Devsecops

Skill valdomirosouza/agent-skills/skills/devsecops

Expert AI Agent Skills for SDD, SRE, DevSecOps and Enterprise Engineering

Install

npx -y skills add valdomirosouza/agent-skills --skill devsecops

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Integrates security into CI/CD pipelines using SAST, DAST, SCA, container scanning, and OWASP controls. Implements PII protection, data anonymization, and secure coding practices. Use when configuring security tooling in pipelines, reviewing code for security vulnerabilities, implementing OWASP Top 10 controls, handling PII data, anonymizing sensitive content, or assessing compliance with LGPD, GDPR, or PCI-DSS requirements.

SKILL.md

3.7 KB, as published. Nobody here has run it

DevSecOps

CI/CD security gates (mandatory)
SAST tooling by language
DAST configuration
OWASP Top 10 controls → owasp-controls.md
Secure coding checklist
PII classification and anonymization → pii-anonymization.md

CI/CD Security Gates — All Blocking

Gate	Tool	Blocks on
Secret detection	gitleaks, truffleHog	Any secret found
SAST	Semgrep, SonarQube	CRITICAL or HIGH findings
SCA (dependencies)	OWASP Dependency Check, Snyk	Known CVE CRITICAL/HIGH
Container scan	Trivy, Grype	Critical CVEs in base image
IaC scan	Checkov, tfsec	CRITICAL misconfigurations
License check	FOSSA	Incompatible licenses
DAST	OWASP ZAP	OWASP Top 10 HIGH/CRITICAL (staging)
SBOM	Syft / CycloneDX	Missing or unsigned SBOM

SAST — Tools by Language

Language	Primary	Secondary
Python	Semgrep + Bandit	PyLint security rules
JavaScript/TypeScript	Semgrep + ESLint security	njsscan
Go	Semgrep + gosec	staticcheck
Java	SonarQube + SpotBugs	Checkmarx
Terraform/IaC	Checkov + tfsec	Terrascan
Kubernetes YAML	Kubesec + Polaris	OPA/Gatekeeper
Dockerfile	Hadolint + Trivy	Dockle

DAST — Configuration

tool: OWASP ZAP
target: https://staging.[service].internal

scan_types:
  baseline_scan: "Passive — every PR"
  full_scan:     "Active — every release"
  api_scan:      "OpenAPI spec imported — focus on endpoints"

blocking_findings:
  - OWASP Top 10 (A01–A10) with severity HIGH/CRITICAL

reports:
  formats: [HTML, JSON, XML]
  retention: 90 days

Secure Coding Checklist

Input / Output

Input validation on all entry points (API, forms, queues) — type, size, format
Output encoding before rendering user data
Parameterized queries — never string interpolation in SQL
Errors do not expose stack traces or internal data to clients

Authentication / Authorization

Authorization check on every operation (not just the route)
JWT tokens: access 15min, refresh 7d, signature RS256 or ES256
Sessions invalidated on logout
No tokens in URLs or logs

Resilience / Availability

Retry with exponential backoff and circuit breaker on external calls
Rate limiting on all public endpoints
Resource limits on all containers

Infrastructure

Base images: distroless or alpine minimal (no shell in production)
Containers running as non-root
Read-only filesystem where possible
All secrets via vault — no plaintext environment variables

PII Classification

Level	Type	Examples	Minimum control
L1 — Critical	Financial, health	Card number, medical record	Encrypted at rest + transit, audited access
L2 — Sensitive	Personal identifiers	CPF, email, national ID	Encrypted, pseudonymization
L3 — Restricted	Behavioral	IP, access logs	Masking, limited retention
L4 — Public	Non-personal	Product name	Standard controls

Full anonymization patterns → pii-anonymization.md

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.