skills.rest
devendrapratapsingh
devendrapratapsinghCOMMUNITY
Explore all skills by this author →
GitHub

security

Scan code, containers, and infrastructure for security vulnerabilities.

1|Updated Mar 11, 2026
Search Tags:#security#compliance#secrets management#container security#vulnerability management#devsecops#iac security
One-click install
npx skills add https://github.com/devendrapratapsingh/bizbuddy-ai-agent --skill security-devendrapratapsingh
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/devendrapratapsingh/bizbuddy-ai-agent/tree/main/.claude/skills/security
Command: npx skills add https://github.com/devendrapratapsingh/bizbuddy-ai-agent --skill security-devendrapratapsingh

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the critical need to integrate robust security practices throughout the software development lifecycle, from code to deployment, mitigating vulnerabilities and ensuring compliance.

Core Features & Use Cases

  • Proactive Vulnerability Detection: Scans code (SAST, DAST), dependencies, containers, and infrastructure configurations for known and potential security flaws.
  • Secure Secrets Management: Automates the secure storage, rotation, and access control of sensitive credentials and keys.
  • Compliance Enforcement: Implements and verifies adherence to security benchmarks and regulatory standards using Policy as Code.
  • Use Case: Automatically scan a new microservice's container image for critical vulnerabilities before it's deployed to production, and ensure all API keys are securely managed via Vault.

Quick Start

Use the security skill to scan the current project's Terraform files for security misconfigurations.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Terraform files for security misconfigurations?▼

Scanning Terraform files for security misconfigurations involves using IaC security tools like TFSec and Checkov. This Skill evaluates your infrastructure configurations against predefined security benchmarks to detect and prevent potential vulnerabilities before cloud deployment.

What is the best way to automate secrets rotation in a CI/CD pipeline?▼

Automating secrets rotation in a CI/CD pipeline is achieved by integrating a secure secrets management tool like Vault. This Skill implements DevSecOps practices to securely store, automatically rotate, and enforce access control for sensitive credentials across your environments.

Can I use Trivy to scan container images for vulnerabilities before production deployment?▼

Yes, you can use Trivy to scan container images for vulnerabilities before production deployment. This Skill integrates container security scanning directly into your CI/CD pipelines to detect known flaws and enforce security hardening across your cloud environments.

Does this approach support compliance checks using Policy as Code?▼

Yes, this approach supports compliance checks using Policy as Code through Open Policy Agent (OPA). It implements and verifies adherence to regulatory standards and security benchmarks, ensuring your infrastructure configurations continuously meet required compliance frameworks.

When do I need SAST and DAST scanning for my codebase?▼

You need SAST and DAST scanning for your codebase when integrating DevSecOps practices throughout the software development lifecycle. SAST analyzes source code for potential security flaws, while DAST tests running applications to proactively mitigate vulnerabilities before deployment.

Related Skills

Explore More Software Engineering Skills→
maroffomaroffo
16

terraform

Manages AWS-like cloud infrastructure code with Terraform and Trello.

Community
Advanced
AngelP17AngelP17
1

senior-devops

Automate CI/CD pipelines, infrastructure provisioning, and deployments across AWS, GCP, and Azure.

Community
Intermediate
joshuakesselljoshuakessell

security

Enforce OWASP security patterns and automated security testing in CI/CD pipelines.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

platform-security

Audit container images, Kubernetes configurations, cloud environments, and infrastructure as code for security vulnerabilities.

Community
Advanced