Devsecops Pipeline skills for AI agents

Integrate static and dynamic application security testing into the CI/CD pipeline so security checks run on every PR and before every deploy. Covers tool selection, gating policy, false-positive management, and reporting. Use when adding security automation to an existing pipeline.

Encode security policy as version-controlled, testable artifacts that the build pipeline enforces — instead of as PDF documents or wiki pages. Covers policy frameworks (OPA, Cedar), guardrails, automated audits, and the cultural shift from review-based to enforcement-based security.

Build the detection layer that catches attacks in production — log collection, signal-to-noise tuning, alert prioritization, and the detection-engineering discipline. Distinct from prevention; detection is the layer that fires when prevention fails.

Defend against supply-chain attacks: malicious dependencies, typosquats, compromised build pipelines, unsigned artifacts. Covers SBOM generation, artifact signing, dependency lockfile discipline, and supply-chain monitoring. Use when designing a hardened build and release pipeline.

Run a threat modeling session as part of a design review for any significant new feature or system. Covers the STRIDE framework, attack-tree decomposition, asset identification, and the artifact the modeling produces. Use when designing or reviewing any system with security implications.