How do I install the Devsecops Lookup skill?

Run npx skillmds@latest add aibot88/devsecops-lookup in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Devsecops Lookup safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Devsecops Lookup?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Devsecops Lookup free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Devsecops Lookup?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Devsecops Lookup by aibot88 — Agent Skill

Name: Devsecops Lookup
Rating: 4.2 (5 reviews)
Author: aibot88

Devsecops Lookup

Looks up OWASP DevSecOps Guideline phases, security tools, and pipeline checks. Returns tool configurations, CWE mappings, and integration patterns for CI/CD security. Use when user asks about "DevSecOps", "SAST", "DAST", "SCA", "container security", "IaC security", "secret detection", "gitleaks", "semgrep", "trivy", "pipeline security", "シークレット検出", "静的解析", "動的解析", "コンテナセキュリティ", "セキュリティゲート".

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

DevSecOps Guideline Lookup

Reference for OWASP DevSecOps Guideline phases, tools, and security checks.

Pipeline Phases

Phase	Activity	Key Tools
Develop	Pre-commit checks, Secret detection	Gitleaks, TruffleHog, pre-commit
Build	SAST, SCA, Container, IaC	Semgrep, Trivy, Hadolint, tfsec
Test	DAST, API Security, IAST	OWASP ZAP, Nuclei, Postman
Deploy	Security Gates, Config validation	Policy-as-code, Admission controllers
Operate	Monitoring, Vulnerability management	CNAPP, SIEM, Pentesting

Lookup Workflow

Identify the Query Type:
- Pipeline phase (develop, build, test, deploy, operate)
- Tool name (gitleaks, semgrep, trivy, etc.)
- Security activity (SAST, SCA, DAST, etc.)
- CWE reference

Search the Indexes:

# Phase lookup
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/pipeline-phases-index.json | jq '.phases["build"]'

# Tool lookup
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/tools-index.json | jq '.tools["semgrep"]'

# Search by keyword
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/tools-index.json | jq '[.tools | to_entries[] | select(.value.keywords | map(ascii_downcase) | any(contains("sast")))]'

# CWE to phase mapping
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/pipeline-phases-index.json | jq '[.phases | to_entries[] | select(.value.cwes | any(contains("CWE-798")))]'

Return Results with:
- What it does (summary)
- Installation command
- Usage example
- CI/CD integration pattern
- Official references

Response Format

### [Tool/Activity Name]

**Phase**: [develop|build|test|deploy|operate]
**Category**: [secret-detection|sast|sca|container|iac|dast|misconfig]

**What It Does**:
[1-2 sentence summary]

**Installation**:
\`\`\`bash
[install command]
\`\`\`

**Basic Usage**:
\`\`\`bash
[usage command]
\`\`\`

**CI/CD Integration** (GitHub Actions):
\`\`\`yaml
[workflow snippet]
\`\`\`

**CWE Coverage**: [list of CWEs]

**References**:
- [Tool URL]
- [OWASP DevSecOps Guideline URL]

Quick Reference: Tools by Phase

Develop (Pre-commit)

Tool	Purpose	Install
Gitleaks	Secret detection	`brew install gitleaks`
pre-commit	Hook management	`pip install pre-commit`
detect-secrets	Secret patterns	`pip install detect-secrets`

Build (CI)

Tool	Purpose	Install
Semgrep	SAST	`pip install semgrep`
Trivy	SCA + Container	`brew install trivy`
Hadolint	Dockerfile lint	`brew install hadolint`
tfsec	Terraform security	`brew install tfsec`
Checkov	IaC security	`pip install checkov`

Test (CD/Staging)

Tool	Purpose	Install
OWASP ZAP	DAST	Docker
Nuclei	Vulnerability scanner	`go install nuclei`

Index Coverage

pipeline-phases-index.json

All DevSecOps pipeline phases
Activities per phase
Recommended tools
CWE mappings
OWASP DevSecOps Guideline references

tools-index.json

15+ security tools
Installation commands
Usage patterns
CI/CD integration examples
Output format specifications

Example Queries

User: "How do I scan for secrets in CI?" You: Look up gitleaks in tools-index.json

User: "What's the build phase?" You: Look up build in pipeline-phases-index.json

User: "Terraform security scanning?" You: Look up tfsec or checkov in tools-index.json

User: "CWE-798 prevention?" You: Search for CWE-798 in phases, return secret detection tools

External Resources

---name: devsecops-lookupdescription: Looks up OWASP DevSecOps Guideline phases, security tools, and pipeline checks. Returns tool configurations, CWE mappings, and integration patterns for CI/CD security. Use when user asks about "DevSecOps", "SAST", "DAST", "SCA", "container security", "IaC security", "secret detection", "gitleaks", "semgrep", "trivy", "pipeline security", "シークレット検出", "静的解析", "動的解析", "コンテナセキュリティ", "セキュリティゲート".--- # DevSecOps Guideline Lookup Reference for OWASP DevSecOps Guideline phases, tools, and security checks. ## Pipeline Phases | Phase | Activity | Key Tools | |-------|----------|-----------| | Develop | Pre-commit checks, Secret detection | Gitleaks, TruffleHog, pre-commit | | Build | SAST, SCA, Container, IaC | Semgrep, Trivy, Hadolint, tfsec | | Test | DAST, API Security, IAST | OWASP ZAP, Nuclei, Postman | | Deploy | Security Gates, Config validation | Policy-as-code, Admission controllers | | Operate | Monitoring, Vulnerability management | CNAPP, SIEM, Pentesting | ## Lookup Workflow 1. **Identify the Query Type**: - Pipeline phase (develop, build, test, deploy, operate) - Tool name (gitleaks, semgrep, trivy, etc.) - Security activity (SAST, SCA, DAST, etc.) - CWE reference 2. **Search the Indexes**: ```bash # Phase lookup cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/pipeline-phases-index.json | jq '.phases["build"]' # Tool lookup cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/tools-index.json | jq '.tools["semgrep"]' # Search by keyword cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/tools-index.json | jq '[.tools | to_entries[] | select(.value.keywords | map(ascii_downcase) | any(contains("sast")))]' # CWE to phase mapping cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/pipeline-phases-index.json | jq '[.phases | to_entries[] | select(.value.cwes | any(contains("CWE-798")))]' ``` 3. **Return Results** with: - What it does (summary) - Installation command - Usage example - CI/CD integration pattern - Official references ## Response Format ```markdown ### [Tool/Activity Name] **Phase**: [develop|build|test|deploy|operate] **Category**: [secret-detection|sast|sca|container|iac|dast|misconfig] **What It Does**: [1-2 sentence summary] **Installation**: \`\`\`bash [install command] \`\`\` **Basic Usage**: \`\`\`bash [usage command] \`\`\` **CI/CD Integration** (GitHub Actions): \`\`\`yaml [workflow snippet] \`\`\` **CWE Coverage**: [list of CWEs] **References**: - [Tool URL] - [OWASP DevSecOps Guideline URL] ``` ## Quick Reference: Tools by Phase ### Develop (Pre-commit) | Tool | Purpose | Install | |------|---------|---------| | Gitleaks | Secret detection | `brew install gitleaks` | | pre-commit | Hook management | `pip install pre-commit` | | detect-secrets | Secret patterns | `pip install detect-secrets` | ### Build (CI) | Tool | Purpose | Install | |------|---------|---------| | Semgrep | SAST | `pip install semgrep` | | Trivy | SCA + Container | `brew install trivy` | | Hadolint | Dockerfile lint | `brew install hadolint` | | tfsec | Terraform security | `brew install tfsec` | | Checkov | IaC security | `pip install checkov` | ### Test (CD/Staging) | Tool | Purpose | Install | |------|---------|---------| | OWASP ZAP | DAST | Docker | | Nuclei | Vulnerability scanner | `go install nuclei` | ## Index Coverage ### pipeline-phases-index.json - All DevSecOps pipeline phases - Activities per phase - Recommended tools - CWE mappings - OWASP DevSecOps Guideline references ### tools-index.json - 15+ security tools - Installation commands - Usage patterns - CI/CD integration examples - Output format specifications ## Example Queries **User**: "How do I scan for secrets in CI?" **You**: Look up `gitleaks` in tools-index.json **User**: "What's the build phase?" **You**: Look up `build` in pipeline-phases-index.json **User**: "Terraform security scanning?" **You**: Look up `tfsec` or `checkov` in tools-index.json **User**: "CWE-798 prevention?" **You**: Search for CWE-798 in phases, return secret detection tools ## External Resources - [OWASP DevSecOps Guideline](https://owasp.org/www-project-devsecops-guideline/) - [OWASP DevSecOps Guideline (Japanese)](https://coky-t.gitbook.io/owasp-devsecops-guideline-ja/) - [CWE/SANS Top 25](https://cwe.mitre.org/top25/) - [NIST SSDF](https://csrc.nist.gov/Projects/ssdf)

Frequently asked questions