Results for “secrets”

Automate Doppler Secretops operations through Composio's toolkit via Rube MCP, including tool discovery, connection management, and execution.

Generate production-grade Kubernetes manifests — Deployments with probes and security contexts, Services, Ingress with TLS, HPA, PDB, NetworkPolicy, ConfigMaps, Secrets — with optional Helm charts, Kustomize overlays, Istio mesh, and ArgoCD GitOps

Audita infraestrutura e pipeline em busca de vulnerabilidades, credenciais vazadas, IAM excessivo e exposição pública, com recomendações de hardening e classificação de severidade.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

Diseña y optimiza pipelines de CI/CD para GitHub Actions y GitLab CI, incluyendo automatización de tests, linting, builds y deploys.

Use this when reviewing whether an app, service, worker, CLI, or serverless system is ready for its target environment with respect to config, secrets, migrations, dependencies, observability, rollback, and runtime constraints.

Scan infrastructure-as-code — Dockerfiles, Compose, Terraform, and GitHub Actions — for security misconfigurations like running as root, world-writable files, unpinned actions, and hardcoded secrets. Pure Claude Code, no signup.

Scan Docker images for vulnerabilities, misconfigurations, secrets, and license violations using Trivy, with CI/CD integration and policy enforcement.

Diagnoses and operates Kubernetes clusters: pods, deployments, ingress, HPA, PVC, StorageClass, NetworkPolicy, Secrets, Helm, ArgoCD, cert-manager. Reads before changing; mutations require confirmation and diff review.

Agent profile for handle CI/CD, environments, build pipelines, deployment topology, secrets, and operational readiness. Use when Codex needs a specialist agent perspective for planning, implementation, review, debugging, validation, or handoff in this domain.

Manage a HashiCorp Vault PKI secrets engine to act as a certificate authority, issuing and rotating short-lived X.509 certificates for services and microservices.

Manage GitHub repositories end-to-end: clone, create, fork, configure settings, protect branches, set secrets, create releases, and run workflows using gh or git+curl.

Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Generates production-grade Kubernetes manifests including Deployments with probes and security contexts, Services, Ingress with TLS, HPA, PDB, NetworkPolicy, ConfigMaps, and Secrets, with optional Helm charts, Kustomize overlays, Istio mesh, and ArgoCD GitOps.

Scan codebase and git history for leaked secrets — API keys, tokens, passwords, private keys. Uses whispers-style regex patterns + gitleaks. Run as /leak-check before any git push. Alerts on Claude API keys, GitHub tokens, AWS credentials, and generic high-entropy strings.

Execute AEM Edge Delivery Services admin operations: manage content, cache, code, indexes, sitemaps, snapshots, logs, users, jobs, sites, config, secrets, API keys, tokens, profiles, and versioning. Also supports Document Authoring operations.

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

Systematically evaluates Kubernetes cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets using tools like kube-hunter, Kubescape, and kube-bench.

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.

Deploy Expo web apps and API routes to EAS Hosting (Cloudflare Workers), including export, deployment, environment secrets, custom domains, and authoring API routes with HTTP methods, CORS, and error handling.

Scaffolds or audits Zod-validated environment variables for a Next.js service, including src/lib/env.ts, .env.example, scripts/check-env.ts, and pnpm check:env. Use when adding env vars, auditing process.env usage, or aligning with deployment secrets.

Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.

Automates static analysis of Android APK/AAB files using MobSF to identify hardcoded secrets, insecure permissions, vulnerable components, and weak cryptography for pre-deployment security assessments or CI/CD integration.

Deploys static site build output to GoDaddy shared hosting via FTP using basic-ftp in Node.js and SamKirkland/FTP-Deploy-Action in CI. Use when: modifying deploy.js, troubleshooting FTP upload failures, changing remote directory structure, configuring FTP credentials in .env or GitHub Secrets, editing deploy workflows, or adding pre/post-deploy steps.

Manage and analyze SOPS-encrypted secret files, including key rotation, multi-provider encryption, and file-based secret operations. Covers encrypting and decrypting files, managing encryption keys (AWS KMS, GCP KMS, Azure Key Vault, PGP), auditing encrypted files, and comparing secret structures.

Hybrid security auditor for OpenClaw skills, Claude/Codex skills, and app repos. Use when installing a new skill, auditing a repo before use or deploy, reviewing custom scripts, checking for prompt injection, command execution, data exfiltration, dependency risk, secrets exposure, or privilege escalation. Use as the default gatekeeper before installing any third-party skill.

Expert knowledge for Azure Key Vault development including troubleshooting, best practices, decision making, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when managing vault/HSM keys & secrets, Private Link, Event Grid, key rotation, or RBAC vs access policies, and other Azure Key Vault related development tasks. Not for Azure Dedicated HSM (use azure-dedicated-hsm), Azure Cloud Hsm (use azure-cloud-hsm), Azure Payment Hsm (use azure-payment-hsm), Azure Information Protection (use azure-information-protection).

Deploy with unified build/test/deploy intent across providers using .agent-loom/deploy.yml and per-provider adapters. Load when the user asks to deploy, ship to preview, release to production, or run a provider-agnostic deploy flow. Also triggers on "deploy anywhere", "deploy to Vercel", "deploy with GitHub Actions", "preview deploy", or "ship this". Runs preflight before any deploy — stops on missing secrets. Pairs with ci-cd-and-automation for pipeline design. Ships vercel and github-actions adapters; extensible adapter interface.

Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enforces secure coding patterns, and automates compliance checks against SOC2, PCI-DSS, HIPAA, and GDPR. Use when conducting a security review or audit, responding to a CVE or security incident, hardening infrastructure, implementing authentication or secrets management, running penetration test prep, checking OWASP Top 10 exposure, or enforcing security controls in CI/CD pipelines.

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

Set up pre-commit hooks on a Python project — standard file-hygiene checks plus a security gate (gitleaks secret scanning, Trivy filesystem scan for CVEs/secrets/misconfigs, and Bandit Python SAST). Use this whenever the user wants to add, configure, or fix pre-commit hooks on a Python repo, mentions .pre-commit-config.yaml, wants secret/vulnerability/SAST scanning on commits, or is setting up code-quality guardrails — even if they just say 'add pre-commit hooks' without naming the tools. Especially for uv-based GenAI/LLM backends. Handles the setup gotchas that break first-time installs: the Trivy binary, the required data/html.tpl report template, bandit[toml] + [tool.bandit] config, and the right .gitignore entries.