Chargement du README du dépôt…
Affichage de 15 skills collectés sur 15.
Build and maintain a threat model for a target codebase. Six modes: "interview" walks an application owner through the four-question framework; "bootstrap" derives a model from code plus past vulnerabilities (CVEs, git history, pentest reports, --context…
Langue du texte source : anglais
Use when the user asks to perform a security audit, security review, vulnerability assessment, or code analysis of a GitHub repository, operator, or batch of repositories using OWASP ASVS, OWASP Kubernetes Top 10, CIS Kubernetes Benchmark, DISA STIG, SLSA,…
Langue du texte source : anglais
Use when the user asks what the campaign or harness is costing, how spend is trending, which business unit a cost lands on, cost per finding or per repo, whether spend is on budget, or asks to capture/refresh financial tracking over time — e.g. "what did July…
Langue du texte source : anglais
Use before committing any new or edited skill to the traust repo, or when asked "are the skills aligned", "did my skill drift from the conventions", "run the alignment check" — runs python3 -m traust.cli check skill-alignment, the cross-skill contract guard…
Langue du texte source : anglais
Use when the user asks to validate, reproduce, exploit, red-team, or live-test security findings against a Kubernetes/OpenShift cluster, operator, WASM module, container, pod, or cluster component. Ingests *-security-audit, *-threat-model, and *-triage…
Langue du texte source : anglais
Use when the user asks code-level portfolio questions or to build/refresh/query the portfolio source-code graph — "which products depend on module X" / CVE blast radius, "top shared libraries", "internal library coupling", "rebuild the portfolio graph",…
Langue du texte source : anglais
Use when the user asks to remediate, patch, fix, or produce a code fix for a security finding from the audit campaign — creating a minimal reviewable patch on a private fork, running the repo's own build/test suite, and emitting a schema-validated remediation…
Langue du texte source : anglais
Use when the user asks for campaign metrics, a leadership scoreboard, or to (re)build/refresh progress-tracker/metrics/traust-metrics.md. Deterministically harvests headline numbers from the campaign's derived artifacts (executive summary, validation/fuzz…
Langue du texte source : anglais
Use when the user asks whether an operator runs with least privilege, what SCCs/securityContext/namespaces/roles an operator uses or requires, or for a fleet least-privilege inventory of OpenShift core and optional operators. Builds a deterministic…
Langue du texte source : anglais
Use when the user asks to write, scaffold, run, or extend a fuzz harness for a parser/decoder/templater identified in a security-audit report — Go-native by default, plus Python (atheris), JavaScript/TypeScript (Jazzer.js), Rust (cargo-fuzz), and Java…
Langue du texte source : anglais
Use when the user provides a previous secure-code-audit report and a patched version of the scanned repository, and asks to verify that findings have been resolved. Performs a targeted re-audit of each original finding against the patched code using the same…
Langue du texte source : anglais
Use when the user asks for an executive summary, leadership roll-up, or cross-portfolio dashboard of security-audit findings — e.g. "summarise all findings", "how many criticals do we have", "credential leaks across the campaign", "findings by language", or…
Langue du texte source : anglais
Use when the user asks an ad-hoc question over the findings corpus that reads like a query — "open criticals by business unit", "which repos have the most confirmed findings", "distinct CWE-1104 exposure across products", "how many findings were validated…
Langue du texte source : anglais
Build or refresh the portfolio repository graph. Reads every segment of the inputs inventory (`locations.inputs`) by the kind declared in `<inputs>/inventory.yaml` (groups / release-payload / catalog / services; ansible/ excluded by default), cross-references…
Langue du texte source : anglais
Use when the user asks for a fleet-wide or portfolio-wide view of threats (not findings) — "how many unmitigated critical threats do we have", "threat register", "which products carry the most open threat exposure", "what class-closing mitigations would pay…
Langue du texte source : anglais
Copiez ce prompt dans l’assistant IA que vous utilisez.
Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/openshift/traust.Le README n’a pas pu être chargé. Vous pouvez toujours consulter les Skills du dépôt ci-dessous.