devsecops-skills

Plugin devsecops-skills from marketplace ops-engineering-skills in selvarajmurugesan90/ops-engineering-skills. Commands read from the repo's manifest — 1 month ago.

Skills (17)

• checkov-and-tfsec-iac-security-scanning

  Configures Checkov and tfsec to scan Terraform/CloudFormation/Kubernetes IaC source for misconfigurations — hardcoded secrets, overly permissive IAM policies, unencrypted storage, open security groups — before `terraform apply` or `aws cloudformation deploy` ever runs. Use when a user asks to "scan

• complete-devsecops-pipeline-for-kubernetes-from-scratch

  Builds the complete security-gate sequence for a Kubernetes-targeted DevSecOps pipeline from scratch — SAST, SCA, container image scanning, a policy-as-code (OPA/Kyverno) admission gate placed before the GitOps handoff, and a secrets model where plaintext credentials never touch the pipeline because

• complete-devsecops-pipeline-for-serverless-from-scratch

  Builds the complete security-gate sequence for a serverless (Lambda- style) DevSecOps pipeline from scratch — SAST, SCA against a much larger bundled transitive-dependency surface, package/artifact signing, and least-privilege execution-role scoping as the primary release gate (rather than a Kuberne

• complete-devsecops-pipeline-for-vm-based-workloads-from-scratch

  Builds the complete security-gate sequence for a VM-based DevSecOps pipeline from scratch — SAST, SCA, golden-image scanning and CIS benchmark hardening baked into the machine image itself, config- management-applied secrets via Ansible Vault (never plaintext), and an ongoing patch/drift-detection g

• container-image-hardening

  Guides building minimal, non-root, hardened container images — multi-stage builds, distroless/minimal base images, non-root users, read-only root filesystems, dropped Linux capabilities, and pinned/ digest-referenced base images. Use when the user asks to "harden this Dockerfile", "reduce container

• critical-vulnerability-emergency-response

  Guides the accelerated, out-of-band response when a critical CVE is publicly disclosed in a widely-used dependency, library, or platform component — rapid exposure assessment across the fleet, patch or temporary mitigation, verification, and closeout. Use when the user says "a critical CVE just drop

• dast-integration

  Guides adding Dynamic Application Security Testing (DAST) — automated black-box scanning of a running web application or API — using tools such as OWASP ZAP or Nuclei, in CI/CD or on a scheduled cadence against a staging environment. Use when the user asks to "add DAST scanning", "run a ZAP baseline

• policy-as-code-guardrails

  Guides writing and enforcing security/compliance policies as code using Open Policy Agent (OPA)/Rego, Kyverno, or Conftest, applied to Kubernetes admission control, CI/CD pipeline gates, and Infrastructure as Code (Terraform/CloudFormation) review. Use when the user asks to "write an OPA policy", "b

• sast-integration

  Guides adding, tuning, and triaging Static Application Security Testing (SAST) in a codebase or CI/CD pipeline using tools such as Semgrep, CodeQL, SonarQube, or Bandit/gosec/ESLint-security-plugin per language. Use when the user asks to "add SAST scanning to a pipeline", "scan this repo for insecur

• secrets-management

  Guides eliminating hardcoded secrets from code and CI/CD, setting up a secrets manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, SOPS+age/KMS for GitOps), rotating credentials, and adding secret-scanning to catch leaks. Use when the user asks to "remove hardcoded secrets", "set up Vaul

• secure-cicd-gates

  Guides designing a coherent set of security gates across a CI/CD pipeline — combining SAST, SCA, secret-scanning, DAST, container scanning, and policy checks into ordered stages with clear block-vs-warn thresholds, instead of ad hoc, redundant, or contradictory individual checks. Use when the user a

• security-finding-backlog-triage

  Guides ongoing triage and prioritization of the accumulated SAST/DAST/ SCA finding queue — scoring severity against real exploitability and a tool's known false-positive rate, and routing findings to a fix-now, scheduled, or won't-fix lane instead of a single undifferentiated backlog. Use when the u

• security-gate-exception-management

  Guides granting a scoped, time-boxed exception to a specific security gate (a suppressed SAST/SCA finding, a bypassed admission policy, a waived compliance control) with a mandatory owner, justification, and expiry date, and reviewing/renewing or closing exceptions before a waiver list grows into an

• security-posture-metrics-and-trend-analysis

  Guides tracking security finding and posture trends over time — mean time-to-remediate (MTTR) by severity, backlog age distribution, false-positive rate, exception-list growth, and gate pass/override rate — to answer "is our security posture actually improving" with data instead of a point-in-time f

• snyk-vulnerability-and-license-scanning

  Configures Snyk as a unified scanner across open-source dependencies (Snyk Open Source/SCA), container images (Snyk Container), and Infrastructure-as-Code (Snyk IaC) from one CLI/token/policy surface, plus Snyk's license-compliance policy engine, which is a distinct enforcement path from vulnerabili

• software-composition-analysis-sca

  Guides scanning third-party and transitive dependencies for known vulnerabilities and license issues using tools such as Grype, Trivy, OWASP Dependency-Check, npm audit/pip-audit, or GitHub Dependabot/Snyk, and building a remediation workflow around the results. Use when the user asks to "scan depen

• supply-chain-security-slsa-sbom

  Guides generating Software Bills of Materials (SBOM) with Syft/CycloneDX, signing artifacts and generating provenance attestations with Sigstore/cosign, and mapping practices to SLSA build-integrity levels. Use when the user asks to "generate an SBOM", "sign our container images", "add SLSA provenan

Similar plugins