openshift
- 147 skills
- 0 followers
- 1 day ago last updated
- ▌ Insecure Patterns · openshift bundleUse when the user asks which insecure coding patterns recur across the portfolio, wants findings grouped/ranked by CWE or OWASP ASVS category, asks "what are our top vulnerabilities by pattern", "which repos share CWE-X", or asks to (re)build the insecure-patterns dashboard. Walks every *-security-audit.json under analysis-results/findings/ (owned) and analysis-results/oss-findings/ (upstream, reported as a separate tagged cut), keeps only source-code findings (drops YAML/Dockerfile/Helm config gaps), buckets by primary CWE mapped to ASVS 5.0, and writes insecure-patterns/{top25.md, detailed.md, dashboard.html, .json}.
- ▌ Check Harness Docs · openshiftUse when changing harness skills, scripts, schemas, pipeline stages, or documentation, or when checking for documentation drift before a commit. Verify counts, local paths, inventory coverage, CLI examples, external dependency records, and version consistency against the tree; update stale documentation and rerun the checks.
- ▌ Financial Tracking · openshift bundleUse when the user asks what the campaign or harness is costing, how spend is trending, which business unit a cost lands on, cost per finding or per repo, whether spend is on budget, or asks to capture/refresh financial tracking over time — e.g. "what did July cost", "spend by business unit", "are we over budget", "cost per critical", "is spend going up", "refresh the financial report". Runs the deterministic spend chain (session actuals → per-lane attribution → business-unit bridge → unit economics → trend) and reports estimates that are always labelled as estimates, with an --invoice seam for reconciling against real billing.
- ▌ Refresh Dashboards · openshift bundleUse when the user asks to refresh, rebuild, or update all the dashboards — "refresh the dashboards", "rebuild every dashboard", "update the derived views", "run the weekly dashboards job" — or on the weekly orchestration cadence. Runs python3 -m traust.cli dashboard refresh, the packaged "Dashboards rebuild" job from docs/continuous-operations.md: projections first (findings.db, census), then the per-dashboard builders (executive summary, trends, insecure-patterns, validation-fuzz, RBAC/tenancy rollup, SLA view, compliance, ATT&CK coverage, LoC cache-only, dependency-exposure, spend), then the leadership scoreboard last because it harvests the others. Deterministic, ~$0, no agents.
- ▌ Rbac Tenancy Rollup · openshift bundleUse when the user asks for a portfolio view of RBAC or multi-tenancy findings — "what are our RBAC issues", "top RBAC misconfigurations", "multi-tenancy findings rollup", "which repos have over-permissive RBAC", "tenant-isolation findings summary", "ATT&CK view of our RBAC findings" — or asks to (re)build the RBAC/tenancy dashboard. Deterministically aggregates authorization and tenant-isolation findings from the corpus-resolved report population (disposition-aware, FP-excluded, branch re-audits excluded) into an executive rollup with MITRE ATT&CK candidate-technique heat, a detailed top-misconfigurations report, and a self-contained HTML dashboard under progress-tracker/metrics/dashboards/rbac-tenancy/.
- ▌ Countersign · openshiftReview and sign off pending human decisions in the findings disposition ledger — machine-refuted false positives awaiting an identity-verified countersignature, and queued needs-review items — and record human overrides on any finding, including severity upgrades/downgrades and validity flips in both directions (false positive to true positive via reopen, true positive to false positive via override). Renders each pending decision as a self-contained card (claim + refutation + evidence) so nothing needs to be remembered from the original reports, records decisions through the countersign workbench, and rebuilds the cumulative reports. Use when asked to "countersign findings", "sign off false positives", "review pending refutations", "what's waiting for my signature", "clear the disposition queue", "downgrade/upgrade this finding's severity", "reclassify this finding", or "this finding is actually a false positive / actually real".
- ▌ Check Skill Security · openshiftUse before committing any new or edited skill or script to the traust repo, or when asked "does this skill degrade our security posture", "run the security-posture check", "is this skill safe to add" — runs python3 -m traust.cli check skill-security, the security-posture guard the pre-commit hook enforces alongside the alignment gate. Verifies privileged skills declare allowed-tools confinement, untrusted-content readers carry the adversarial-content doctrine, no git network command takes an ungated non-literal URL (the confirmed-RCE class from the 2026-07 self-audit), no shell-execution constructs or ps-visible Authorization headers, no fixed /tmp state paths, no unpinned runtime installs, no raw-egress tool grants, headless agents under repo-config isolation, and target-build invocations routed through the safe_exec sandbox.
- ▌ Pqc Readiness · openshift bundleAssess a repository's post-quantum TLS readiness. Use when asked whether a repo can negotiate ML-KEM hybrid TLS, who controls that choice, or to emit a pqc-readiness report. Walks the TLS control chain from platform down to app, consulting capability notes for version meaning.
- ▌ Create Fuzzing · openshift bundleUse when the user asks to write, scaffold, run, or extend a fuzz harness for a parser/decoder/templater identified in a security-audit report — Go-native by default, plus Python (atheris), JavaScript/TypeScript (Jazzer.js), Rust (cargo-fuzz), and Java (jazzer, manual run) via the language field in targets.json and templates under harnesses/_templates/. Adds a target to targets.json, authors a harness dropped into the audited repo's tree, drives `make clone install build fuzz-<id>`, and triages any crashers into follow-up findings. Offline only: no cluster, cloud creds, or service mocks.
- ▌ Fleet Fix · openshift bundleUse when the user wants to remediate a SYSTEMIC pattern (one weakness class × N repos — an insecure-patterns CWE entry or a PROGRESS.md rollup like the Konflux mutable-pipelineRef) as one campaign instead of per-finding fixes — "fix this pattern everywhere", "fleet fix", "pin pipelineRefs across the fleet", "batch-remediate CWE-X". Authors one reviewed transform spec with golden tests, applies it across every affected repo via apply_fleet_fix.py (diffs only), and only after human batch approval opens MRs/PRs through the remediate-finding fork flow; merge events flow back through track-findings for pattern burndown.
- ▌ Add Inputs · openshiftUse when the user asks to add one or more GitHub/GitLab repositories or an entire GitHub organization to the repository inventory (`locations.inputs`). Adds entries to the appropriate segment CSV files and generates matching owners.csv rows.
- ▌ Crypto Analysis · openshift bundleUse when you need to understand a crypto decision point — probe what crypto is configured, trace who owns the decision (governance chain), and confirm with runtime evidence. Probe-driven via python3 -m traust.cli adapters crypto-audit.
- ▌ Impact Analysis · openshift bundleUse when determining which portfolio repositories are affected by an advisory (CVE, GHSA, MAL-/malicious-package, or another OSV-native id). Queries the portfolio graph for blast radius, then runs language-specific analysis (govulncheck + ELF reachability for Go, the strongest tier; manifest-level analyzers for npm, PyPI, Maven, Cargo, RubyGems, and NuGet; a manifest-level SurfaceAnalyzer for the universal Docker/GitHub Actions/Helm surfaces) to classify every importing repo. Emits a schema-validated artifact consumed by /triage and /verify-remediation.
- ▌ Track Findings · openshift bundleUse when the user wants to record human triage feedback or machine validation results against the findings of a *-security-audit, *-cloud-config-audit, or *-container-audit report and produce a cumulative status report — ingesting merge-request comments, commits, Jira tickets, interactive human triage, live-validation reports, and remediation-verification reports into an append-only disposition layer, then generating a schema-conformant *-findings-current.{json,md} showing the current validity and resolution of every finding.
- ▌ Compliance Check · openshift bundleUse when the user asks to assess compliance of a product or deployed cloud environment against PCI DSS, NIST 800-53, FedRAMP High/Moderate, SOC 2 (TSC), or the GDPR technical slice — e.g. "run a compliance check", "assess X against FedRAMP moderate", "SOC 2 posture for this service", "are we meeting 800-53 on this cluster", "compliance across all frameworks". Runs the deterministic assessment runner (code-computed verdicts, evidence bundles, citation gate) and judges only evidence_review controls; emits compliance-assessment.{json,md} + optional OSCAL. "interview" mode is the self-service intake: it walks a service owner through boundary declaration and evidence-review context, writing a validated scope-registry entry and an attestation bundle — attestations are evidence, never verdicts.
- ▌ Dependency Watch · openshift bundleUse on the daily continuous-operations cadence, or when the user asks to "check for new dependency CVEs", "run the deps lane", "watch dependencies", or "file dependency vulnerabilities" — runs the advisory-driven dependency chain end to end: refresh the vulnerability feeds, sweep new advisories against the audited fleet, run /impact-analysis reachability on hits, and route affected repos' findings into their disposition ledgers as event-carried findings (gate A15 — the baseline is never written), so a newly disclosed dependency CVE becomes an owned, SLA-clocked finding the same day. Orchestrator-neutral — invocable identically from an operator session, cron, Source Code Intelligence, or any enterprise scheduler.
- ▌ Isolation Review · openshift bundleUse when the user asks to review, assess, or score the tenant isolation of a multi-tenant service — resolving the service's repo set via the portfolio graph, building a customer-facing interface inventory from graph data and existing audit/threat-model findings, rating per-interface complexity, scoring five isolation-hardening dimensions (privilege, encryption, authentication, connectivity, operational hygiene) with cited evidence, and emitting a schema-validated isolation report under analysis-results/isolation/<service-slug>/.
- ▌ Secure Rpm Audit · openshiftUse when the user asks to perform a security audit, security review, or vulnerability assessment of an RPM packaging repository (CentOS Stream / Fedora / RHEL dist-git) — a repo containing a .spec file, downstream patches, and a sources lookaside manifest — using OWASP ASVS, the SEI CERT C/C++ Coding Standards, Fedora Packaging Guidelines, SLSA, and OpenSSF Scorecard.
- ▌ Corpus Intake · openshift bundleUse when the user wants to register, update, or review a corpus tree or scan engagement — "add a new BU engagement", "register this tree", "onboard <name> scanning work", "why is this tree unregistered", "update the ownership of X" — or when any census/dashboard run reports an unregistered-tree drift warning. Interactively interviews for the registration fields (or takes them as arguments), validates and updates $TRAUST_CONFIG_HOME/corpus-config.yaml through corpus_intake.py (never hand-edited), then re-runs /census so the corpus manifest reflects the change immediately.
- ▌ Validation Fuzz Dashboard · openshift bundleUse when the user asks for a live-validation dashboard, fuzzing-results dashboard, validation coverage roll-up, or "how many findings were confirmed exploitable / refuted" — e.g. "build the validation dashboard", "combine validation and fuzz results", "what did live validation confirm", "validation false-positive rate". Aggregates every validations/*/*validation*.json report plus FUZZ-CAMPAIGN-SUMMARY.md into one self-contained HTML dashboard.
- ▌ Cloud Config Audit · openshift bundleUse when the user asks to audit or harden the cloud configuration declared in an IaC checkout (Terraform, CloudFormation, Kubernetes/Helm, ARM/Bicep, Dockerfiles) — e.g. "audit our terraform", "check the IaC for misconfigurations", "run checkov", "harden the cloud config in this repo". Runs the pinned open-source Checkov policy engine fully offline (no cloud API calls, no platform key, declared-layer only by design), then a bounded agent pass that dedupes, suppresses with cited rationale, assigns severity from the rubric, and maps to CWE + control refs, emitting a schema-validated cloud-config-audit report that feeds the standard findings flow.
- ▌ Executive Summary Findings · openshift bundleUse when the user asks for an executive summary, leadership roll-up, or cross-portfolio dashboard of security-audit findings — e.g. "summarise all findings", "how many criticals do we have", "credential leaks across the campaign", "findings by language", or "rebuild the executive summary". Aggregates every *security-audit.{json,md} report under analysis-results/ into a one-page Markdown brief and a self-contained HTML dashboard.
- ▌ Threat Model · openshift bundleBuild and maintain a threat model for a target codebase. Six modes: "interview" walks an application owner through the four-question framework; "bootstrap" derives a model from code plus past vulnerabilities (CVEs, git history, pentest reports, --context docs) when no owner is available; "bootstrap-then-interview" chains the two; "review" measures an existing threat model's drift against the current code and offers to apply fixes; "update" applies targeted feedback without regenerating; "pr" threat-models a diff and returns an approve/request-changes assessment. Output is always named after the target (<repo>-threat-model.md); legacy THREAT_MODEL.md files are still read and are migrated on write. Emissions share one schema gated by python3 -m traust.cli reporting lint. Use when asked to "threat model", "map the attack surface", "is the threat model still current", "threat model this MR/PR/diff", or "what should we be worried about in this codebase".
- ▌ Verify Remediation · openshift bundleUse when the user provides a previous secure-code-audit report and a patched version of the scanned repository, and asks to verify that findings have been resolved. Performs a targeted re-audit of each original finding against the patched code using the same frameworks, criteria, and evidence standards as the original secure-code-audit, then emits a structured verification report.
- ▌ Validate Findings · openshift bundleUse when the user asks to validate, reproduce, exploit, red-team, or live-test security findings against a Kubernetes/OpenShift cluster, operator, WASM module, container, pod, or cluster component. Ingests *-security-audit, *-threat-model, and *-triage reports, builds an attack plan (replay + chained + novel), executes it against an authorized live target under a hard scope guard, and emits a schema-validated *-validation.{json,md} report.
- ▌ Operator Priv Profile · openshift bundleUse when the user asks whether an operator runs with least privilege, what SCCs/securityContext/namespaces/roles an operator uses or requires, or for a fleet least-privilege inventory of OpenShift core and optional operators. Builds a deterministic per-operator privilege profile from manifests/CSVs (tier 1 — SCC requests, per-container securityContext, namespaces/install modes, complete RBAC enumeration), diffs shipped RBAC against the code's +kubebuilder:rbac markers (tier 2 — surplus grants = least-priv gap), and ships a gated runtime capture for the actually-assigned SCC and effective SA permissions (tier 3, executed only with explicit cluster authorization).
- ▌ Security Audit Phased · openshift bundleUse when a reviewer wants to steer a security code audit between phases — Phase 1 reconnaissance, Phase 2 prior-vuln pattern analysis, Phase 3 systematic CWE-taxonomy weakness hunt (including PEACH tenant isolation), Phase 4 cross-cutting analysis and final report, Phase 6 reproducer generation, plus review/CVSS/follow-up-seed helpers. Each phase is a separate slash command that reads the previous phase's JSON and writes its own.
- ▌ Remediate Finding · openshift bundleUse when the user asks to remediate, patch, fix, or produce a code fix for a security finding from the audit campaign — creating a minimal reviewable patch on a private fork, running the repo's own build/test suite, and emitting a schema-validated remediation report.
- ▌ Secure Container Audit · openshiftUse when the user asks to perform a security audit, vulnerability scan, SBOM analysis, or supply-chain assessment of a container image (registry reference, payload image, or batch of images) using skopeo, syft, and grype — covering image configuration, known CVEs in shipped packages, signature/provenance posture, and drift between the image contents and its source repository.
- ▌ Generate Team Report · openshift bundleUse when the user asks to generate a shareable findings folder, executive summary, or team-specific security audit report for one or more products from the findings directory.
- ▌ Inventory Repositories · openshift bundleUse when the user asks to list, discover, inventory, or extract the source repositories that ship in a release payload image or an OLM operator bundle/catalog — e.g. "inventory release 4.21", "which repos ship in the foo operator 2.3", "refresh the payload inventory". Writes the per-segment CSV inventory and owners.csv that repo-graph and the dashboards read.
- ▌ Validate Browser Finding · openshift bundleUse when validating browser-exploitable findings such as CSRF, XSS, or clickjacking against authorized containerized labs with Playwright. Test progressively through authentication, middleware, and ingress defenses.
- ▌ Restructure Commits · openshiftRestructure branch commits into logical component-based commits for HyperShift PRs
- ▌ Triage Leaked Infra · openshiftAssess whether an AWS VPC or infra set from HyperShift CI is safe to delete. Use when the user pastes cleanleaked output and asks 'can I delete this?', 'is this safe to remove?', 'triage this infra', asks about a LEAKED or UNCERTAIN verdict, provides a VPC ID or infraID and wants to know if it's orphaned, or says 'check this VPC'. Also use when the user asks 'should I delete this?' about any AWS resource in the HyperShift CI account.
- ▌ Update Konflux Tasks · openshiftAutomatically update outdated Konflux Tekton tasks based on enterprise contract verification logs.
- ▌ Konflux Archived Pipelineruns · openshiftAccesses archived Konflux PipelineRuns, TaskRuns, and pod logs via KubeArchive. Auto-applies when checking Konflux PipelineRun results, investigating enterprise contract failures, or retrieving logs from completed Konflux CI runs.
- ▌ Fix Hypershift Repo Robot Pr · openshiftFix robot/bot PRs in HyperShift repo by regenerating files and creating a new PR with passing verification
- ▌ Test Tag Pipeline · openshiftCreate a manual PipelineRun to test tag pipeline changes before merging.
- ▌ Build Ho Image · openshiftBuild and push hypershift-operator container image. Auto-applies when testing HO changes that require deploying to a live cluster.
- ▌ Destroy Hc AWS · openshiftDestroy a HyperShift HostedCluster and all associated AWS infrastructure (VPC, IAM, Route53, etc.).
- ▌
- ▌ Build Cpo Image · openshiftBuild and push control-plane-operator container image. Auto-applies when testing CPO changes that require deploying to a live cluster.
- ▌
- ▌ Git Environment · openshiftCreate development environments with git worktrees, branches, commits, and push to remote. Auto-applies for git workflow tasks.
- ▌ Konflux Build · openshiftCreate a manual Konflux build from a PR with configurable image expiry (default 30 days)
- ▌ E2e Test Runner · openshiftProvides the ability to run and iterate on HyperShift e2e tests. Auto-applies when implementing features that require e2e validation, fixing e2e test failures, or working on tasks that need live cluster testing.
- ▌ Create Hc AWS · openshiftCreate a HyperShift HostedCluster on AWS for development and testing, with optional custom CPO/HO images.