Skill UI

Implements container build integrity by orchestrating in-toto attestations across CI/CD steps, ensuring signed provenance, SBOMs, and policy-compliant deployment verification in Kubernetes environments.

Simulates and detects software supply chain attacks by checking typosquatting risks with Levenshtein distance, probing dependency confusion across registries, verifying package hashes, and running pip-audit vulnerability scans for security assessments.

Harden serverless compute on AWS Lambda, Azure Functions, and Google Cloud Functions by enforcing least-privilege IAM roles, moving secrets into vaults, scanning dependencies, validating inputs, securing function URLs, and monitoring runtimes so injections, credential theft, and supply-chain threats are caught before deployment.

Parses CycloneDX and SPDX SBOMs, maps components to the NVD CVE catalog, scores their risk via dependency graphs, and produces compliance-ready reports for supply chain security assessments and automated CI/CD scans.

This skill provides robust mechanisms to verify the integrity of AI agent plugins, tools, and dependencies. It generates deterministic SHA-256 manifests (INTEGRITY.json) for all components, allowing users to detect unauthorized modifications, track provenance, and ensure that deployed assets match their published versions. Use this during CI/CD pipelines, code review, and pre-production promotion to secure the entire agent ecosystem.

Checks AI agent implementations against the OWASP Agentic Security Initiative Top 10 risks, producing findings on controls, vulnerabilities, and recommendations for prompt injection, tool governance, escalation, logging, identity, policy, supply chain, and behavioral monitoring before production or audit.