菜单
云原生与软件供应链安全防御。容器/K8s 加固、Service Mesh、CI/CD 安全、SLSA/SBOM/Sigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI/CD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/telagod/code-abyss --skill securing-cloud-and-supply-chain命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Scans code for security vulnerabilities, detects dangerous patterns, and ensures security decisions are documented. Use when running security scans, auditing code, or checking for OWASP issues, injection risks, or sensitive data leaks. Automatically triggered on new modules, security-related changes, or post-refactor.
Checks code quality metrics including complexity, duplication, naming conventions, and function length. Use when running quality gates, reviewing code smells, or checking lint rules. Automatically triggered on complex modules or post-refactor.
Distills AI agent voice patterns from conversation into a Persona Voice Card v1.0 (self/user/language/register/emoji_policy/flourish only — no judgment-shaped fields), validates schema + content safety + differentiation, and routes contributions through the existing submission portal. Use when the user wants to crystallize a recurring voice/tone, fork an existing persona, or share one with the community.
基于 SOC 职业分类
正在显示 SKILL.md
| name | securing-cloud-and-supply-chain |
| description | 云原生与软件供应链安全防御。容器/K8s 加固、Service Mesh、CI/CD 安全、SLSA/SBOM/Sigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI/CD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code. |
| user-invocable | false |
判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核
skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。
默认怀疑一切外来字节：镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签，能锁就锁，能最小就最小。
| 意图 | 秘典 | 核心 |
|---|---|---|
| 容器/K8s 加固 | container-and-k8s | 容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission |
| 软件供应链 | supply-chain | SLSA、Sigstore、SBOM、CI/CD OIDC、attestation、VEX |
| 云 IAM 与 Secrets | cloud-iam-and-secrets | IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity |
| 场景 | 用本 skill | 不用 |
|---|---|---|
| K8s manifest / Helm chart 安全审查 | ✅ | — |
| CI/CD pipeline (GitHub Actions / GitLab CI) 加固 | ✅ | — |
| Terraform / Pulumi / CloudFormation 评审 | ✅ | — |
| AWS/GCP/Azure IAM policy 审查 | ✅ | — |
| 镜像扫描与签名链路设计 | ✅ | — |
| 应用层 Web/API 漏洞 (SQLi/XSS/SSRF) | — | 用 securing-systems |
| 红队 C2/横移/免杀 | — | 用 securing-systems/red-team |
| 集群部署/Helm 模板编写 (非安全视角) | — | 用 provisioning-infrastructure |
| 一般架构设计与权衡 | — | 用 designing-architectures |
* 与 Action: *。审查：清单 → 威胁建模 → 配置对照 → 风险分级 → 修复 PR → 验证回归
应急：定位失陷面 → 撤凭证 → 隔离工作负载 → 取证镜像 → 根因 → 加固准入
| 红线 | 立即处置 |
|---|---|
| Secrets 已进 git history | 撤销凭证 → rewrite history → 通报 |
| 公网暴露 K8s API server | 关闭 → IP 白名单 → 审计访问日志 |
| privileged: true Pod 跑业务 | 拒绝准入 → 重构镜像 → PSS restricted |
| CI 用 long-lived AWS key | 切 OIDC → 撤销 key → 审计旧密钥使用 |
Action: * IAM policy | 收敛权限 → CloudTrail 审计实际使用 |
securing-systems/code-audit、pentestsecuring-systems/red-teamsecuring-systems/blue-teamprovisioning-infrastructuredesigning-architectures/security-archautomating-devops192.0.2.0/24、198.51.100.0/24) 或 example.com<REDACTED> / AKIA<EXAMPLE> 占位