openshift

@openshift source repo

147 skills
0 followers
8 hours ago last updated

▌
Draft Pr · openshift
Open a pull request in the browser with prefilled title, description, and labels

0
installs
▌
Find Rule · openshift
Search for existing rules that match a given requirement text. Identify rules that implement a specific control.

0
installs
▌
Run Tests · openshift
Run ctest validation tests on a built product

0
installs
▌
Test Rule · openshift
Run Automatus tests for a security rule

0
installs
▌
Create Rule · openshift
Create a new security rule with all required components

0
installs
▌
Map Controls · openshift
Interactive control-to-rule mapping session. Walk through unmapped requirements, suggest rules using cross-framework analysis, and write selections to control files.

0
installs
▌
Build Product · openshift
Build a ComplianceAsCode product

0
installs
▌
Create Product · openshift
Create a new product in ComplianceAsCode project

0
installs
▌
Manage Profile · openshift
Create or update a versioned profile pair (versioned + unversioned extends pattern).

0
installs
▌
Create Template · openshift
Create a template for checks and remediations

0
installs
▌
Inspect Control · openshift
Inspect a control file showing requirement stats, mapping status, and cross-framework context. Use for triage before mapping.

0
installs
▌
Map Requirement · openshift
Map rules to a single control file requirement using cross-framework analysis and rule search.

0
installs
▌
Onboard Control · openshift
Onboard a new security policy as a control file. Parse the document, create control file structure, and map existing rules to requirements.

0
installs
▌
Assess Nist Control · openshift
Assess a pending NIST 800-53 control with OSCAL enrichment, CIS reverse lookup, and Linux hardening prioritization. Guides authors through understanding, automatability analysis, rule mapping, and validation.

0
installs
▌
Create Test Scenarios · openshift
Create Automatus test scenarios to test the given rule.

0
installs
▌
Resolve Rule Variables · openshift
Resolve XCCDF variable selections for a set of rules. Looks up which variables each rule depends on, reads their .var files, and guides the author to select a value key for each variable. Returns a list of var_name=key selections ready to add to a control file's rules list.

0
installs
▌
Release Workflow · openshift bundle
OpenShift z-stream release workflow and orchestration expert. Use when discussing release tasks, build promotion, test analysis, advisory workflows, or any aspect of the Konflux/Errata release pipeline. Provides context on task sequencing, checkpoints, and MCP execution for releases 4.12-4.20.

0
installs
▌
Learn History · openshift
Analyze all past sessions for this project and extract knowledge worth persisting to AGENTS.md, .claude/agents/, or memory. Deep analysis of full session history.

0
installs
▌
Learn Session · openshift
Review the current session and extract knowledge worth persisting to AGENTS.md, .claude/agents/, or memory. Use at the end of a session to capture what was learned.

0
installs
▌
Openshift Docs · openshift bundle
Search and read OpenShift Container Platform documentation in markdown format. Use when the user asks about OpenShift features, configuration, installation, troubleshooting, or any OCP-specific topic — including operators, routes, services, oc, RBAC, networking, storage, or cluster administration.

0
installs
▌
Kubernetes Docs · openshift bundle
Search and read Kubernetes documentation in markdown format. Use when the user asks about Kubernetes concepts, tasks, API reference, kubectl, or any upstream k8s topic — including pods, deployments, services, RBAC, networking, storage, or scheduling.

0
installs
▌
Product Lifecycle · openshift bundle
Query Red Hat Product Life Cycle data for support phases, end-of-life dates, and OpenShift version compatibility. Use when evaluating whether installed operators or layered products are supported on a given OCP version, approaching end of life, or need upgrading before a cluster upgrade. Also use when the user asks about product support status, EOL dates, or lifecycle phases for any Red Hat product.

0
installs
▌
Cluster Update Advisor · openshift
Assess OpenShift cluster update (upgrade) readiness and risk. Use when evaluating whether a cluster is safe to update, when an update is available, or when the user asks about update risks, prerequisites, blockers, or best practices.

0
installs
▌
Investigate Alert · openshift bundle
Investigate one or more firing OpenShift alerts to determine root cause and recommend remediation options. Use when the user provides alert names or a set of firing alerts. Not for cluster setup, configuration how-tos, or writing alerting rules.

0
installs
▌
Estimate Epic · openshift
Size OLS Jira Epics using t-shirt sizes (XS/S/M/L/XL) based on the total story points of their child issues. Can size specific Epics, or bulk-size all unsized Epics. Also invoked automatically after creating a new Epic.

0
installs
▌
Estimate Risk · openshift
Assess risk level (1/2/3) for OLS Jira stories using the team's risk rubric. Fetches the story, applies the decision tree, sets the Risk Score field, and adds the assessment as a comment. Use for on-demand assessment or after creating a new story.

0
installs
▌
Estimate Story · openshift bundle
Estimate story points for OLS Jira stories using the calibrated rubric derived from 300 completed stories. Fetches the story, applies the decision tree, sets the SP field, and adds the estimate as a comment. Use for on-demand estimation or after creating a new story.

0
installs
▌
Triage New Bugs · openshift
Use when triaging new OLS Jira bugs to determine which ones require a spec update, which need more information, and which are pure implementation issues. Fetches all New-status bugs, analyzes them against the current .ai/spec/ landscape, and presents a report with draft comments for human approval.

0
installs
▌
Make Jira From Spec · openshift
Create or update Jira Epics and Stories from spec changes. Reads spec diffs from the current session or a PR, uses brainstorming to design the work breakdown, creates/updates issues in Jira, then estimates story points, risk levels, and epic sizes. Splits stories that exceed 5 SP. Use when the user says "make jira from spec", "make-jira-from-spec", "create jira from spec", "update jira from spec", or wants to turn spec changes into tracked Jira work.

0
installs
▌
Bug · openshift
Bug

0
installs
▌
Test · openshift
Run tests (frontend, backend, unit, or all)

0
installs
▌
QA Verify · openshift bundle
Automated QA verification for OpenShift Console PRs. Builds and runs the console on both main and the PR branch, captures before/after screenshots and GIFs via Playwright MCP, then posts a side-by-side comparison as a GitHub PR comment. Use when the user asks to verify a PR, QA changes, capture visual proof, or show before/after evidence.

0
installs
▌
Debug Test · openshift
Debug and fix failing Playwright e2e tests with MCP-assisted diagnosis. Use when user says "playwright test failing", "fix e2e test", "debug spec", or provides a failing .spec.ts file, e2e directory, or Playwright tag.

0
installs
▌
Skill Audit · openshift
Audit all Claude Code skills for stale references, broken paths, and deprecated tool names

0
installs
▌
Gen E2e Test · openshift
Generate Playwright e2e tests for OpenShift Console features. Creates spec files and page objects following the project's established patterns and conventions. Use this skill whenever the user wants to create, write, or add e2e tests, asks to cover a feature with e2e, describes a UI workflow to test, says "I need to test this feature", "add test coverage for X", or invokes /gen-e2e-test explicitly.

0
installs
▌
Gen Rtl Test · openshift
Generate React Testing Library tests following OCP Console best practices

0
installs
▌
Update Package · openshift
Expert package update assistant for OpenShift Console. Update packages safely with automated testing, building, and fixing.

0
installs
▌
Migrate Cypress · openshift
Migrate a Cypress test file (.cy.ts) or Gherkin feature file (.feature) to Playwright following Console's architecture. This is the ONLY skill for Cypress-to-Playwright conversion work, supporting full migration, analysis-only (--analyze), or dry-run (--dry-run) modes. Use this skill whenever the user wants to convert, port, rewrite, or migrate Cypress or Gherkin tests to Playwright, mentions "old cypress tests", "remaining e2e tests", or provides a .cy.ts or .feature file path in a migration context.

0
installs
▌
Pre Push Review · openshift
Comprehensive local code review using both Claude AI and CodeRabbit AI before pushing changes to GitHub. This command analyzes your local changes and provides actionable feedback without posting anything to GitHub.

0
installs
▌
Microcopy Review · openshift bundle
Reviews user-facing microcopy against content design guidelines and provides clear, actionable recommendations.

0
installs
▌
Plugin API Review · openshift
Review changes to the OpenShift Console plugin API for compliance with contribution guidelines, styleguide, and proper documentation in changelogs. Provides a detailed report of findings and compliance score.

0
installs
▌
Update Bundle · openshift
Sync related_images.json from Quay (oras + konflux_prefix/revision in related_images.json) and regenerate the OLM bundle. Pass mode dev (CI quay) or release (stable images, version bump — /version-update). Do not use oc.

0
installs
▌
Go Code Review · openshift bundle
Reviews Go code for idiomatic patterns, error handling, concurrency safety, and common mistakes. Use when reviewing .go files, checking error handling, goroutine usage, or interface design.

0
installs
▌
Go Testing Code Review · openshift bundle
Reviews Go test code for proper table-driven tests, assertions, and coverage patterns. Use when reviewing *_test.go files.

0
installs
▌
Rebase · openshift
Rebase the current branch onto its base branch, resolve all conflicts, and verify lint, i18n, and build pass. Use when the user asks to rebase, update, or sync a branch with its upstream base.

0
installs
▌
Release · openshift bundle
Bump the project version across all release branches and commit the changes. Use when the user asks to do a release or update the version on all branches.

0
installs
▌
Backport · openshift
Backport commits or PRs from main to a release branch. Use when the user asks to backport, cherry-pick, or port changes between branches, or when resolving conflicts from a cherry-pick onto a release branch.

0
installs
▌
Code Review · openshift
Review a pull request for code quality, correctness, and project conventions. Use when the user asks to review a PR, code review, or examine changes on a branch. Accepts a GitHub PR URL, PR number, or local branch name.

0
installs
▌
Review Skills · openshift
Review project AI skills for duplication, stale references, mistakes, and structural issues. Use when the user asks to review skills, audit skills, check for duplicate skills, or verify skill quality.

0
installs
▌
Review Readmes · openshift
Review all README.md files in the repo for typos, errors, and outdated information. Use when the user asks to review READMEs, check documentation accuracy, or audit docs.

0
installs
▌
Unused Exports · openshift
Find exported symbols that are never imported by another file. Use when the user says "check exports", "unused exports" or asks to clean up exports.

0
installs
▌
Update Version · openshift
Update the project version number across all files that contain it on the current branch. Use when bumping the version on a single branch only. For a full multi-branch release, use the release skill instead.

0
installs
▌
Raise Pr · openshift
Step-by-step workflow for committing staged changes and opening a pull request for lightspeed-agentic-sandbox.

0
installs
▌
Review Pr · openshift
Review PR with structured approach covering architecture, naming, patterns, and critical questions

0
installs
▌
Deps Update · openshift
Update Python dependencies with uv, regenerate lock and Konflux requirements files, then verify lint, types, and tests. Fix breakage from API changes in bumped packages. Use when the user says "deps update", "bump dependencies", or "update deps".

0
installs
▌
Resolve Cve · openshift
Triage a CVE: assess impact against this repo's dependencies, then bump, document not-affected, or plan a code fix. Use when the user mentions a CVE, Jira vulnerability issue, or security advisory for a dependency.

0
installs
▌
Rebase Clean · openshift
Performs a strict clean rebase of a feature branch onto main with minimal conflict resolution and full validation. Use when the user asks to rebase carefully and run tests + verify until green.

0
installs
▌
Find Dead Code · openshift
Find unused functions, classes, imports, and unreachable code paths. Use when the user asks for dead code or cleanup candidates.

0
installs
▌
Version Update · openshift
Bump the Python package version in pyproject.toml for a release or when the user asks to change the project version.

0
installs
▌
Find Complexity · openshift
Find functions with high cyclomatic complexity, length, or parameter count. Use when the user asks for complexity hotspots or refactor candidates.

0
installs
▌
Find Duplication · openshift
Find code duplication in the codebase. Supports branch-scoped or full sweep. Use when the user asks to find duplicated code or repeated patterns before a PR.

0
installs
▌
Safe Code Change · openshift
After a code change, find affected tests, update them to match new behavior, then run the full validation pipeline once. Use when the user has made or asked for a code change and wants to make sure nothing is broken.

0
installs
▌
Validate And Fix · openshift
Run install sync, unit tests, and make verify; auto-fix trivial failures (ruff format/fix, obvious test expectation updates). Use when the user asks to validate, run tests, check the pipeline, or verify changes are clean.

0
installs
▌
Investigate CI Failure · openshift
Investigate CI job failures on a GitHub pull request (checks, Prow, or GitHub Actions). Use when the user pastes a PR URL and asks about CI failures or red checks.

0
installs
▌
Echo Token · openshift bundle
Generate a verification token and write it to disk. Use when asked to produce an e2e test token.

0
installs
▌
Find Token · openshift bundle
Find the hidden verification token. Run the find-token script to retrieve unique DIAG and VERIFY tokens.

0
installs
▌
Step Finder · openshift
Search openshift/release step-registry for existing steps, workflows, and chains before creating new CI components. Use when adding tests, jobs, or step-registry entries, or when asked to find reusable pre/test/post components.

0
installs
▌
Add Step Registry · openshift
Add a new step-registry step (ref YAML + commands.sh) in openshift/release. Use when creating a new CI step, atomic test action, or reusable ref component. Run step-finder first to avoid duplicates.

0
installs
▌
Rhdh Ocp Pool · openshift bundle
List existing RHDH OCP Hive ClusterPool configurations and generate new pool YAML for a target OCP version, with imageSetRef aligned from other pools in the openshift/release repository. Covers OCP pools only, not K8s platforms

0
installs
▌
Rhdh Aks Tests · openshift bundle
List AKS test entries in RHDH ci-operator config files and update the AKS Kubernetes version per branch. Use when listing e2e-aks tests, changing MAPT_KUBERNETES_VERSION for AKS, or checking which AKS K8s version each release branch uses.

0
installs
▌
Rhdh Eks Tests · openshift bundle
List EKS test entries in RHDH ci-operator config files and update the EKS Kubernetes version per branch. Use when listing e2e-eks tests, changing MAPT_KUBERNETES_VERSION for EKS, or checking which EKS K8s version each release branch uses.

0
installs
▌
Rhdh Gke Tests · openshift bundle
List GKE test entries in RHDH ci-operator config files. Use when listing e2e-gke tests or checking which branches have GKE test entries. Unlike AKS/EKS, GKE uses a pre-existing static cluster — version upgrades are performed via the GCP Console.

0
installs
▌
Rhdh Ocp Tests · openshift bundle
List, generate, add, and remove OCP-versioned test entries (e2e-ocp-*) in RHDH ci-operator config files. Covers only OCP cluster-claim tests, not K8s platform tests (AKS, EKS, GKE, OSD)

0
installs
▌
Rhdh Ocp Coverage · openshift bundle
Analyze RHDH OCP version coverage by cross-referencing cluster pools and CI test configs against both RHDH and OCP lifecycle APIs to find gaps, stale configurations, and compatibility mismatches

0
installs
▌
Rhdh Aks Lifecycle · openshift bundle
Check AKS Kubernetes version support status using the official AKS release status API and compare against versions configured in CI config files. Use whenever someone asks about AKS K8s version support, EOL dates, deprecation, or whether the configured AKS version is still GA. Also use when planning AKS K8s version upgrades — run this before using rhdh-aks-tests to make changes.

0
installs
▌
Rhdh Eks Lifecycle · openshift bundle
Check EKS Kubernetes version support status using the official AWS EKS docs source and compare against versions configured in CI config files. Use whenever someone asks about EKS K8s version support, EOL dates, or whether the configured EKS version is still in standard support. Also use when planning EKS K8s version upgrades — run this before using rhdh-eks-tests to make changes.

0
installs
▌
Rhdh Gke Lifecycle · openshift bundle
Check GKE Kubernetes version support status using the endoflife.date API (auto-scraped from Google's GKE release schedule). Use whenever someone asks about GKE K8s version support, EOL dates, or whether the current GKE cluster version is still supported. GKE uses a long-running static cluster whose version is not managed in CI config.

0
installs
▌
Rhdh Ocp Lifecycle · openshift bundle
Check which OCP versions are supported by active RHDH releases and which are end-of-life, using the Red Hat Product Life Cycles API for both RHDH and OCP lifecycle data including EUS phases. Supports OCP 4.x and future 5.x+

0
installs
▌
Otel · openshift bundle
Use this skill to analyze failing CI tests for the OpenShift OpenTelemetry Operator, rerun the specific failing tests (chainsaw-based, junit_otel_* prefix), diagnose whether the failure is a product bug or a test that needs fixing, apply fixes to test source files when needed, and export results to the artifact directory. Trigger whenever $SHARED_DIR/qe-agent-context.json is present with has_test_failures=true for OpenTelemetry Operator tests, or when an engineer asks to debug, rerun, or fix failing OTel QE tests.

0
installs
▌
Rhdh Decommission Release · openshift bundle
Use when decommissioning an end-of-life RHDH release branch by removing CI config, generated Prow jobs, and branch protection from the openshift/release repository

0
installs
▌
Tempo · openshift bundle
Use this skill to analyze failing CI tests for the OpenShift Tempo Operator (TempoStack and TempoMonolithic), rerun the specific failing tests (chainsaw-based, junit_tempo_* prefix), diagnose whether the failure is a product bug or a test that needs fixing, apply fixes to test source files when needed, and export results to the artifact directory. Trigger whenever $SHARED_DIR/qe-agent-context.json is present with has_test_failures=true for Tempo Operator tests, or when an engineer asks to debug, rerun, or fix failing Tempo QE tests.

0
installs
▌
Tracing UI · openshift bundle
Use this skill to analyze failing CI tests for the OpenShift Distributed Tracing UI console plugin (Cypress, junit_distributed-tracing-console-plugin* prefix) - rerun them, diagnose product bug vs test issue vs job configuration, fix test files when needed, and export results. Trigger when $SHARED_DIR/qe-agent-context.json has has_test_failures=true for Tracing UI tests, or when an engineer asks to debug, rerun, or fix failing Tracing UI QE tests.

0
installs
▌
Census · openshift bundle
Use when the user asks for the corpus census, the report population, "how many repos/reports do we actually have", how much duplication is in the numbers, the distinct-vulnerability count, ownership cuts (owned vs upstream vs external-BU), or asks to (re)build the census or corpus manifest. Deterministically resolves the report population via python3 -m traust.cli corpus + $TRAUST_CONFIG_HOME/corpus-config.yaml, quantifies the five duplication vectors, computes distinct vulnerabilities (fingerprint-deduped at HEAD, disposition-adjusted, FP-excluded, hardening separate) per ownership cut, and writes census.{json,md,html} — the denominator authority every other dashboard cites.

0
installs
▌
Sla View · openshift
Use when the user asks about SLA compliance, overdue findings, response/remediation deadlines, breach counts, or escalation lists — e.g. "what's past SLA", "criticals overdue", "are we meeting the 30-day clock", "SLA view for FedRAMP", "who's most overdue". Replays disposition-ledger clocks against a schema-validated SLA policy (default: Red Hat PSIRT VMWM) and emits sla-view.{json,md} with per-team overdue tables and a human-gated escalation digest.

0
installs
▌
Repo Graph · openshift bundle
Build or refresh the portfolio repository graph. Reads every segment of the inputs inventory (`locations.inputs`) by the kind declared in `<inputs>/inventory.yaml` (groups / release-payload / catalog / services; ansible/ excluded by default), cross-references every repo against analysis-results/findings/ coverage (audit/triage/threat-model + severity), and emits repo-graph.{json,dot,gexf,html} + repo-graph-stats.md into analysis-results/graph/. Use when asked to "build the repo graph", "update the portfolio graph", "map repos to findings", "which repos have no coverage", or "what ships kube-rbac-proxy".

0
installs
▌
Drift Watch · openshift
Use when the user asks whether derived artifacts or paired sources are stale or drifting — "is anything stale", "check for drift", "are the feeds/graphs/findings-db current", "did inputs change since the graph was built", "run the drift report" — or on a regular cadence. Runs the deterministic staleness/drift checker over feeds, findings.db, repo-/portfolio-graph vs the inputs inventory, repo-liveness, corpus registration, finding-identity stamping across every audit report, ADR-registry pins, external-tool freshness (installed scanners vs latest upstream releases), docs-product-map version enumeration (declared doc versions vs the live docs.redhat.com landing pages — catches FUTURE product-doc versions the variance lane isn't covering), pqc-facts stamps/schema provenance, and dated policy provenance; writes drift-report.{json,md} to progress-tracker/metrics/drift/.

0
installs
▌
Findings DB · openshift
Use when the user asks an ad-hoc question over the findings corpus that reads like a query — "open criticals by business unit", "which repos have the most confirmed findings", "distinct CWE-1104 exposure across products", "how many findings were validated live" — or asks to build/refresh/query the findings database. Queries the SQLite projection (analysis-results/graph/findings.db) instead of walking 8k JSON files.

0
installs
▌
Mine Ledger · openshift bundle
Use when the user asks to mine the disposition ledger for confirmed true positives, build or refresh the rule-calibration corpus, find rule-pack coverage gaps, check per-rule precision, or produce the opengrep rule-authoring backlog — e.g. "mine the ledger", "what TP clusters have no rule", "how precise are the traust rules", "refresh the rule-mining report". Runs out-of-band from audits; audits themselves feed it via structured scanner_correlation entries.

0
installs
▌
Loc Dashboard · openshift bundle
Use when the user asks how many lines of code have been scanned/audited, wants a LoC breakdown by language or repo across the security-audit campaign, or asks to (re)build the LoC dashboard. Produces gh-languages-cache.jsonl and a self-contained loc-dashboard.html from the campaign manifests.

0
installs
▌
Traust Metrics · openshift bundle
Use when the user asks for campaign metrics, a leadership scoreboard, or to (re)build/refresh progress-tracker/metrics/traust-metrics.md. Deterministically harvests headline numbers from the campaign's derived artifacts (executive summary, validation/fuzz dashboard, threat register, progress-tracker control files) and the harness's own tree/git metadata into one consistently-updatable Markdown scoreboard.

0
installs
▌
Triage · openshift bundle
Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes <repo>-triage.json + <repo>-triage.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.

0
installs
▌
Attack Coverage · openshift bundle
Use when the user asks for MITRE ATT&CK coverage of the portfolio — "which ATT&CK techniques/tactics do our threats or validated chains cover", "build the ATT&CK Navigator layer", "ATT&CK heat map", or after updating threat models/validations to refresh the coverage roll-up. Deterministically joins validated attack chains, threat-model attack_refs, and finding-category-derived candidates against the pinned vendored ATT&CK table and emits a Navigator layer JSON plus a tactic/technique coverage one-pager.

0
installs
▌
Check Alignment · openshift
Use before committing any new or edited skill to the traust repo, or when asked "are the skills aligned", "did my skill drift from the conventions", "run the alignment check" — runs python3 -m traust.cli check skill-alignment, the cross-skill contract guard the pre-commit hook enforces. Verifies referenced scripts exist, deterministic pre-scan recording conventions (deterministic_steps, judge protocol) travel with the tools that require them, audit-profile skills link the shared report structure instead of restating it, liveness consumers name the census artifact, skill frontmatter matches its directory, and discovery wiring (.claude/.crush symlinks + command wrapper) is complete.

0
installs
▌
Check Licensing · openshift
Use before pushing to the traust repo, after adding or editing any skill, rule pack, doc, or script, or when adopting a new external tool, framework, data feed, or rule pack — runs python3 -m traust.cli check content-licenses to verify no restrictively-licensed framework text has been re-imported (PEACH-adaptation fingerprints, restrictive content-license markers outside the licensing docs, CIS benchmark recommendation-text signatures), and walks the checklist for licensing a NEW external dependency into docs/external-dependencies.md. Use when asked to "check licensing", "run the license check", "did I re-import licensed content", "can we use/ship this tool or ruleset", or "add a license row".

0
installs
▌
Findings Trends · openshift bundle
Use when the user asks whether portfolio security findings are trending up or down, wants a burndown, remediation velocity, MTTR, risk-index, or accepted-risk trend, or asks to (re)build the findings-trends dashboard — e.g. "are we getting better", "findings over time", "how fast are we remediating", "what risk have we accepted". Replays every repo's track-findings disposition ledger against time buckets and emits findings-trends.{json,md,html} with direction arrows per metric.

0
installs
▌
Portfolio Graph · openshift bundle
Use when the user asks code-level portfolio questions or to build/refresh/query the portfolio source-code graph — "which products depend on module X" / CVE blast radius, "top shared libraries", "internal library coupling", "rebuild the portfolio graph", "query the code graph". Distinct from /repo-graph (the organizational coverage graph): this one holds the code-level layers — module dependencies (L1), Kubernetes interfaces (L2), artifacts/SBOM (L3), and symbols (L4), all implemented — in a queryable SQLite database built by python3 -m traust.cli portfolio.

0
installs
▌
Threat Register · openshift bundle
Use when the user asks for a fleet-wide or portfolio-wide view of threats (not findings) — "how many unmitigated critical threats do we have", "threat register", "which products carry the most open threat exposure", "what class-closing mitigations would pay off fleet-wide" — or asks to (re)build the threat register. Deterministically aggregates every *-threat-model.md (and legacy THREAT_MODEL.md) under analysis-results into progress-tracker/metrics/dashboards/threat-register/threat-register.{json,md,html}, keyed by the stable compound key <model-slug>:<Tn>.

0
installs
▌
Recall Benchmark · openshift bundle
Use when the user asks to measure the auditor's detection recall, run the recall benchmark, score a harness release against ground truth, bootstrap/admit benchmark targets, or asks "what fraction of real vulnerabilities do we find". Audits pinned pre-fix refs of repos with known-real findings (self-replay from the disposition ledger, CVE replay, seeded) on clean clones, scores detection with the finding_identity match ladder via match_benchmark.py, and emits benchmark.{json,md} + a metrics-ledger snapshot — recall overall/per-CWE/per-severity/per-language, held-out split, and run-to-run stability.

0
installs
▌
Vuln Scan · openshift bundle
Static source-code vulnerability scan. Reads a target directory (and its threat model — <repo>-threat-model.md, or legacy THREAT_MODEL.md — if present), spawns parallel review subagents per focus area, and writes <repo>-vuln-findings.{json,md} with campaign finding IDs ({REPO_SLUG}-{SHORTSHA}-{NNN}) and the shared severity enum, for /triage to consume. When a <repo>-security-audit.json baseline exists, the scan supplements it: known findings are deduped against the baseline and new verified findings enter the disposition ledger directly (as findings-carrying events; the baseline is never written — gate A15) at not_verified (no triage precondition; triage adjudicates downstream) — /secure-code-audit remains the preferred baseline and /verify-remediation the way to update it after fixes. Read-only — no building, running, or network. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", "re-sweep an audited repo", or as the step between /threat-model and /triage.

0
installs
▌
Patch · openshift
Generate candidate fixes for verified security findings. Consumes <repo>-triage.json (preferred; legacy TRIAGE.json accepted), a <repo>-security-audit.json report, *-vuln-findings.json (or legacy VULN-FINDINGS.json), *-pqc-facts.json (actionable first-party PQC blockers only), or an external vuln-pipeline results directory. Pipeline input is delegated to the execution-verified `vuln-pipeline patch` ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is written as inert diffs and git-am-ready patches for human review. Writes PATCHES/bug_NN/{patch.diff,patch.patch,patch_result.json}, PATCHES.md, and PATCHES.json. Use when asked to "fix the findings", "patch these vulns", "generate fixes", or "close the loop on triage".

0
installs

147 published skills · page 1 of 2