「sbom」の検索結果

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.

日本語の概要は準備中です。原文の説明を表示しています。

External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the target has a public GitHub org, when their build artifacts/SBOMs are reachable, when their docker images are on Docker Hub/GHCR, or when you find internal package names in their JS bundles.

日本語の概要は準備中です。原文の説明を表示しています。

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

日本語の概要は準備中です。原文の説明を表示しています。

Open source license compliance check for a dependency list, a single library, or outbound code. Use when reviewing a manifest, SBOM, or repo for copyleft obligations and license compatibility, when asked whether a library can ship, or when preparing code to be open-sourced.

日本語の概要は準備中です。原文の説明を表示しています。

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across ecosystems to identify vulnerabilities, assess risks, and recommend remediation.

日本語の概要は準備中です。原文の説明を表示しています。

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

日本語の概要は準備中です。原文の説明を表示しています。

Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.

日本語の概要は準備中です。原文の説明を表示しています。

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).

日本語の概要は準備中です。原文の説明を表示しています。

Expert knowledge for Azure Firmware Analysis development including best practices, security, integrations & coding patterns, and deployment. Use when configuring RBAC/service principals, uploading firmware via CLI/PowerShell/Python, mapping results to Device Registry, reading SBOM paths, or deploying workspaces with ARM/Bicep/Terraform, and other Azure Firmware Analysis related development tasks. Not for Azure Defender For Iot (use azure-defender-for-iot), Azure IoT Edge (use azure-iot-edge), Azure IoT Hub (use azure-iot-hub), Azure Confidential Computing (use azure-confidential-computing).

日本語の概要は準備中です。原文の説明を表示しています。

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

日本語の概要は準備中です。原文の説明を表示しています。

Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines. Use when building DevSecOps workflows, ensuring compliance, or establishing security gates for container deployments.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need framework-agnostic Docker and container image guidance for Java projects - Dockerfile design, multi-stage Maven builds, jlink custom runtimes, micro runtime distributions such as Alpaquita, JVM container ergonomics, non-root execution, image metadata, .dockerignore, reproducible builds, vulnerability scanning, SBOM awareness, and production-safe container defaults. This should trigger for requests such as Review Java Dockerfile; Improve Docker image security; Add jlink runtime to a Java container; Add containerization to a Java project; Optimize Java container image size; Review Docker build reproducibility. Part of Plinth Toolkit

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing, designing, or modifying Java enterprise products, services, libraries, agents, plugins, connected components, or platform modules that may qualify as products with digital elements and need EU Cyber Resilience Act secure-by-design, vulnerability handling, security update, SBOM, product documentation, or release-readiness controls. Part of Plinth Toolkit

日本語の概要は準備中です。原文の説明を表示しています。

Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit. Use for CI/CD security gates, pre-deployment audits, compliance requirements, or encountering CVE detection, outdated packages, license compliance, SBOM generation errors.

日本語の概要は準備中です。原文の説明を表示しています。

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.

日本語の概要は準備中です。原文の説明を表示しています。

Guides dependency audits and upgrades. Use when auditing dependencies, upgrading vulnerable packages, managing lockfiles or package managers, SBOMs, or update and monorepo policy.

日本語の概要は準備中です。原文の説明を表示しています。

供应链安全时使用。适用于依赖漏洞扫描 / 镜像安全 / CI 投毒防护 / SBOM。融合 SLSA + Sigstore + Snyk + Trivy。

日本語の概要は準備中です。原文の説明を表示しています。

Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.

日本語の概要は準備中です。原文の説明を表示しています。

Build native Linux packages (.deb / .rpm / .apk / .pkg.tar.zst) from a PKGBUILD or yap.json project using the yap-mcp Model Context Protocol server. Use this skill whenever the user asks to "build a package", "make a deb/rpm", "cross-compile for arm64/aarch64", "sign a release", generate SBOMs, install a built artifact, or diagnose why a yap build failed. The yap MCP server exposes async builds with buildID polling, validation, dependency-graph inspection, and artifact discovery.

日本語の概要は準備中です。原文の説明を表示しています。

DevSecOps skill for securing CI/CD pipelines, infrastructure as code, containers, Kubernetes, cloud deployments, secrets handling, dependency management, SAST/DAST/SCA, release gates, supply-chain controls, SBOMs, policy-as-code, and secure SDLC workflows. Use for pipeline hardening, deployment risk reviews, security automation, and remediation planning.

日本語の概要は準備中です。原文の説明を表示しています。

Manage software composition analysis — SBOMs, vulnerability triage, and remediation of third-party dependencies.

日本語の概要は準備中です。原文の説明を表示しています。

Meet EU Cyber Resilience Act vulnerability duties — coordinated disclosure, SBOMs, and lifecycle security for digital products.

日本語の概要は準備中です。原文の説明を表示しています。

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

日本語の概要は準備中です。原文の説明を表示しています。

Practical security review and hardening guidance for application code in Python, JavaScript/TypeScript, and Go. Use this skill whenever the user asks for a security review or audit, wants to harden authentication (password hashing, sessions, JWT, OAuth2/OIDC, MFA), fix OWASP Top 10 issues (injection, XSS, IDOR, CSRF, SSRF, deserialization), threat-model with STRIDE, clean up secrets and .env handling, or set up dependency scanning (pip-audit, npm audit, osv-scanner, gitleaks, SBOM). Also trigger for "make this secure", "is this safe to deploy", bcrypt/argon2id, rate limiting logins, RBAC/ABAC, CSP and security headers, cookie flags, and secure-by-default coding help.

日本語の概要は準備中です。原文の説明を表示しています。