devsecops
Skill4 starsChanged 5 months agoMITView on GitHub
DevSecOps skill for securing CI/CD pipelines, infrastructure as code, containers, Kubernetes, cloud deployments, secrets handling, dependency management, SAST/DAST/SCA, release gates, supply-chain controls, SBOMs, policy-as-code, and secure SDLC workflows. Use for pipeline hardening, deployment risk reviews, security automation, and remediation planning.
We split this skill into the rules it gives an agent
6 rules. 0 are common, 5 are distinctive, and 1 is very specific to this project.
0
Common
Most of the 5 edited versions we read keep these.
5
Distinctive
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 11
Prefer incremental controls that developers can keep using over heavyweight gates that will be bypassed.
- Distinctive: line 12
Treat credentials, artifacts, build provenance, and deployment permissions as first-class risks.
- Distinctive: line 19
Add or improve controls: least privilege, pinned dependencies, scanning, signing, SBOM, policy checks, and audit logging.
- Distinctive: line 21
Verify with local checks, CI dry runs, or policy evaluation where available.
- Distinctive: line 26
Use short-lived credentials or OIDC federation instead of long-lived secrets.
- Very specific: line 27
Run SAST/SCA/container/IaC checks with documented exception handling.
“Common” is measured: kept by at least 6 in 10 of the 5 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
DevSecOps
Operating Rules
- Inspect the repo, pipeline files, deployment manifests, and current security tooling before recommending changes.
- Prefer incremental controls that developers can keep using over heavyweight gates that will be bypassed.
- Treat credentials, artifacts, build provenance, and deployment permissions as first-class risks.
- Separate blocking release criteria from advisory findings.
Workflow
- Map the path from commit to production: source, build, test, artifact, deploy, runtime.
- Identify trust boundaries, identities, secrets, third-party actions/images, and artifact storage.
- Add or improve controls: least privilege, pinned dependencies, scanning, signing, SBOM, policy checks, and audit logging.
- Tune severity and false-positive handling so the pipeline remains usable.
- Verify with local checks, CI dry runs, or policy evaluation where available.
Baseline Controls
- Pin third-party CI actions and container base images.
- Use short-lived credentials or OIDC federation instead of long-lived secrets.
- Run SAST/SCA/container/IaC checks with documented exception handling.
- Generate SBOMs and preserve build provenance for release artifacts.
- Enforce least-privilege deploy roles per environment.
Other versions6 projects use a version of this.
Word for word · 1
- Garyson26/Trident-SecOps-Skills★ 1100% same
Edited · 0
None found.
Wrote their own version · 5
- rade-nugroho/Agentic-Enteprises-Skill★ 9same name
- daemon-blockint-tech/Agentic-Enteprises-Skill★ 8same name
- weirdgme/Claude-code-infrastructure-showcase★ 4same name
- ffsshhttiikk/opencode-agents-skills★ 2same name
- Quad4-Software/skills★ 1same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository45 other files it gives its agents.
- ai-redteamSkill
- api-security-automationSkill
- assembly-programmingSkill
- bug-bounty-workflowSkill
- claude-mythos-emulationSkill
- cloud-security-automationSkill
- cybersecurity-partnerSkill
- detection-engineeringSkill
- exploit-developmentSkill
- forensics-triageSkill
- gemini-tool-orchestratorSkill
- go-programmingSkill
- kubernetes-securitySkill
- malware-reverse-engineeringSkill
- multilingualSkill
- offensive-securitySkill
- prompt-enhancementSkill
- python-programmingSkill
- ai-redteamSkill
- api-security-automationSkill
- assembly-programmingSkill
- bug-bounty-workflowSkill
- claude-mythos-emulationSkill
- cloud-security-automationSkill
- cybersecurity-partnerSkill
- detection-engineeringSkill
- devsecopsSkill
- exploit-developmentSkill
- forensics-triageSkill
- gemini-tool-orchestratorSkill
- go-programmingSkill
- kubernetes-securitySkill
- malware-reverse-engineeringSkill
- multilingualSkill
- offensive-securitySkill
- osint-recon-automationSkill
- prompt-enhancementSkill
- purple-team-automationSkill
- python-programmingSkill
- smart-contract-auditSkill
- soc-operationsSkill
- threat-intel-fusionSkill
- smart-contract-auditSkill
- soc-operationsSkill
- threat-intel-fusionSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.