skills.rest
nebius
nebiusOFFICIAL
Explore all skills by this author →
WebsiteGitHub

apply-security

Review code, infrastructure, and CI/CD for security risks and apply authorized minimal remediations.

7|5|Updated Jul 22, 2025
Search Tags:#ci/cd#remediation#kubernetes#security review#terraform#vulnerability scanning#sarif
One-click install
npx skills add https://github.com/nebius/nebius-ps-services --skill apply-security-nebius
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: apply-security
Source: https://github.com/nebius/nebius-ps-services/tree/main/skills/apply-security
Command: npx skills add https://github.com/nebius/nebius-ps-services --skill apply-security-nebius

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security issues in Terraform, Kubernetes, Helm, CI/CD workflows, and application code often go unnoticed until they cause credential exposure, privilege escalation, or public data leaks. This Skill provides a structured security review workflow that finds real risks, ranks them by severity and exploitability, and applies only safe, behavior-preserving fixes. ## Core Features & Use Cases - Multi-Area Security Scanning: Reviews Terraform, Kubernetes manifests, Helm charts, CI/CD workflows, and application code in Python, Java, JavaScript, TypeScript, Rust, and Bash using stable finding IDs and severity/confidence classification. - Safe Remediation Policy: Patches low-risk issues directly (log redaction, least-privilege workflow permissions, shell quoting) while requiring explicit approval for IAM, auth, crypto, public exposure, or availability-impacting changes. - Structured Reporting: Produces prioritized findings in Markdown, JSON, or SARIF-style output with risk, root cause, recommended fix, feature impact, and safe override fields. - Use Case: Before merging a PR that adds a new Kubernetes deployment and GitHub Actions workflow, run a security scan to catch missing security contexts, broad token permissions, and unpinned actions, then apply the safe fixes automatically. ## Quick Start Ask the agent to review the current diff or a specific directory for security risks and apply only safe low-risk fixes.

Frequently Asked Questions about apply-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Terraform and Kubernetes code for security risks?▼

Run the skill in scan mode against your repository, diff, or specific paths. It checks Terraform for wildcard IAM, public ingress, and secrets in state, and Kubernetes for privileged containers, missing security contexts, and RBAC issues, returning prioritized findings.

What security issues does it detect in CI/CD workflows?▼

It flags missing or broad token permissions, unsafe pull_request_target usage, secret leakage in logs or artifacts, unpinned third-party actions, and curl-pipe-shell patterns. Safe fixes like adding permissions: read-all can be applied directly.

Can it automatically fix security findings?▼

Yes, but only for low-risk local changes such as log redaction, shell quoting, sensitive = true on Terraform variables, and compatible security contexts. High-risk changes involving IAM, auth, crypto, or public exposure require explicit approval first.

Does it support SARIF or JSON output for security findings?▼

Yes, findings can be emitted as Markdown by default, as a JSON array with severity and remediation fields, or as SARIF 2.1.0-style output mapping finding IDs to ruleId and file locations for tool integration.

What are the limitations of automated security review?▼

It cannot determine whether public exposure is intentional, whether IAM permissions are all required, or whether a secret is active without runtime and environment context. Such findings are marked with lower confidence and require human approval rather than automatic changes.

Related Skills

Explore More Software Engineering Skills→
MDLDev-siteMDLDev-site

security-sentinel

Identifies and remediates security vulnerabilities in code, configurations, and infrastructure.

Official
Advanced
nicolasmosquerarnicolasmosquerar
1

Policy as Code

Enforce infrastructure policies on Terraform and CDK workflows in CI/CD pipelines.

Community
Advanced
viraatdasviraatdas

cso

Identify and remediate security risks across infrastructure, supply chain, and code.

Community
Advanced
mechemsimechemsi

ci-cd-pipeline

Automate CI/CD quality gates in GitHub Actions workflows with security scanners.

Community
Advanced