Skill UI

Track trojanized updates, compromised dependencies, unauthorized code edits, and tampered build artifacts by querying EDR/SIEM telemetry, correlating indicators, and documenting findings for rapid response in proactive threat-hunting campaigns.

Use Sigstore Cosign to sign, attest, and verify container images with keyless OIDC signing, SBOM/vulnerability attestations, and CI/CD admission enforcement for supply chain provenance security.

Provides a structured approach for implementing NERC CIP compliance controls across BES cyber systems, covering categorization, electronic security perimeters, security and configuration management, supply chain risk, and the 2025 MFA plus low-impact asset updates.

Implements container build integrity by orchestrating in-toto attestations across CI/CD steps, ensuring signed provenance, SBOMs, and policy-compliant deployment verification in Kubernetes environments.

Simulates and detects software supply chain attacks by checking typosquatting risks with Levenshtein distance, probing dependency confusion across registries, verifying package hashes, and running pip-audit vulnerability scans for security assessments.

Harden serverless compute on AWS Lambda, Azure Functions, and Google Cloud Functions by enforcing least-privilege IAM roles, moving secrets into vaults, scanning dependencies, validating inputs, securing function URLs, and monitoring runtimes so injections, credential theft, and supply-chain threats are caught before deployment.

Parses CycloneDX and SPDX SBOMs, maps components to the NVD CVE catalog, scores their risk via dependency graphs, and produces compliance-ready reports for supply chain security assessments and automated CI/CD scans.

This skill provides robust mechanisms to verify the integrity of AI agent plugins, tools, and dependencies. It generates deterministic SHA-256 manifests (INTEGRITY.json) for all components, allowing users to detect unauthorized modifications, track provenance, and ensure that deployed assets match their published versions. Use this during CI/CD pipelines, code review, and pre-production promotion to secure the entire agent ecosystem.

Checks AI agent implementations against the OWASP Agentic Security Initiative Top 10 risks, producing findings on controls, vulnerabilities, and recommendations for prompt injection, tool governance, escalation, logging, identity, policy, supply chain, and behavioral monitoring before production or audit.