skills.rest
DuqueOM
DuqueOMCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-audit

Detect security flaws in code, configurations, and containers before deployment.

5|Updated Nov 18, 2025
Search Tags:#security#audit#secrets#iam#ci-cd#sbom#image-signing
One-click install
npx skills add https://github.com/DuqueOM/ML-MLOps-Portfolio --skill security-audit-duqueom
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/DuqueOM/ML-MLOps-Portfolio/tree/main/.devin/skills/security-audit
Command: npx skills add https://github.com/DuqueOM/ML-MLOps-Portfolio --skill security-audit-duqueom

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents insecure configurations, secret leakage, and weak IAM posture by running pre-build and pre-deploy security checks across repositories and container images.

Core Features & Use Cases

  • Secret scanning with gitleaks to detect leaked credentials in code and repos
  • Dependency and image vulnerability scanning with Trivy, and SBOM generation with Syft
  • IAM least-privilege verification and workload identity checks for cloud environments

Quick Start

Run the security-audit skill before each build to block deployments on critical findings.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan for leaked secrets before deploying a container image?▼

Secret scanning detects leaked credentials in code and repositories using gitleaks, preventing secret leakage and weak IAM posture by running pre-build checks to block deployments on critical findings.

How do I generate an SBOM and scan container images for vulnerabilities in a CI/CD pipeline?▼

Generate an SBOM and scan container images for vulnerabilities by running pre-deploy security audits in your CI/CD pipeline, utilizing Trivy for vulnerability scanning and Syft for SBOM generation.

What is the best way to verify cloud IAM least-privilege and workload identity before deployment?▼

Verifying cloud IAM least-privilege and workload identity involves running pre-build security audits across cloud and Kubernetes environments to enforce IRSA and Workload Identity verification before deployment.

Does image signing with cosign work during pre-build security audits?▼

Image signing with cosign is enforced during pre-build security audits to ensure safe deployments across cloud and Kubernetes environments by verifying container image integrity before release.

Can I scan IaC configurations and repositories for security flaws before deployment?▼

Scanning IaC configurations and repositories for security flaws is supported during the pre-build and pre-deploy stages, detecting insecure configurations across CI/CD pipelines before cloud or Kubernetes deployment.

Related Skills

Explore More Software Engineering Skills→
shakhovskiya-createshakhovskiya-create

deploy-audit

Audit CI/CD pipelines and infrastructure configurations for security and reliability.

Community
Advanced
asanexampleasanexample
1

supply-chain-onboarding

Automate container image signing and verification in GitHub Actions with Kyverno cosign.

Official
Intermediate
adaptive-enforcement-labadaptive-enforcement-lab
3

iam-configuration

Enforce least-privilege IAM roles for GKE nodes and workloads with audit logging.

Official
Advanced
flatrickflatrick
1

springboot-verification

Automate build, static analysis, tests, coverage, and security scanning for Spring Boot projects.

Community
Advanced