Security
Unified skill for security assessment and intelligence workflows.
Workflow Routing
| Request Pattern |
Route To |
| Recon, reconnaissance, port scan, subdomain, DNS, WHOIS, ASN |
Recon/SKILL.md |
| Web assessment, OWASP, pentest, ffuf, app security, threat modeling, STRIDE, DREAD, PASTA, threat model |
WebAssessment/SKILL.md |
| Prompt injection, jailbreak, LLM security, guardrail bypass |
PromptInjection/SKILL.md |
| Security news, sec updates, breaches, tldrsec, security research |
SECUpdates/SKILL.md |
| Annual reports, security trends, threat landscape, vendor reports |
AnnualReports/SKILL.md |
| Secure coding, vulnerability prevention, defense patterns, security review code |
SecureCoding/SKILL.md |
| Supply chain, dependency audit, package security, new dependency check |
SupplyChain.md |
| Secret audit, scan for secrets, find leaked keys, git history secrets |
SecureCoding/SKILL.md |
| Trivy, vulnerability scan, CVE, container scan, IaC scan |
See Trivy Vulnerability Scanning below |
| sops, encrypt secrets, decrypt secrets |
See sops Secrets Management below |
Trivy Vulnerability Scanning
Scan projects, containers, and infrastructure-as-code for known vulnerabilities.
# Scan project directory for CVEs
trivy fs --format json . | jq '.Results[] | select(.Vulnerabilities) | .Vulnerabilities[] | select(.Severity == "CRITICAL")'
# Scan container image
trivy image --format json myapp:latest
# Scan IaC (Terraform, CloudFormation)
trivy config --format json ./infrastructure/
# CI gate — fail on critical
trivy fs --exit-code 1 --severity CRITICAL .
When to use:
- Before deploying — scan the project for known CVEs
- Container builds — scan images before pushing to registry
- IaC review — catch misconfigurations in Terraform/CloudFormation before apply
- CI pipelines — add
--exit-code 1 to fail the build on critical findings
Triage approach:
- Run
trivy fs --format json . to get full results
- Filter to CRITICAL and HIGH severity first
- Check if vulnerable code paths are actually reachable
- Update dependencies where possible, document accepted risks where not
sops Secrets Management
Encrypt and decrypt secrets files using Mozilla sops with age keys.
# Encrypt a file with age key
sops --encrypt --age age1... secrets.yaml > secrets.enc.yaml
# Decrypt
sops --decrypt secrets.enc.yaml
# Edit encrypted file in place
sops secrets.enc.yaml
When to use:
- Storing secrets in git — encrypt with sops so they can be version-controlled safely
- Sharing secrets across team/agents — encrypted files can be committed and shared
- Rotating secrets — edit in place with
sops secrets.enc.yaml
Rules:
- Never commit unencrypted secrets files
- Use age keys (not PGP) for new setups — simpler key management
- Store the age key outside the repo (e.g.,
~/.config/sops/age/keys.txt)
Examples
Example 1: User: "[typical request]" → Routes to appropriate sub-skill workflow
Example 2: User: "[another request]" → Routes to different sub-skill workflow
1---2name: security3description: Security assessment — network recon, web app testing, prompt injection testing, security news, and vulnerability scanning. USE WHEN recon, port scan, subdomain, DNS, WHOIS, pentest, threat model, OWASP, prompt injection, LLM security, security news, trivy, CVE, vulnerability scan, sops, encrypt secrets.4---56# Security78Unified skill for security assessment and intelligence workflows.910## Workflow Routing1112| Request Pattern | Route To |13|---|---|14| Recon, reconnaissance, port scan, subdomain, DNS, WHOIS, ASN | `Recon/SKILL.md` |15| Web assessment, OWASP, pentest, ffuf, app security, threat modeling, STRIDE, DREAD, PASTA, threat model | `WebAssessment/SKILL.md` |16| Prompt injection, jailbreak, LLM security, guardrail bypass | `PromptInjection/SKILL.md` |17| Security news, sec updates, breaches, tldrsec, security research | `SECUpdates/SKILL.md` |18| Annual reports, security trends, threat landscape, vendor reports | `AnnualReports/SKILL.md` |19| Secure coding, vulnerability prevention, defense patterns, security review code | `SecureCoding/SKILL.md` |20| Supply chain, dependency audit, package security, new dependency check | `SupplyChain.md` |21| Secret audit, scan for secrets, find leaked keys, git history secrets | `SecureCoding/SKILL.md` |22| Trivy, vulnerability scan, CVE, container scan, IaC scan | See **Trivy Vulnerability Scanning** below |23| sops, encrypt secrets, decrypt secrets | See **sops Secrets Management** below |2425## Trivy Vulnerability Scanning2627Scan projects, containers, and infrastructure-as-code for known vulnerabilities.2829```bash30# Scan project directory for CVEs31trivy fs --format json . | jq '.Results[] | select(.Vulnerabilities) | .Vulnerabilities[] | select(.Severity == "CRITICAL")'3233# Scan container image34trivy image --format json myapp:latest3536# Scan IaC (Terraform, CloudFormation)37trivy config --format json ./infrastructure/3839# CI gate — fail on critical40trivy fs --exit-code 1 --severity CRITICAL .41```4243**When to use:**44- Before deploying — scan the project for known CVEs45- Container builds — scan images before pushing to registry46- IaC review — catch misconfigurations in Terraform/CloudFormation before apply47- CI pipelines — add `--exit-code 1` to fail the build on critical findings4849**Triage approach:**501. Run `trivy fs --format json .` to get full results512. Filter to CRITICAL and HIGH severity first523. Check if vulnerable code paths are actually reachable534. Update dependencies where possible, document accepted risks where not5455## sops Secrets Management5657Encrypt and decrypt secrets files using Mozilla sops with age keys.5859```bash60# Encrypt a file with age key61sops --encrypt --age age1... secrets.yaml > secrets.enc.yaml6263# Decrypt64sops --decrypt secrets.enc.yaml6566# Edit encrypted file in place67sops secrets.enc.yaml68```6970**When to use:**71- Storing secrets in git — encrypt with sops so they can be version-controlled safely72- Sharing secrets across team/agents — encrypted files can be committed and shared73- Rotating secrets — edit in place with `sops secrets.enc.yaml`7475**Rules:**76- Never commit unencrypted secrets files77- Use age keys (not PGP) for new setups — simpler key management78- Store the age key outside the repo (e.g., `~/.config/sops/age/keys.txt`)7980## Examples8182**Example 1:** `User: "[typical request]"` → Routes to appropriate sub-skill workflow8384**Example 2:** `User: "[another request]"` → Routes to different sub-skill workflow
mj-deving