific to AI code generation. category: securi

• ai-systems-security

  Secure AI-powered products and infrastructure. Use when integrating LLM APIs, deploying model-serving infrastructure, building agent workflows, connecting MCP servers, or reviewing AI system architecture for security gaps. category: secure_development subcategory: ai-systems

• authentication

  Enforce standard authentication for external data source connections. Use when integrating, configuring, or reviewing connections from AI systems to external databases, APIs, or data services.

• container-hardening

  Harden container images and runtime configuration. Use when building, reviewing, or auditing Containerfiles, Dockerfiles, container compose files, or Kubernetes pod security settings. category: secure_development subcategory: kubernetes

• dependency-vulnerability-audit

  Supply chain security audit using CLI vulnerability scanners, license compliance checks, and supply chain risk assessment. Use when auditing project dependencies for known CVEs, license concerns, and supply chain health. category: secure_development subcategory: supply-chain

• input-validation-injection

  Apply when reviewing or writing code that processes untrusted input, constructs queries or commands, or handles user-supplied data. Covers SQL, LDAP, OS command injection, prototype pollution, and general validation strategy. origin: "Adapted from CoSAI Project CodeGuard (https://github.com/cosai-oa

• logging

  Enforce logging of access to sensitive external data sources in AI systems. Use when designing, building, or reviewing audit and logging capabilities for AI systems accessing external databases or data services.

• pod-access-control

  Configure Kubernetes RBAC bindings, service accounts, namespaces, resource quotas, and service types for pods. Use when writing, reviewing, or auditing Deployments, ServiceAccounts, Roles, RoleBindings, ResourceQuotas, or Services for least-privilege access control. category: secure_development subc

• scc-security

  Review OpenShift Security Context Constraints for correct privilege levels. Use when auditing pod security, reviewing SCC assignments, or configuring container runtime permissions on OpenShift clusters. category: secure_development subcategory: kubernetes

• secrets-detection-patterns

  Detect hardcoded secrets in source code using pattern-based scanning for API keys, tokens, passwords, private keys, and connection strings. Use before committing, during code review, or for post-incident history scanning. Self-contained — no external tools required. category: secure_development subc

• secure-by-design

  Apply Secure by Design, by Default, and in Deployment (SD3) principles. Use when reviewing default configurations, setup processes, update mechanisms, or evaluating whether a system fails open or closed. category: secure_development subcategory: security-principles

• web-application-security

  Review web application security controls against OWASP-aligned risks. Use when building, auditing, or reviewing server-side web applications that handle user input, sessions, authentication, or access control. category: secure_development subcategory: web-security

• address-sanitizer

  AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C/C++ code to find buffer overflows and use-after-free bugs.

• admin-interface-security

  Secure the administrative interface of model registries. Use when building, deploying, or reviewing model registry access controls and admin interfaces.

• aflpp

  AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C/C++ projects.

• agent-identity

  Enforce that AI agents have their own identity separate from human users. Use when designing, building, or reviewing agent identity management, agent authentication, or agent permission models.

• agent-to-agent-auth

  Enforce SPIFFE/SPIRE plus mTLS for agent-to-agent communication. Use when designing, building, or reviewing authentication between AI agents or multi-agent systems.

• agent-to-mcp-server-auth

  Enforce authentication for agents connecting to MCP servers via MCP clients. Use when designing or reviewing how AI agents authenticate to MCP servers.

• agentic-actions-auditor

  Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary p

• algorithm-selection

  Apply when selecting, reviewing, or configuring cryptographic algorithms, cipher suites, protocol versions, or key exchange mechanisms. Covers banned/deprecated/recommended algorithms, post-quantum readiness, key management, and OpenSSL API migration.

• apache-camel-security

  Secure Apache Camel route deployments across endpoint, payload, route, and configuration layers. Use when building, reviewing, or auditing Camel routes, integration pipelines, or Camel-based microservices.

• atheris

  Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.

• audit-context-building

  Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

• authentication-enforcement

  Enforce authentication and authorization at the API gateway for AI systems. Use when designing, building, or reviewing API gateways that front inference engines, LLM APIs, or AI model endpoints.

• authorization

  Enforce authorization checks for external data source access in AI systems. Use when designing, configuring, or reviewing access controls between AI components and external databases or data services.

• avoid-api-keys

  Avoid using API keys in production AI systems. Use when reviewing authentication mechanisms, designing production deployments, or auditing credential management in AI and agentic systems.

• aws-security

  Enforce AWS security baselines for IAM, networking, logging, and managed services like RDS. Use when building, reviewing, or auditing AWS infrastructure, IAM policies, VPC configuration, or RDS deployments.

• bidirectional-filtering

  Deploy runtime guardrails for bidirectional prompt and response filtering in AI systems. Use when designing, building, or reviewing AI architectures that need prompt injection protection, content filtering, or input/output safety controls.

• build-yaml-misconfiguration

  Apply when reviewing or writing GitLab CI (.gitlab-ci.yml), Tekton pipeline/task YAML, or Containerfiles/Dockerfiles used in CI builds. Detects common misconfigurations that expose secrets, weaken isolation, skip security gates, grant excessive privileges, or produce insecure container images.

• cargo-fuzz

  cargo-fuzz is the de facto fuzzing tool for Rust projects using Cargo. Use for fuzzing Rust code with libFuzzer backend.

• client-metadata-support

  Support OAuth Client ID Metadata Documents in authorization servers. Use when building or reviewing authorization server client validation and registration mechanisms for MCP ecosystems.

• client-side-security

  Apply when reviewing or writing browser-facing code that handles user input, renders HTML, sets cookies, or loads third-party scripts. Covers XSS, CSRF, CSP, clickjacking, XS-Leaks, and HTTP security headers.

• codeql

  Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experime

• compiler-hardening

  Apply compiler hardening flags and sanitizers to C/C++ builds. Use when reviewing build configurations, CI pipelines, or Makefiles/CMakeLists for native code projects.

• consent-and-scoping

  Enforce granular OAuth scopes and explicit user consent in MCP servers. Use when designing, building, or reviewing MCP server permission models, scope definitions, or consent flows.

• constant-time-analysis

  Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or

• constant-time-testing

  Constant-time testing detects timing side channels in cryptographic code. Use when auditing crypto implementations for timing vulnerabilities.

• containerization

  Enforce container security best practices for MCP servers, including OpenShift integration. Use when containerizing MCP servers or reviewing container security configurations for MCP deployments.

• coverage-analysis

  Coverage analysis measures code exercised during fuzzing. Use when assessing harness effectiveness or identifying fuzzing blockers.

• cpu-performance

  Configure CPU isolation, scheduling policies, storage provisioning, and image pull policies for latency-sensitive Kubernetes workloads. Use when writing, reviewing, or auditing pod specs for telco, far-edge, or real-time workloads that require deterministic CPU performance.

• crypto-protocol-diagram

  Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations. Use when diagramming a crypto protocol, visualizing a handshake or key exchange flow,

• database-security

  Enforce database security for schema design, access control, encryption, and operational hardening. Use when building, reviewing, or auditing database schemas, connection handling, credential management, or database deployment configuration.

• defense-in-depth

  Apply defense-in-depth by layering multiple independent security controls. Use when reviewing system architecture, evaluating whether a single control is the only barrier, or assessing blast radius of a component compromise.

• devcontainer-setup

  Creates devcontainers with language-specific tooling (Python/Node/Rust/Go) and persistent volumes. Use when adding devcontainer support to a project or setting up isolated development environments.

• differential-review

  Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressi

• discovery-mechanism

  Enforce authorization server metadata discovery for MCP ecosystems. Use when configuring or reviewing authorization server endpoint publication and discovery metadata.

• discovery-mechanisms

  Enforce support for OAuth 2.0 and OIDC discovery mechanisms in MCP clients. Use when building, configuring, or reviewing MCP client authentication and authorization server discovery.

• dynamic-client-registration

  Support OAuth 2.0 Dynamic Client Registration in authorization servers. Use when building or reviewing authorization server client management for MCP ecosystems.

• encrypted-communication

  Enforce encrypted communication with external data sources. Use when designing, configuring, or reviewing network connections between AI systems and external databases, APIs, or data services.

• external-idp-integration

  Enforce MCP server integration with external centralized identity providers. Use when building, configuring, or reviewing MCP server authentication against external IdPs like Keycloak.

• file-handling-uploads

  Apply when reviewing or writing code that accepts file uploads, processes user-supplied files, or serves stored files. Covers extension validation, content verification, filename security, storage isolation, and scanning.

• file-protection

  Protect LLM model files against unauthorized access and modification. Use when designing, deploying, or reviewing storage and access controls for AI model files and weights.

• fips-compliance

  Enforce FIPS 140-2/140-3 compliance for RHEL, OpenShift, and Go workloads. Use when building, configuring, reviewing, or auditing systems that require FIPS-validated cryptographic modules, RHEL crypto-policy enforcement, FIPS-ready Go binaries, or FIPS-mode kernel and cluster configuration.

• fp-check

  Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.

• fuzzing-dictionary

  Fuzzing dictionaries guide fuzzers with domain-specific tokens. Use when fuzzing parsers, protocols, or format-specific code.

• fuzzing-obstacles

  Techniques for patching code to overcome fuzzing obstacles. Use when checksums, global state, or other barriers block fuzzer progress.

• git-cleanup

  Use when a user asks to analyze and safely clean up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work before any deletion.

• go-security

  Enforce secure coding practices in Go applications. Use when building, reviewing, or auditing Go code that handles user input, database access, cryptography, TLS, or uses unsafe/cgo.

• graphql-security

  Secure GraphQL API deployments against introspection leaks, deep query abuse, and authorization bypass. Use when building, reviewing, or auditing GraphQL schemas, resolvers, or gateway configurations.

• hardening-local

  Harden locally deployed MCP servers against network exposure and host compromise. Use when building, deploying, or reviewing MCP servers that run on a user's local machine.

• hardening-remote

  Harden remotely deployed MCP servers with TLS, network segmentation, and server verification. Use when deploying, configuring, or reviewing MCP servers running as remote services.

• harness-writing

  Techniques for writing effective fuzzing harnesses across languages. Use when creating new fuzz targets or improving existing harness code.

• health-probes

  Configure Kubernetes health probes, lifecycle hooks, and termination policies. Use when writing, reviewing, or auditing pod specs, Deployments, StatefulSets, or Helm templates that define liveness, readiness, startup probes, postStart/preStop hooks, or terminationMessagePolicy.

• helm-chart-security

  Secure Helm chart development, dependency management, and secret handling. Use when building, reviewing, or auditing Helm charts, values files, Chart.yaml dependencies, or Helm-based deployment pipelines.

• http-security-headers

  Verify and configure HTTP response security headers. Use when reviewing web server configuration, reverse proxy setup, or application middleware that sets response headers.

• input-output-sanitization

  Enforce input and output sanitization in MCP servers. Use when building or reviewing MCP server request handling, tool invocation, or response processing.

• insecure-defaults

  Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

• internal-application-routing

  Route internal application traffic through the API gateway for AI systems. Use when designing AI system architecture or reviewing network topology for inference engines and model endpoints.

• isolation-sandboxing

  Enforce isolation and sandboxing of inference engine execution. Use when deploying, configuring, or reviewing inference engines like vLLM that load and serve AI models, especially third-party models.

• jwt-token-enforcement

  Enforce short-lived JWT access token validation for inference engines. Use when implementing or reviewing token validation, access control, or request authentication in inference engine endpoints.

• kafka-amq-security

  Secure Kafka and AMQ Streams deployments with encryption, authentication, and authorization. Use when building, reviewing, or auditing Kafka broker configuration, AMQ Streams custom resources, or Kafka client connectivity.

• least-privilege-and-mediation

  Enforce least privilege and complete mediation in access control design. Use when reviewing authorization models, RBAC configurations, API access controls, or evaluating whether every request is authorized before access is granted.

• libafl

  LibAFL is a modular fuzzing library for building custom fuzzers. Use for advanced fuzzing needs, custom mutators, or non-standard fuzzing targets.

• libfuzzer

  Coverage-guided fuzzer built into LLVM for C/C++ projects. Use for fuzzing C/C++ code that can be compiled with Clang.

• linux-capabilities

  Review and restrict Linux capabilities in Kubernetes containers. Use when writing, reviewing, or auditing pod security contexts that add or drop Linux capabilities such as BPF, NET_ADMIN, NET_RAW, SYS_ADMIN, IPC_LOCK, SYS_NICE, or SYS_PTRACE.

• logging-and-observability

  Enforce centralized structured logging and audit trails in MCP servers. Use when building, configuring, or reviewing MCP server logging, observability, or audit capabilities.

• mcp-client-client-metadata-support

  Support OAuth Client ID Metadata Documents in MCP clients. Use when building or reviewing MCP client registration and identity presentation to authorization servers.

• mcp-client-dynamic-client-registration
• mcp-client-protected-resource-metadata
• mermaid-to-proverif
• model-registry-logging
• model-registry-model-security-scanning
• model-registry-model-signature-verification
• model-registry-secure-storage
• model-security-scanning
• model-signature-verification
• modern-python
• mqtt-security
• network-acls
• network-security
• no-credential-forwarding
• oauth-scopes-handling
• oauth21-implementation
• oauth21-resource-server
• observability
• oidc-integration
• operator-security
• os-tool-security
• ossfuzz
• output-validation-sandbox
• platform-integrity
• prompt-injection-mitigation
• property-based-testing
• protected-resource-metadata
• rate-limiting
• rbac
• react-security
• redis-elasticache-security
• reject-api-keys
• request-validation
• roots-support
• runtime-restrictions
• ruzzy
• safe-c-functions
• sampling-controls
• sarif-parsing
• sbom-provenance
• secure-pipeline
• secure-storage
• secure-token-handling
• semgrep-rule-creator
• semgrep-rule-variant-creator
• semgrep
• service-to-service-mtls
• session-management-cookies
• sharp-edges
• simplicity-and-isolation
• software-signing
• supply-chain-risk-auditor
• third-party-model-security
• tls-compliance
• token-exchange-for-tools
• token-lifecycle
• tool-server-injection-prevention
• transparency-and-usability
• variant-analysis
• vector-forge
• vulnerability-management
• workload-resilience
• wycheproof
• xml-serialization-security
• zeroize-audit

Similar plugins