Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking, and security automation. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or ensuring compliance requirements.
npxskills add vuralserhat86/antigravity-agentic-skills--skill secops_coreLoading…
Complete toolkit for senior secops with modern tools and best practices.
This skill provides three core capabilities through automated scripts:
# Script 1: Security Scanner
python scripts/security_scanner.py [options]
# Script 2: Vulnerability Assessor
python scripts/vulnerability_assessor.py [options]
# Script 3: Compliance Checker
python scripts/compliance_checker.py [options]
Automated tool for security scanner tasks.
Features:
Usage:
python scripts/security_scanner.py <project-path> [options]
Comprehensive analysis and optimization tool.
Features:
Usage:
python scripts/vulnerability_assessor.py <target-path> [--verbose]
Advanced tooling for specialized tasks.
Features:
Usage:
python scripts/compliance_checker.py [arguments] [options]
Comprehensive guide available in references/security_standards.md:
Complete workflow documentation in references/vulnerability_management_guide.md:
Technical reference guide in references/compliance_requirements.md:
Languages: TypeScript, JavaScript, Python, Go, Swift, Kotlin Frontend: React, Next.js, React Native, Flutter Backend: Node.js, Express, GraphQL, REST APIs Database: PostgreSQL, Prisma, NeonDB, Supabase DevOps: Docker, Kubernetes, Terraform, GitHub Actions, CircleCI Cloud: AWS, GCP, Azure
# Install dependencies
npm install
# or
pip install -r requirements.txt
# Configure environment
cp .env.example .env
# Use the analyzer script
python scripts/vulnerability_assessor.py .
# Review recommendations
# Apply fixes
Follow the patterns and practices documented in:
references/security_standards.mdreferences/vulnerability_management_guide.mdreferences/compliance_requirements.md# Development
npm run dev
npm run build
npm run test
npm run lint
# Analysis
python scripts/vulnerability_assessor.py .
python scripts/compliance_checker.py --analyze
# Deployment
docker build -t app:latest .
docker-compose up -d
kubectl apply -f k8s/
Check the comprehensive troubleshooting section in references/compliance_requirements.md.
references/security_standards.mdreferences/vulnerability_management_guide.mdreferences/compliance_requirements.mdscripts/ directoryKapsamlı güvenlik taraması ve vulnerability detection rehberi.
- [ ] Role-based access control (RBAC) implementasyonu
- [ ] URL/API endpoint authorization
- [ ] Direct object reference koruması
- [ ] CORS policy kontrolü
- [ ] Sensitive data şifreleme (at-rest, in-transit)
- [ ] TLS 1.2+ kullanımı
- [ ] Güçlü hashing algoritmaları (bcrypt, argon2)
- [ ] Secret management (env, vault)
- [ ] SQL injection koruması (parametrized queries)
- [ ] XSS prevention (output encoding)
- [ ] Command injection kontrolü
- [ ] NoSQL injection koruması
- [ ] Input validation
- [ ] Output encoding/escaping
- [ ] Content Security Policy (CSP)
- [ ] HTTPOnly cookies
# JavaScript/TypeScript
npm audit
npx eslint --ext .js,.ts . --rule 'security/*'
# Python
pip-audit
bandit -r .
# Genel
semgrep --config=auto .
| Kontrol | Açıklama | Öncelik |
|---|---|---|
| Hardcoded secrets | API key, password, token | 🔴 Kritik |
| Unsafe deserialization | JSON/XML parsing | 🔴 Kritik |
| Path traversal | File system access | 🟡 Yüksek |
| Regex DoS | ReDoS vulnerabilities | 🟡 Yüksek |
npm audit --audit-level=high
npm audit fix
# Alternatif
npx snyk test
pip-audit
safety check
// Express.js örnek
app.use(session({
secret: process.env.SESSION_SECRET,
resave: false,
saveUninitialized: false,
cookie: {
secure: true,
httpOnly: true,
sameSite: 'strict',
maxAge: 3600000 // 1 saat
}
}));
- [ ] Consent management
- [ ] Right to deletion
- [ ] Data portability
- [ ] Privacy policy
# Full security scan
npm audit && npx eslint . && semgrep --config=auto .
# Dependency vulnerability check
npm audit --audit-level=critical
Security Audit v1.0 - 2025 Best Practices
This skill empowers Claude to perform comprehensive security scans of container images and running containers. By leveraging industry-standard tools, it identifies vulnerabilities and provides insights for remediation, enhancing the overall security of containerized applications.
This skill activates when you need to:
User request: "Scan this Docker image for vulnerabilities before I deploy it: myapp:latest"
The skill will:
myapp:latest Docker image.User request: "Scan the running container with ID abc123xyz for security vulnerabilities."
The skill will:
abc123xyz.This skill can be integrated with other CI/CD pipeline tools to automate security checks as part of the deployment process. It also provides data that can be used with reporting and dashboarding tools to visualize security posture over time.
Dependency security ve vulnerability management.
# npm audit
npm audit
npm audit fix
# Snyk
npx snyk test
npx snyk monitor
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: npm
directory: "/"
schedule:
interval: weekly
open-pull-requests-limit: 10
| Severity | Action |
|---|---|
| Critical | Hemen update |
| High | 24 saat içinde |
| Medium | Sprint içinde |
| Low | Planla |
# ZORUNLU: Lock file commit et
git add package-lock.json
SecOps Core v1.1 - Enhanced
Kaynak: OWASP DevSecOps Guideline & CNCF Cloud Native Security
npm audit, snyk veya trivy ile 3. parti kütüphane zafiyetlerini CI/CD'de bloklayacak şekilde tara.git-secrets veya trufflehog ile kod deposuna şifre/token pushlanmasını engelle (Pre-commit hook).SonarQube veya CodeQL ile güvenlik açıklarını (SQLi, XSS) tara.OWASP ZAP ile dışarıdan saldırı simülasyonu yap.checkov veya kics ile yanlış konfigürasyonlara karşı tara.Falco ile izle.| Aşama | Doğrulama |
|---|---|
| 1 | Pipeline güvenlik taramasını geçemeyen build'i durduruyor mu? |
| 2 | Secrets yönetimi için Vault veya Cloud KMS kullanılıyor mu? (Environment variable'da plain text yok). |
| 3 | Tüm güvenlik bulguları merkezi bir dashboard'da toplanıyor mu? (DefectDojo vb.). |
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).