Build Security Operations Skills
Security skill authors need consistent workflows, references, and validation patterns. This template provides reusable structures for security guidance, rules, and CI scanning.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "skill-name" from https://skillstore.io/skills/agentsecops-skill-name.md and its manifest at https://skillstore.io/api/skills/agentsecops-skill-name/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "skill-name". Create a SAST skill outline for Python services.
Expected outcome:
Using "skill-name". Plan CI security scanning for a Node.js repository.
Expected outcome:
Most detections are Markdown, security examples, or defensive reference material and are false positives. The CI asset contains a confirmed critical supply-chain risk because it pipes an unpinned remote installer directly to Bash.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-skill-name/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-skill-name?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-skill-name?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-skill-name/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-skill-name.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). skill-name security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-skill-name/audits/9@techreport{agentsecops-agentsecops-skill-name-2026,
author = {AgentSecOps},
title = {skill-name security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/agentsecops-skill-name/audits/9},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-name security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-skill-name/audits/9"
identifiers:
- type: other
value: "skillstore:agentsecops-skill-name:audit:9"
description: "Skillstore immutable audit report identifier"
Define repeatable vulnerability analysis, severity classification, remediation, and validation steps for a development team.
Adapt the CI asset to document approved scanners, artifacts, thresholds, and reporting practices.
Use the checklist patterns to structure detection, containment, eradication, recovery, and post-incident tasks.
Create a security skill outline for [security task]. Define users, triggers, workflow steps, expected outputs, and validation criteria.
Adapt the rule template for [vulnerability]. Include detection logic, severity, framework mappings, vulnerable examples, safe alternatives, and false-positive guidance.
Adapt the CI template for [repository stack]. Select scanners, pin trusted dependencies, define permissions, set failure thresholds, and retain useful artifacts.
Design an incident-response skill for [incident type]. Include decision branches, approvals, evidence handling, containment checks, recovery validation, escalation, and audit outputs.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Ref
181fdefcafd96b041926e61c4b2e306ca7e7820e
Maintenance freshness
7/24/2026
Usage
5 downloads · 206 views
File structure
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Automate SecOps Checks
by alirezarezvani
Security teams need consistent review workflows across projects. This skill provides SecOps CLI scaffolds and reference guides for repeatable checks.
Configure SAST for DevSecOps Pipelines
by wshobson
Teams need repeatable security scans before code reaches production. This skill guides SAST setup, rule tuning, and CI gate configuration.
Review Application Security Risks
by Bikach
Security reviews can miss issues across authentication, input handling, APIs, and secrets. This skill provides structured guidance, checklists, and remediation patterns for application-security work.
Build Security Blue Books for Sensitive Apps
by sickn33
Sensitive applications need clear security documentation before review. This skill helps Codex, Claude, and Claude Code draft structured Blue Book guidance.
Assess Common Web Vulnerabilities
by sickn33
Web teams need a consistent way to recognize common application risks. This skill provides a structured vulnerability reference with causes, impacts, and mitigations.