Skill UI

This skill guides the integration of OWASP ZAP for Dynamic Application Security Testing (DAST) directly into CI/CD pipelines. Learn how to perform baseline, full, and API scans against running applications, interpret complex security findings, tune scan policies, and establish automated security quality gates in modern CI/CD platforms like GitHub Actions and GitLab CI. Essential for DevSecOps practices.

This skill guides developers through integrating Static Application Security Testing (SAST) tools like CodeQL and Semgrep into GitHub Actions CI/CD pipelines. It covers automating code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results, and establishing quality gates to prevent vulnerable code from merging into production.

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

This skill demonstrates how to use Trivy, an open-source security scanner, to perform comprehensive container security assessments. It scans container images, Kubernetes manifests, and Infrastructure as Code (IaC) files for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues. Key features include generating Software Bill of Materials (SBOM) for supply chain transparency and integrating scanning gates into CI/CD pipelines, supporting robust DevSecOps practices.

This comprehensive skill guides the process of rapid malware triage and classification using YARA rules. It covers advanced techniques for writing detection rules based on unique strings, specific byte sequences, and structural PE characteristics. It is essential for security analysts building automated detection pipelines, scanning endpoints, or performing large-scale threat hunting across an enterprise environment.

This skill details implementing Software Composition Analysis (SCA) using Snyk. It helps security teams detect known vulnerabilities, check license compliance, and automate dependency remediation within CI/CD pipelines. Learn to integrate scanning into GitHub, GitLab, and Jenkins workflows, generate automated fix PRs, and continuously monitor deployed applications to safeguard the software supply chain.

Grype is an open-source vulnerability scanner from Anchore. It inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases (NVD, GitHub Advisories). Use it for security assessments, auditing, and integrating into CI/CD pipelines to enforce vulnerability standards and manage supply chain risks.

Kubesec is a powerful open-source tool designed to perform comprehensive security risk analysis on Kubernetes resource manifests (YAML/JSON). It automatically detects critical misconfigurations, potential privilege escalation vectors, and deviations from industry security best practices. It provides actionable scoring and hardening recommendations, making it essential for CI/CD pipelines, security auditing, and automated compliance checks.

AegisOps-AI is a professional-grade 'Living Pipeline' that integrates advanced AI reasoning directly into the SDLC. It acts as an intelligent gatekeeper, automating high-stakes audits across three domains: identifying memory vulnerabilities in Linux Kernel patches, detecting massive cost drifts in Terraform plans, and translating natural language security intent into hardened Kubernetes manifests.

This comprehensive workflow guides the design, optimization, and deployment of scalable, cost-effective Google Cloud Platform (GCP) architectures for both startups and large enterprises. It covers the full lifecycle, from gathering detailed requirements (compliance, SLA) and recommending optimal patterns (Serverless, GKE, Data Pipelines) to estimating costs, generating Infrastructure as Code (IaC) using Terraform, setting up CI/CD pipelines, and completing a thorough security review.

Automates CI/CD pipeline setup, from linting and type checks to integration, E2E, security, and deployment stages, plus feedback loops for AI agents and preview deployments.

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. This skill covers essential quality gates including unit testing, linting (golangci-lint), static analysis security testing (SAST), vulnerability scanning, dependency management, Docker builds, and automated releases using GoReleaser.