AgentSkillsCN

security-compliance

实施安全扫描、漏洞检测与合规性检查。在开展安全审计、处理依赖项漏洞、进行敏感信息检测、运行CodeQL扫描、使用SAST/DAST工具，或遵循安全最佳实践时，均可使用该技能。同时支持威胁建模与安全加固工作。

SKILL.md
--- frontmatter
name: security-compliance
description: Implement security scanning, vulnerability detection, and compliance checks. Use when working with security audits, dependency vulnerabilities, secret detection, CodeQL scanning, SAST/DAST tools, or security best practices. Handles threat modeling and security hardening.

Security & Compliance Guardian

Mission

Maintain and enhance security posture for Brainarr through comprehensive scanning, vulnerability management, and compliance monitoring.

Current Security Infrastructure

  • •✅ CodeQL Scanning: Automated C# security analysis
  • •✅ Secret Detection: Pre-commit hooks + GitLeaks
  • •✅ Dependency Scanning: Dependabot automated updates
  • •✅ SBOM Generation: Software Bill of Materials in releases
  • •✅ Artifact Signing: Cosign keyless signing

Expertise Areas

1. Static Application Security Testing (SAST)

  • •CodeQL query customization for C# and .NET
  • •Security code review automation
  • •Vulnerability pattern detection (injection, XSS, etc.)
  • •False positive management and suppression

2. Dependency Security

  • •Dependabot configuration optimization
  • •Vulnerability remediation strategies
  • •Supply chain attack prevention
  • •License compliance checking

3. Secret Management

  • •Credential scanning (GitLeaks, TruffleHog)
  • •Environment variable security
  • •Secrets rotation policies
  • •API key protection strategies

4. Container Security (Future)

  • •Image vulnerability scanning (Trivy, Grype)
  • •Base image hardening
  • •Runtime security monitoring
  • •Registry security policies

5. Compliance & Auditing

  • •SBOM generation and management
  • •Security audit trails
  • •Compliance reporting (OWASP, CWE)
  • •Penetration testing coordination

Enhancement Opportunities

  1. •Dynamic Analysis: Add DAST for runtime vulnerability detection
  2. •Container Scanning: Scan Docker images when published
  3. •Secrets Rotation: Automate API key rotation
  4. •Security Dashboards: Centralized security metrics
  5. •Threat Modeling: Regular security architecture reviews

Security Best Practices

Code Security

  • •Input validation on all external data
  • •Parameterized queries (no SQL injection)
  • •Output encoding (prevent XSS)
  • •Secure cryptographic operations
  • •No hardcoded secrets

Dependency Management

  • •Pin dependency versions
  • •Regular security updates
  • •Monitor transitive dependencies
  • •Review dependency changes in PRs

API Security

  • •Authentication required for AI providers
  • •API key encryption at rest
  • •Rate limiting to prevent abuse
  • •Request/response validation

Security Checklist

  • • No hardcoded secrets in code
  • • All dependencies up-to-date
  • • CodeQL findings addressed
  • • SBOM generated for releases
  • • Artifacts signed and verified
  • • Security advisories monitored
  • • Incident response plan documented
  • • Third-party audits completed

Related Skills

  • •code-quality - Security is quality
  • •release-automation - Secure release processes
  • •observability - Security monitoring

Examples

Example 1: Review Security Scan Results

User: "Check the CodeQL findings and fix critical issues" Action: Review security alerts, prioritize by severity, fix vulnerabilities, add suppressions for false positives

Example 2: Update Vulnerable Dependency

User: "Dependabot found a critical vulnerability in Newtonsoft.Json" Action: Review vulnerability details, test compatibility, update version, verify tests pass, merge PR

Example 3: Implement Secret Scanning

User: "Add secret scanning to prevent API key leaks" Action: Configure GitLeaks, add .gitleaks.toml, create pre-commit hooks, scan history, document process