agentsclimarketplace
Sign in

Deploying securely

Skill pvnarp/harness-agentic-skills/skills/cross-product/deploying-securely

End-to-end secure deployment workflow chaining Harness SAST and SCA scanning (formerly Qwiet AI / ShiftLeft), Harness CI/CD pipelines, and Traceable API security validation. Runs pre-deployment code analysis, builds and deploys through Harness, then validates deployed APIs are secure. Use when user says "deploy securely", "secure deployment", "deploy with security checks", "CI/CD with security gates", or "release with security validation".From its SKILL.md

Install
npx -y skills add pvnarp/harness-agentic-skills --skill deploying-securely

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

9.9 KB, as published. Nobody here has run it

Secure Deploy

What this skill uses

Harness MCP tools: harness:harness_diagnose, harness:harness_execute, harness:harness_get, harness:harness_list, harness:harness_search Resource types: pipeline Traceable MCP tools: traceable-ai:get_query_time_range CLI: sl analyze, sl check-analysis REST API: https://app.shiftleft.io/api/v4

End-to-end secure deployment orchestration across Harness SAST and SCA, Harness (CI/CD), and Traceable (API security). This skill sequences pre-deployment code scanning, pipeline execution, and post-deployment API validation into a single coordinated workflow.

Instructions

Prerequisites

Collect from the user: repository path, Harness org and project, pipeline identifier, target environment, Harness SAST and SCA org ID (formerly Qwiet) ($SHIFTLEFT_ORG_ID), and Traceable service name. For production deployments, confirm intent explicitly.

Phase 1: Harness SAST and SCA Scan (Pre-Deployment Gate)

Follow the /qwiet-analyzing skill instructions. Detect the language, then run:

sl analyze --wait --app "<app-name>" --tag branch=<branch> <language-flags> .
sl check-analysis --v2 --app "<app-name>" --config shiftleft.yml

Decision point: If sl check-analysis returns exit code 0, proceed to Phase 2. If non-zero, retrieve findings via the REST API and report them, then STOP the deployment. Only proceed if the user explicitly overrides (log the override).

curl -s -H "Authorization: Bearer $SHIFTLEFT_ACCESS_TOKEN" \
  "https://app.shiftleft.io/api/v4/orgs/$SHIFTLEFT_ORG_ID/apps/<app-name>/findings?severity=critical,high" \
  | jq '.response.findings[] | {title, severity, file: .dataflow.source.file, line: .dataflow.source.line}'

Phase 2: Harness CI Pipeline (Build and Test)

Follow the /running-pipelines skill instructions for execution and /debugging-pipelines for failure diagnosis.

Use harness:harness_get (resource_type: "pipeline") to locate the pipeline. If it does not exist, follow the /creating-pipelines skill to create one with build, test, and security gate stages.

Execute with harness:harness_execute (resource_type: "pipeline", action: "run"). If it fails, use harness:harness_diagnose (resource_type: "pipeline", url=<execution URL>) to investigate. Report failures and ask the user whether to retry, fix, or abort.

Decision point: Pipeline succeeded -- proceed to Phase 3. Pipeline failed -- STOP unless the user resolves and re-runs.

Phase 3: Harness CD Deployment

If the pipeline includes a CD stage, deployment happens in Phase 2. If deployment is a separate pipeline, execute it with harness:harness_execute (resource_type: "pipeline", action: "run"), passing the target environment and build artifact tag from Phase 2 as inputs. Monitor until completion; use harness:harness_diagnose on failures.

Phase 4: Traceable API Security Validation (Post-Deployment)

Follow the Traceable MCP tool calling sequence from the project conventions. Run these assessments on the newly deployed service.

Step 4.1: API Inventory

Follow the /inventorying-apis skill instructions. Catalog all APIs for the deployed service. Confirm the expected endpoints are present.

Step 4.2: Risk Assessment

Follow the /assessing-risk skill instructions. Score the API risk posture for the deployed service. Flag any high or critical risk APIs.

Step 4.3: Authentication Coverage

Follow the /analyzing-auth-coverage skill instructions. Identify any APIs lacking authentication. This is especially critical for newly deployed endpoints.

Step 4.4: Shadow API Discovery

Follow the /discovering-shadow-apis skill instructions. Check for any undocumented or unexpected endpoints that appeared after deployment.

Step 4.5: Decision point

  • All checks pass (no critical API risks, no auth gaps, no shadow APIs): Deployment is validated.
  • Issues found: Report them with severity. Recommend rollback for critical issues. Let the user decide.

Phase 5: Consolidated Security Report

Generate a report combining results from all phases:

## Secure Deployment Report

**Date:** <date>
**Application:** <app-name>
**Environment:** <target-env>
**Pipeline:** <pipeline-id>

### Phase 1: Pre-Deployment SAST (Harness SAST and SCA)
- **Status:** PASS / FAIL / OVERRIDE
- **Findings:** X critical, Y high, Z medium
- **Policy Check:** Passed / Violated (details)

### Phase 2: CI Pipeline (Harness)
- **Status:** SUCCESS / FAILED
- **Build Duration:** X minutes
- **Test Results:** X passed, Y failed, Z skipped

### Phase 3: Deployment (Harness)
- **Status:** SUCCESS / FAILED / ROLLED_BACK
- **Environment:** <target-env>
- **Artifact:** <image:tag>

### Phase 4: Post-Deployment API Security (Traceable)
- **APIs Cataloged:** X endpoints across Y services
- **Risk Score:** X/100
- **Auth Coverage:** X% of APIs authenticated
- **Shadow APIs Found:** X
- **Critical Issues:** <list if any>

### Overall Verdict
<SECURE / AT RISK / BLOCKED>

### Recommendations
1. <prioritized action items>

Examples

Example 1: Standard secure deployment

User: "Deploy the payment-service to staging with full security checks"

What the AI does:

  1. Runs sl analyze --wait --app payment-service --java . on the repository
  2. Checks results with sl check-analysis --v2 -- finds 0 critical issues, proceeds
  3. Executes the payment-service-ci pipeline via harness:harness_execute
  4. Monitors until deployment to staging completes
  5. Runs Traceable API inventory, risk assessment, auth coverage, and shadow API checks
  6. Generates the consolidated report showing all green

Example 2: Deployment blocked by SAST findings

User: "Securely deploy user-auth to production"

What the AI does:

  1. Confirms production deployment intent with the user
  2. Runs sl analyze --wait --app user-auth --python .
  3. sl check-analysis returns exit code 1 -- critical SQL injection found
  4. Reports the finding: "Critical: SQL injection in auth/login.py line 42"
  5. STOPS deployment. Advises the user to fix the vulnerability first
  6. Does NOT proceed to pipeline execution

Example 3: Post-deployment API issues detected

User: "Deploy inventory-api to dev with security validation"

What the AI does:

  1. SAST scan passes, CI pipeline succeeds, deployment completes
  2. Traceable analyzing-auth-coverage finds 2 new endpoints without authentication
  3. Reports: "WARNING: 2 unauthenticated endpoints found post-deployment"
  4. Recommends adding authentication before promoting to staging
  5. Lets the user decide whether to keep the dev deployment or rollback

Related skills

Prerequisites (skills typically run before this one):

Composes with (skills commonly invoked together):

Follow-ups (skills commonly chained after this one):

Performance Notes

  • The Harness SAST and SCA scan is the longest step (5-30 minutes depending on codebase size). Always use --wait to block until complete.
  • Run Traceable assessments sequentially, not in parallel, since each depends on the time range initialization from traceable-ai:get_query_time_range.
  • Pipeline execution monitoring may require multiple status checks. Allow reasonable intervals between polls.
  • For large codebases, recommend the user run SAST scans as part of their regular CI rather than on-demand.
  • Accuracy of the security verdict matters more than speed. Do not skip any phase.

Troubleshooting

Harness SAST and SCA scan fails to start

  • Verify the sl CLI is installed: sl --version. Confirm authentication by checking that $HOME/.shiftleft/config.json exists.
  • Check that $SHIFTLEFT_ORG_ID and $SHIFTLEFT_ACCESS_TOKEN are set
  • Ensure the language is supported and build artifacts exist (Java needs .jar or .war)

Harness pipeline not found

  • Verify the org_id and project_id are correct
  • Use harness:harness_search with keywords to find the pipeline
  • Check that the user has execution permissions on the pipeline

Traceable returns no APIs after deployment

  • The service may need a few minutes of traffic before APIs appear in inventory
  • Verify the Traceable agent is installed in the target environment
  • Check that the service name in Traceable matches the deployed service

Deployment succeeds but Traceable shows high risk

  • This is expected for new services without security hardening
  • Review each finding individually before recommending rollback
  • Some findings may be informational rather than actionable

Pipeline execution times out

  • Use harness:harness_diagnose to identify the stuck stage
  • Check delegate connectivity with harness:harness_list on delegates
  • Review infrastructure provisioning if the deployment stage is hanging

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.