메뉴
Security checks for Fawkes — secrets, RBAC, container security. Load before security changes.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Architecture Decision Record template and quality checklist with DORA capability linkage. Use when documenting an architectural decision that agents must follow going forward.
Step-by-step OpenTelemetry and uFawkesObs setup: SDK init patterns for TypeScript, Python, Go; DORA metric spans; Grafana dashboard spec. Use when adding observability to a service.
Step-by-step guide to connect a uFawkesAI project to uFawkesPipe and fawkes platform: Dockerfile, ArgoCD manifest, DORA deployment spans. Use when setting up CI/CD for a new service.
Pre-merge security checklist covering secrets, dependencies, auth, data handling, and fawkes suite gates. Use when reviewing a PR for security issues or hardening a change before merge.
TDD patterns and language-specific test examples for TypeScript/Jest, Python/pytest, and Go. Use when writing tests, increasing coverage, or implementing test-driven development.
Add DORA metrics instrumentation to GitHub Actions workflows — job timestamps, deployment tracking, lead time calculation. Load when adding DORA logging to workflows.
| name | security-hardening |
| description | Security checks for Fawkes — secrets, RBAC, container security. Load before security changes. |
| license | MIT |
| compatibility | opencode |
Container security (every pod):
securityContext:
runAsNonRoot: true
runAsUser: 1000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities: { drop: [ALL] }
Secrets: secretKeyRef in K8s, ${{ secrets.X }} in CI, sensitive = true in Terraform. Never plaintext.
RBAC: Role not ClusterRole unless multi-namespace needed. No wildcard verbs.
SAST checks:
grep -rn "subprocess.*shell=True\|os\.system\|eval(" services/
grep -rEn "(password|secret|token)\s*=\s*['\"][^'\"]" services/ infra/ platform/
grep -L "runAsNonRoot: true" platform/apps/*/deployment.yaml