Menu
Security checks for Fawkes — secrets, RBAC, container security. Load before security changes.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Architecture Decision Record template and quality checklist with DORA capability linkage. Use when documenting an architectural decision that agents must follow going forward.
Step-by-step OpenTelemetry and uFawkesObs setup: SDK init patterns for TypeScript, Python, Go; DORA metric spans; Grafana dashboard spec. Use when adding observability to a service.
Step-by-step guide to connect a uFawkesAI project to uFawkesPipe and fawkes platform: Dockerfile, ArgoCD manifest, DORA deployment spans. Use when setting up CI/CD for a new service.
Pre-merge security checklist covering secrets, dependencies, auth, data handling, and fawkes suite gates. Use when reviewing a PR for security issues or hardening a change before merge.
TDD patterns and language-specific test examples for TypeScript/Jest, Python/pytest, and Go. Use when writing tests, increasing coverage, or implementing test-driven development.
Add DORA metrics instrumentation to GitHub Actions workflows — job timestamps, deployment tracking, lead time calculation. Load when adding DORA logging to workflows.
| name | security-hardening |
| description | Security checks for Fawkes — secrets, RBAC, container security. Load before security changes. |
| license | MIT |
| compatibility | opencode |
Container security (every pod):
securityContext:
runAsNonRoot: true
runAsUser: 1000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities: { drop: [ALL] }
Secrets: secretKeyRef in K8s, ${{ secrets.X }} in CI, sensitive = true in Terraform. Never plaintext.
RBAC: Role not ClusterRole unless multi-namespace needed. No wildcard verbs.
SAST checks:
grep -rn "subprocess.*shell=True\|os\.system\|eval(" services/
grep -rEn "(password|secret|token)\s*=\s*['\"][^'\"]" services/ infra/ platform/
grep -L "runAsNonRoot: true" platform/apps/*/deployment.yaml