skills.rest
jvsandhu
jvsandhuCOMMUNITY
Explore all skills by this author →
GitHub

secops_core

Scan code, dependencies, and containers for vulnerabilities and compliance gaps.

Updated Jan 14, 2026
Search Tags:#owasp#compliance#security audit#container security#devsecops#vulnerability scanning#trivy
One-click install
npx skills add https://github.com/jvsandhu/agentic-skills --skill secops-core-jvsandhu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secops_core
Source: https://github.com/jvsandhu/agentic-skills/tree/main/skills/secops_core
Command: npx skills add https://github.com/jvsandhu/agentic-skills --skill secops-core-jvsandhu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security teams and developers struggle to consistently detect vulnerabilities across code, dependencies, and container images while meeting OWASP controls and compliance requirements. This Skill consolidates security scanning, vulnerability assessment, and compliance checking into one auditable workflow. ## Core Features & Use Cases - Security Scanning: Run automated scans with the security_scanner.py script plus tools like Semgrep, Bandit, and ESLint security rules to detect hardcoded secrets, injection flaws, and unsafe deserialization. - Vulnerability Assessment: Audit dependencies with npm audit, pip-audit, and Snyk, and scan container images with Trivy, with severity-based response SLAs (Critical: 24h, High: 1 week). - Compliance Checking: Validate OWASP Top 10 controls, GDPR/KVKK data protection requirements, and DevSecOps pipeline checkpoints using the compliance_checker.py script and reference guides. - Use Case: Before deploying a Docker image, ask the agent to scan it with Trivy, audit npm dependencies, and verify OWASP access-control and cryptographic checklists, producing a remediation report. ## Quick Start Ask the agent to run a full security audit on your project, including dependency vulnerability scanning, OWASP Top 10 checks, and a container image scan before deployment.

Frequently Asked Questions about secops_core

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Docker container image for vulnerabilities?▼

Run a Trivy or Snyk scan against the full image name including its tag, such as myapp:latest. The scan returns identified vulnerabilities with severity levels and suggested remediation steps before deployment.

How to audit npm dependencies for security vulnerabilities?▼

Run npm audit to list known vulnerabilities, then npm audit fix to apply compatible patches. For deeper analysis use npx snyk test, and automate ongoing checks with a Dependabot configuration in GitHub.

What tools check OWASP Top 10 controls in code?▼

Use Semgrep with the auto config for general static analysis, Bandit for Python, and ESLint security rules for JavaScript and TypeScript. These detect injection flaws, hardcoded secrets, and XSS risks mapped to OWASP categories.

Trivy vs Snyk for container security scanning?▼

Both scan container images for known vulnerabilities and report severity levels. Trivy is commonly used for pre-deployment image scans, while Snyk also supports scanning running containers and integrates with monitoring workflows.

How should vulnerability severity affect remediation timelines?▼

Critical vulnerabilities should be patched immediately or within 24 hours, high severity within one week, medium within the sprint, and low severity scheduled into the backlog. Track all findings in a central dashboard such as DefectDojo.

Why does npm audit fail to fix some vulnerabilities?▼

npm audit fix only applies patches within compatible semver ranges. Vulnerabilities requiring major version upgrades need manual updates or npm audit fix --force, which may introduce breaking changes requiring code adjustments.

Related Skills

Explore More Software Engineering Skills→
dieguscldieguscl

docker-build

Build and test Docker images locally with security scanning.

Community
Intermediate
GaryOcean428GaryOcean428

security-audit

Detect secrets, insecure dependencies, and vulnerable patterns in codebases.

Community
Advanced
naviktnavikt
1

security-review

Scan secrets and vulnerabilities in Nav codebases during pre-commit and pre-PR workflows.

Official
Advanced
langbyyilangbyyi
96

business-logic-vulnerabilities

Identifies high-severity business logic vulnerabilities in web applications.

Community
Advanced