skills.rest
qenex-ai
qenex-aiOFFICIAL
Explore all skills by this author →
GitHub

Security and Compliance

Identify security vulnerabilities and compliance gaps across code, configurations, and CI/CD pipelines.

Updated Aug 23, 2026
Search Tags:#security#compliance#SAST#secrets-management#infrastructure-security#dependency-scanning
One-click install
npx skills add https://github.com/qenex-ai/devops-plugin --skill security-and-compliance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Security and Compliance
Source: https://github.com/qenex-ai/devops-plugin/tree/main/skills/security-compliance
Command: npx skills add https://github.com/qenex-ai/devops-plugin --skill security-and-compliance

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill provides structured guidance and tooling for configuring and auditing security controls, managing secrets, and enforcing secure coding and deployment practices, reducing risk across software and infrastructure.

Core Features & Use Cases

  • Security Scanning: SAST/DAST workflows (CodeQL, Semgrep, Bandit) and container security checks integrated into CI.
  • Dependency & Secrets Management: Dependency scanning, secret scanning, and secure storage practices.
  • Infrastructure & Application Security: IaC checks (Checkov, tfsec), Kubernetes hardening, and secure configurations.
  • Use Case: A development team runs a security sweep on a pull request to surface critical vulnerabilities and policy violations before merge.

Quick Start

Trigger a security scan on your project using your CI workflow to run CodeQL/Semgrep and dependency checks.

Frequently Asked Questions about Security and Compliance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security scans and compliance checks in my CI/CD pipeline?▼

You can automate security scans and compliance checks by integrating SAST workflows like CodeQL or Semgrep into your CI pipeline to proactively surface vulnerabilities and policy violations before code merge.

What is the best way to scan infrastructure as code for misconfigurations?▼

Scanning infrastructure as code for misconfigurations is best handled using standard IaC checking tools like Checkov or tfsec to identify compliance gaps and enforce secure configurations across your deployments.

Can I use this for dependency scanning and secrets management?▼

Yes, this supports dependency scanning and secrets management by applying standard scanning tools and secure storage practices to identify exposed secrets and vulnerable dependencies across your software projects.

Does this approach work for Kubernetes hardening and container security?▼

Yes, this approach works for Kubernetes hardening and container security by applying structured security checks and best practices to your container configurations and deployment workflows.

When do I need static analysis for my pull requests?▼

You need static analysis for pull requests when you want to run a security sweep to detect critical vulnerabilities and enforce secure coding practices before merging code changes into the main branch.

Related Skills

Explore More Legal & Compliance Skills→
wtthorntonwtthornton
4

ops

Scan codebases and infrastructure for vulnerabilities and compliance gaps.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

security-scanning-workflows

Automate SAST, dependency, and container security scans in CI/CD pipelines.

Official
Advanced
claudcherejiclaudchereji

security-engineer

Automate vulnerability scanning and compliance reporting for cloud infrastructure.

Community
Advanced
JosiahSiegelJosiahSiegel
51

defender-for-devops

Integrate Microsoft Defender for DevOps into Azure Pipelines for automated security scanning.

Community
Advanced