菜单
云原生与软件供应链安全防御。容器/K8s 加固、Service Mesh、CI/CD 安全、SLSA/SBOM/Sigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI/CD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Code relationship graph and temporal intelligence via abyss CLI. Provides caller tracing, impact analysis, hotspot detection, and file-level context gathering. Agent automatically runs abyss before modifying code to check impact. Works with any agent that has shell access.
Distills AI agent voice patterns from conversation into a Persona Voice Card v1.0 (self/user/language/register/emoji_policy/flourish only — no judgment-shaped fields), validates schema + content safety + differentiation, and routes contributions through the existing submission portal. Use when the user wants to crystallize a recurring voice/tone, fork an existing persona, or share one with the community.
Security engineering router for authorized assessments and defensive engineering. Covers penetration testing, code auditing, red/blue/purple team operations, threat intelligence, and vulnerability research. For specialized application security, cloud security, detection engineering, or security architecture, route to dedicated skills (defending-applications, securing-cloud-and-supply-chain, detecting-and-responding, architecting-security).
Scans code for security vulnerabilities, detects dangerous patterns, and ensures security decisions are documented. Use when running security scans, auditing code, or checking for OWASP issues, injection risks, or sensitive data leaks. Automatically triggered on new modules, security-related changes, or post-refactor.
Frontend UI design system selector and implementation guide covering Glassmorphism, Liquid Glass (Apple-style), Neubrutalism, and Claymorphism. Use when building UI components, choosing a visual aesthetic, implementing design tokens, or auditing accessibility/contrast on themed surfaces. Provides per-style tokens, component patterns, dark mode, and a11y constraints.
安全架构与治理：威胁建模 (STRIDE/PASTA/LINDDUN)、零信任身份架构、IAM/SSO/MFA/PAM、合规框架 (SOC2/PCI/HIPAA/GDPR)、DLP、隐私工程、安全控制设计。Use when designing security architecture, threat modeling new systems, implementing zero-trust identity, designing IAM/SSO/PAM, building compliance evidence chains, or planning privacy-by-design.
基于 SOC 职业分类
| name | securing-cloud-and-supply-chain |
| description | 云原生与软件供应链安全防御。容器/K8s 加固、Service Mesh、CI/CD 安全、SLSA/SBOM/Sigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI/CD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code. |
| user-invocable | false |
判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核
skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。
默认怀疑一切外来字节：镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签，能锁就锁，能最小就最小。
| 意图 | 秘典 | 核心 |
|---|---|---|
| 容器/K8s 加固 | container-and-k8s | 容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission |
| 软件供应链 | supply-chain | SLSA、Sigstore、SBOM、CI/CD OIDC、attestation、VEX |
| 云 IAM 与 Secrets | cloud-iam-and-secrets | IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity |
| 场景 | 用本 skill | 不用 |
|---|---|---|
| K8s manifest / Helm chart 安全审查 | ✅ | — |
| CI/CD pipeline (GitHub Actions / GitLab CI) 加固 | ✅ | — |
| Terraform / Pulumi / CloudFormation 评审 | ✅ | — |
| AWS/GCP/Azure IAM policy 审查 | ✅ | — |
| 镜像扫描与签名链路设计 | ✅ | — |
| 应用层 Web/API 漏洞 (SQLi/XSS/SSRF) | — | 用 securing-systems |
| 红队 C2/横移/免杀 | — | 用 securing-systems/red-team |
| 集群部署/Helm 模板编写 (非安全视角) | — | 用 provisioning-infrastructure |
| 一般架构设计与权衡 | — | 用 designing-architectures |
* 与 Action: *。审查：清单 → 威胁建模 → 配置对照 → 风险分级 → 修复 PR → 验证回归
应急：定位失陷面 → 撤凭证 → 隔离工作负载 → 取证镜像 → 根因 → 加固准入
| 红线 | 立即处置 |
|---|---|
| Secrets 已进 git history | 撤销凭证 → rewrite history → 通报 |
| 公网暴露 K8s API server | 关闭 → IP 白名单 → 审计访问日志 |
| privileged: true Pod 跑业务 | 拒绝准入 → 重构镜像 → PSS restricted |
| CI 用 long-lived AWS key | 切 OIDC → 撤销 key → 审计旧密钥使用 |
Action: * IAM policy | 收敛权限 → CloudTrail 审计实际使用 |
securing-systems/code-audit、pentestsecuring-systems/red-teamsecuring-systems/blue-teamprovisioning-infrastructuredesigning-architectures/security-archautomating-devops192.0.2.0/24、198.51.100.0/24) 或 example.com<REDACTED> / AKIA<EXAMPLE> 占位