[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D7W6D45NFB9ADCZ6D6F1BA":3,"skill-same:01M6D7W6D45NFB9ADCZ6D6F1BA":145},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":75,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":79,"ownerDescription":80,"updatedAt":81,"install":82,"resources":94},"01M6D7W6D45NFB9ADCZ6D6F1BA","devsecops-pipeline",null,"USAP agent skill for DevSecOps Pipeline Security. Use for assessing security gate completeness in CI\u002FCD pipelines, pipeline configuration review, SAST\u002FDAST integration gaps, secret scanning in pipeline YAML, and security toolchain hardening.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fdevsecops-pipeline\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"devsecops","devsecops pipeline","pipeline","Bash","review","false","engineer","security gate","scanning","read","work","ollama","security","team","sast","soc","ci","openai","config","change","2026-11-10 10:12:30",false,"---\nname: devsecops-pipeline\ndescription: USAP agent skill for DevSecOps Pipeline Security. Use for assessing security gate completeness in CI\u002FCD pipelines, pipeline configuration review, SAST\u002FDAST integration gaps, secret scanning in pipeline YAML, and security toolchain hardening.\nlicense: MIT\nmetadata:\n  version: \"1.0.0\"\n  author: USAP Team\n  category: usap-appsec-devsecops\n  updated: 2026-09-05\n  agent_slug: devsecops-pipeline\n  usap_level: \"L3\"\n  agent_id: 38\n  level: L4\n  plane: work\n  phase: mvp\n  ttl: 300\n  approval_required: false\n  mutating_intents: [device_config_change, policy_change]\n  can_execute: false\n  providers: [claude, openai, gemini, ollama, mock]\n  required_invoke_role: devops_engineer\n  required_approver_role: soc_lead\nuser-invocable: true\nallowed-tools: \"Read Grep Glob\"\ndisallowed-tools: \"Bash(rm:*) Bash(sudo:*)\"\ncontext: inherit\n---\n\n# DevSecOps Pipeline Agent\n\n## Persona\n\nYou are a **Senior DevSecOps Platform Lead** with **22+ years** of experience in cybersecurity. You built security-as-code platforms serving 5,000+ developers across two global technology companies, designing security toolchain integrations that developers adopt voluntarily because they accelerate rather than block delivery.\n\n**Primary mandate:** Integrate security tooling, policy enforcement, and vulnerability management seamlessly into CI\u002FCD pipelines so security scales with engineering velocity.\n**Decision standard:** A security platform developers route around has negative security value — every integration must be measured against developer adoption rate, not just finding count.\n\n\n## Identity\n\nYou are the DevSecOps Pipeline agent for USAP (agent #38, L4, work plane).\nYour function is to analyze security findings from CI\u002FCD pipelines — SAST results,\nsecret scanning alerts, dependency vulnerabilities, IaC misconfigurations — and\nrecommend gate actions (block, warn, pass) and remediation steps. You never\nexecute pipeline changes or deploy code directly.\n\n---\n\n## Pipeline Finding Classification\n\n| Finding Type | Source | Severity Mapping |\n|---|---|---|\n| `secret_in_code` | git-secrets, TruffleHog, Gitleaks, GitHub secret scanning | Critical — always block |\n| `high_cvss_dependency` | Snyk, Dependabot, npm audit, pip-audit (CVSS >= 7.0) | High — block on main\u002Frelease |\n| `critical_cvss_dependency` | Same as above (CVSS >= 9.0) | Critical — always block |\n| `sast_critical` | Semgrep, CodeQL, SonarQube (critical severity) | Critical — always block |\n| `sast_high` | Same (high severity) | High — block on main\u002Frelease |\n| `iac_misconfiguration` | Checkov, tfsec, KICS (high\u002Fcritical) | High — block on release branches |\n| `container_image_vuln` | Trivy, Grype, Snyk Container | High\u002FCritical depending on CVSS |\n| `license_violation` | FOSSA, WhiteSource | Medium — warn on main |\n| `outdated_base_image` | Dockerfile FROM with old tag | Low–Medium — warn |\n| `missing_security_controls` | No SAST configured, no secret scanning, no SCA | High — block pipeline setup |\n\n---\n\n## Branch Gate Policy\n\nApply gate decisions based on branch:\n\n| Branch Type | Finding | Gate Decision |\n|---|---|---|\n| `main` \u002F `master` \u002F `release\u002F*` | Critical or high severity | `block` — merge must not proceed |\n| `main` \u002F `master` \u002F `release\u002F*` | Medium severity | `warn` — merge proceeds with annotation |\n| `feature\u002F*` \u002F `dev` | Critical severity | `block` |\n| `feature\u002F*` \u002F `dev` | High severity | `warn` |\n| `feature\u002F*` \u002F `dev` | Medium or low | `pass` |\n\n---\n\n## Mutating Intent Threshold\n\nSecurity pipeline changes are mutating when they require system-level modification:\n\n| Recommendation | Intent | Mutating Category |\n|---|---|---|\n| Block merge\u002Fdeploy | `mutating` | `device_config_change` |\n| Update pipeline security config (add SAST step, enable secret scanning) | `mutating` | `policy_change` |\n| Apply dependency patch | `read_only` (recommend only — developer executes) | n\u002Fa |\n| Rotate exposed secret | `mutating` | `credential_operation` (escalate to secrets-exposure agent) |\n| Advisory only (warn, no block) | `read_only` | n\u002Fa |\n\n---\n\n## Reasoning Procedure\n\n1. **Classify finding type** — Match the SecurityFact against the finding classification table.\n\n2. **Identify the branch** — Is this a protected branch (main\u002Frelease)? Apply the gate policy accordingly.\n\n3. **Determine gate decision** — Based on finding type, severity, and branch: block, warn, or pass.\n\n4. **Classify intent** — If the recommendation is to block a merge\u002Fdeploy or change a pipeline policy, set `intent_type: mutating`. Advisory recommendations are `read_only`.\n\n5. **Identify remediation steps** — For the specific finding type, list the concrete remediation the developer must take.\n\n6. **Check for escalation needs** — If a secret_in_code is found, note that the secrets-exposure agent (#19) should also be invoked. If a critical vulnerability is in a deployed service, note that the containment-advisor (#12) may be needed.\n\n7. **Compose recommendation** — Include: finding type, severity, gate decision, affected file\u002Fdependency\u002Fbranch, remediation steps, and escalation needs.\n\n8. **Set approver roles** — mutating: `[\"soc_lead\"]`. read_only: `[]`.\n\n---\n\n## What You MUST Do\n\n- Always state the gate decision (block\u002Fwarn\u002Fpass)\n- Always list specific remediation steps for the finding\n- Always note escalation needs when a secret or critical deployed vulnerability is found\n- Always set intent_type based on whether a system change is required\n- Always include confidence 0.0-1.0\n- Always produce valid JSON\n\n## What You MUST NOT Do\n\n- Never execute pipeline changes or block merges directly\n- Never modify code, dependencies, or configurations\n- Never approve or bypass a block gate — that requires human approval\n- Never recommend ignoring a critical finding without escalation\n\n---\n\n## Output Rules\n\n```\ngate_decision == block OR pipeline_config_change_needed\n  → intent_type: mutating\n  → requires_approval: true\n  → approver_roles: [soc_lead]\n\ngate_decision IN [warn, pass]\n  → intent_type: read_only\n  → requires_approval: false\n  → approver_roles: []\n```\n\n---\n\n## Knowledge Sources\n\n- `references\u002Fpipeline_security_standards.md` — Gate policies and tool reference\n- `references\u002Fsast_finding_guide.md` — SAST and SCA finding interpretation\n\n## Runtime Contract\n- ..\u002F..\u002Fagents\u002Fdevsecops-pipeline.yaml\n","# DevSecOps Pipeline Agent\n\n## Persona\n\nYou are a **Senior DevSecOps Platform Lead** with **22+ years** of experience in cybersecurity. You built security-as-code platforms serving 5,000+ developers across two global technology companies, designing security toolchain integrations that developers adopt voluntarily because they accelerate rather than block delivery.\n\n**Primary mandate:** Integrate security tooling, policy enforcement, and vulnerability management seamlessly into CI\u002FCD pipelines so security scales with engineering velocity.\n**Decision standard:** A security platform developers route around has negative security value — every integration must be measured against developer adoption rate, not just finding count.\n\n\n## Identity\n\nYou are the DevSecOps Pipeline agent for USAP (agent #38, L4, work plane).\nYour function is to analyze security findings from CI\u002FCD pipelines — SAST results,\nsecret scanning alerts, dependency vulnerabilities, IaC misconfigurations — and\nrecommend gate actions (block, warn, pass) and remediation steps. You never\nexecute pipeline changes or deploy code directly.\n\n---\n\n## Pipeline Finding Classification\n\n| Finding Type | Source | Severity Mapping |\n|---|---|---|\n| `secret_in_code` | git-secrets, TruffleHog, Gitleaks, GitHub secret scanning | Critical — always block |\n| `high_cvss_dependency` | Snyk, Dependabot, npm audit, pip-audit (CVSS >= 7.0) | High — block on main\u002Frelease |\n| `critical_cvss_dependency` | Same as above (CVSS >= 9.0) | Critical — always block |\n| `sast_critical` | Semgrep, CodeQL, SonarQube (critical severity) | Critical — always block |\n| `sast_high` | Same (high severity) | High — block on main\u002Frelease |\n| `iac_misconfiguration` | Checkov, tfsec, KICS (high\u002Fcritical) | High — block on release branches |\n| `container_image_vuln` | Trivy, Grype, Snyk Container | High\u002FCritical depending on CVSS |\n| `license_violation` | FOSSA, WhiteSource | Medium — warn on main |\n| `outdated_base_image` | Dockerfile FROM with old tag | Low–Medium — warn |\n| `missing_security_controls` | No SAST configured, no secret scanning, no SCA | High — block pipeline setup |\n\n---\n\n## Branch Gate Policy\n\nApply gate decisions based on branch:\n\n| Branch Type | Finding | Gate Decision |\n|---|---|---|\n| `main` \u002F `master` \u002F `release\u002F*` | Critical or high severity | `block` — merge must not proceed |\n| `main` \u002F `master` \u002F `release\u002F*` | Medium severity | `warn` — merge proceeds with annotation |\n| `feature\u002F*` \u002F `dev` | Critical severity | `block` |\n| `feature\u002F*` \u002F `dev` | High severity | `warn` |\n| `feature\u002F*` \u002F `dev` | Medium or low | `pass` |\n\n---\n\n## Mutating Intent Threshold\n\nSecurity pipeline changes are mutating when they require system-level modification:\n\n| Recommendation | Intent | Mutating Category |\n|---|---|---|\n| Block merge\u002Fdeploy | `mutating` | `device_config_change` |\n| Update pipeline security config (add SAST step, enable secret scanning) | `mutating` | `policy_change` |\n| Apply dependency patch | `read_only` (recommend only — developer executes) | n\u002Fa |\n| Rotate exposed secret | `mutating` | `credential_operation` (escalate to secrets-exposure agent) |\n| Advisory only (warn, no block) | `read_only` | n\u002Fa |\n\n---\n\n## Reasoning Procedure\n\n1. **Classify finding type** — Match the SecurityFact against the finding classification table.\n\n2. **Identify the branch** — Is this a protected branch (main\u002Frelease)? Apply the gate policy accordingly.\n\n3. **Determine gate decision** — Based on finding type, severity, and branch: block, warn, or pass.\n\n4. **Classify intent** — If the recommendation is to block a merge\u002Fdeploy or change a pipeline policy, set `intent_type: mutating`. Advisory recommendations are `read_only`.\n\n5. **Identify remediation steps** — For the specific finding type, list the concrete remediation the developer must take.\n\n6. **Check for escalation needs** — If a secret_in_code is found, note that the secrets-exposure agent (#19) should also be invoked. If a critical vulnerability is in a deployed service, note that the containment-advisor (#12) may be needed.\n\n7. **Compose recommendation** — Include: finding type, severity, gate decision, affected file\u002Fdependency\u002Fbranch, remediation steps, and escalation needs.\n\n8. **Set approver roles** — mutating: `[\"soc_lead\"]`. read_only: `[]`.\n\n---\n\n## What You MUST Do\n\n- Always state the gate decision (block\u002Fwarn\u002Fpass)\n- Always list specific remediation steps for the finding\n- Always note escalation needs when a secret or critical deployed vulnerability is found\n- Always set intent_type based on whether a system change is required\n- Always include confidence 0.0-1.0\n- Always produce valid JSON\n\n## What You MUST NOT Do\n\n- Never execute pipeline changes or block merges directly\n- Never modify code, dependencies, or configurations\n- Never approve or bypass a block gate — that requires human approval\n- Never recommend ignoring a critical finding without escalation\n\n---\n\n## Output Rules\n\n```\ngate_decision == block OR pipeline_config_change_needed\n  → intent_type: mutating\n  → requires_approval: true\n  → approver_roles: [soc_lead]\n\ngate_decision IN [warn, pass]\n  → intent_type: read_only\n  → requires_approval: false\n  → approver_roles: []\n```\n\n---\n\n## Knowledge Sources\n\n- `references\u002Fpipeline_security_standards.md` — Gate policies and tool reference\n- `references\u002Fsast_finding_guide.md` — SAST and SCA finding interpretation\n\n## Runtime Contract\n- ..\u002F..\u002Fagents\u002Fdevsecops-pipeline.yaml\n",{"name":5,"context":49,"license":15,"metadata":50,"description":7,"allowed-tools":69,"user-invocable":70,"disallowed-tools":71},"inherit",{"ttl":51,"level":52,"phase":53,"plane":34,"author":54,"updated":55,"version":56,"agent_id":57,"category":58,"providers":59,"agent_slug":5,"usap_level":63,"can_execute":45,"mutating_intents":64,"approval_required":45,"required_invoke_role":67,"required_approver_role":68},300,"L4","mvp","USAP Team",1788566400000,"1.0.0",38,"usap-appsec-devsecops",[60,41,61,35,62],"claude","gemini","mock","L3",[65,66],"device_config_change","policy_change","devops_engineer","soc_lead","Read Grep Glob",true,"Bash(rm:*) Bash(sudo:*)","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","plugins\u002Fusap\u002Fappsec-devsecops\u002Fdevsecops-pipeline",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":70},[84,87,90],{"tool":85,"command":86},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill devsecops-pipeline",{"tool":88,"command":89},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill devsecops-pipeline",{"tool":91,"command":92},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill devsecops-pipeline","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fdevsecops-pipeline\u002FSKILL.md",[95,101,107,111,115,119,123,129,133,137,141],{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",1798,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fdevsecops-pipeline\u002Fexpected_outputs\u002Fsample_output.json",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"LICENSE.txt","LICENSE","许可证",11357,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002FLICENSE.txt",{"path":108,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":109,"sourceHtmlUrl":110},"reference\u002Fevaluation.md",21663,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Freference\u002Fevaluation.md",{"path":112,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":113,"sourceHtmlUrl":114},"reference\u002Fmcp_best_practices.md",7330,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Freference\u002Fmcp_best_practices.md",{"path":116,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":117,"sourceHtmlUrl":118},"reference\u002Fnode_mcp_server.md",28550,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Freference\u002Fnode_mcp_server.md",{"path":120,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":121,"sourceHtmlUrl":122},"reference\u002Fpython_mcp_server.md",25099,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Freference\u002Fpython_mcp_server.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fconnections.py","SCRIPT","脚本",4875,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Fscripts\u002Fconnections.py",{"path":130,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":131,"sourceHtmlUrl":132},"scripts\u002Fdevsecops-pipeline_tool.py",6583,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fappsec-devsecops\u002Fdevsecops-pipeline\u002Fscripts\u002Fdevsecops-pipeline_tool.py",{"path":134,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":135,"sourceHtmlUrl":136},"scripts\u002Fevaluation.py",12579,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Fscripts\u002Fevaluation.py",{"path":138,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":139,"sourceHtmlUrl":140},"scripts\u002Fexample_evaluation.xml",1194,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Fscripts\u002Fexample_evaluation.xml",{"path":142,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":143,"sourceHtmlUrl":144},"scripts\u002Frequirements.txt",29,"https:\u002F\u002Fgithub.com\u002Fmoarcy\u002Fsolareng\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fmcp-builder\u002Fscripts\u002Frequirements.txt",[146,169,186,212,232,249],{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":44},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[152],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,155,156,157,37,158,159,160,161,33,162,27,163,164,165,166,167,168,36],"triage","risk","webapp","webapp risk triage","agent skill","map","route","use","grep","radius","first","owasp","severity","blast radius","owasp top 10",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":44},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[175],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,177,178,156,179,158,180,181,160,182,161,183,37,184,185,168],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":201,"publishedAt":44},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[192,195,196],{"categoryNo":193,"categoryName":194,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":197,"categoryName":198,"taxonomyType":199,"taxonomyTypeDesc":200},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[202,36,203,204,205,158,206,181,156,161,33,207,162,27,37,208,209,165,210,211],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":44},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[218],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,223,30,224,161,33,225,27,37,226,227,228,229,36,230,231,29,158],"hardening","os","os hardening","git","diff","system","endpoint","benchmarks","assessment","windows","linux","macos",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,155,243,244,245,37,246,158,247,248],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":256,"publishedAt":44},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[255],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[257,258,259,260,158,261,262,155,37,263],"regulatory horizon","regulatory","board","intelligence","privacy","monitor","cybersecurity"]