Skill UI

Implement policy as code using OPA, Kyverno, and Sentinel to automate compliance enforcement in CI/CD pipelines. Define security rules for infrastructure and Kubernetes resources, preventing violations before production deployment. Ideal for DevSecOps teams ensuring consistent governance across cloud environments.

This skill performs Static Application Security Testing (SAST) to detect code vulnerabilities across multiple programming languages and frameworks. It helps identify injection flaws, hardcoded secrets, and security policy violations before deployment. Suitable for code reviews, compliance checks like OWASP, and legacy code assessment. Requires source code access and is not for runtime testing.

Expert in Terraform and OpenTofu for Infrastructure as Code (IaC). Covers advanced module design, state management, multi-cloud deployments, and CI/CD automation. Ensures secure, scalable, and compliant enterprise infrastructure patterns through policy-as-code and GitOps workflows.

Policy and workflow for reviewing AI-generated code before merge or execution. Covers AST-based static checks, dependency advisories, isolated behavior tests, and evidence collection with language-specific coverage limits.