ReddRadar
Agent skill
skill-name
[REQUIRED] Comprehensive description of what this skill does and when to use it. Include: (1) Primary functionality, (2) Specific use cases, (3) Security operations context. Must include specific "Use when:" clause for skill discovery. Example: "SAST vulnerability analysis and remediation guidance using Semgrep and industry security standards. Use when: (1) Analyzing static code for security vulnerabilities, (2) Prioritizing security findings by severity, (3) Providing secure coding remediation, (4) Integrating security checks into CI/CD pipelines." Maximum 1024 characters.
Install this agent skill to your Project
npx add-skill https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/_template
SKILL.md
Skill Name
Overview
Brief overview of what this skill provides and its security operations context.
Quick Start
Provide the minimal example to get started immediately:
# Example command or workflow
tool-name --option value
Core Workflow
Sequential Workflow
For straightforward step-by-step operations:
- First action with specific command or operation
- Second action with expected output or validation
- Third action with decision points if needed
Workflow Checklist (for complex operations)
For complex multi-step operations, use a checkable workflow:
Progress: [ ] 1. Initial setup and configuration [ ] 2. Run primary security scan or analysis [ ] 3. Review findings and classify by severity [ ] 4. Apply remediation patterns [ ] 5. Validate fixes with re-scan [ ] 6. Document findings and generate report
Work through each step systematically. Check off completed items.
For more workflow patterns, see references/WORKFLOW_CHECKLIST.md
Feedback Loop Pattern (for validation)
When validation and iteration are needed:
- Generate initial output (configuration, code, etc.)
- Run validation:
./scripts/validator_example.py output.yaml - Review validation errors and warnings
- Fix identified issues
- Repeat steps 2-4 until validation passes
- Apply the validated output
Note: Move detailed validation criteria to references/ if complex.
Security Considerations
- Sensitive Data Handling: Guidance on handling secrets, credentials, PII
- Access Control: Required permissions and authorization contexts
- Audit Logging: What should be logged for security auditing
- Compliance: Relevant compliance requirements (SOC2, GDPR, etc.)
Bundled Resources
Scripts (scripts/)
Executable scripts for deterministic operations. Use scripts for low-freedom operations requiring consistency.
example_script.py- Python script template with argparse, error handling, and JSON outputexample_script.sh- Bash script template with argument parsing and colored outputvalidator_example.py- Validation script demonstrating feedback loop pattern
When to use scripts:
- Deterministic operations that must be consistent
- Complex parsing or data transformation
- Validation and quality checks
References (references/)
On-demand documentation loaded when needed. Keep SKILL.md concise by moving detailed content here.
EXAMPLE.md- Template for reference documentation with security standards sectionsWORKFLOW_CHECKLIST.md- Multiple workflow pattern examples (sequential, conditional, iterative, feedback loop)
When to use references:
- Detailed framework mappings (OWASP, CWE, MITRE ATT&CK)
- Advanced configuration options
- Language-specific patterns
- Content exceeding 100 lines
Assets (assets/)
Templates and configuration files used in output (not loaded into context). These are referenced but not read until needed.
ci-config-template.yml- Security-enhanced CI/CD pipeline with SAST, dependency scanning, secrets detectionrule-template.yaml- Security rule template with OWASP/CWE mappings and remediation guidance
When to use assets:
- Configuration templates
- Policy templates
- Boilerplate secure code
- CI/CD pipeline examples
Common Patterns
Pattern 1: [Pattern Name]
Description and example of common usage pattern.
Pattern 2: [Pattern Name]
Additional patterns as needed.
Integration Points
- CI/CD: How this integrates with build pipelines
- Security Tools: Compatible security scanning/monitoring tools
- SDLC: Where this fits in the secure development lifecycle
Troubleshooting
Issue: [Common Problem]
Solution: Steps to resolve.
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
AgentSecOps/SecOpsAgentKit
policy-opa
Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA). Use when: (1) Enforcing security and compliance policies across infrastructure and applications, (2) Validating Kubernetes admission control policies, (3) Implementing policy-as-code for compliance frameworks (SOC2, PCI-DSS, GDPR, HIPAA), (4) Testing and evaluating OPA Rego policies, (5) Integrating policy checks into CI/CD pipelines, (6) Auditing configuration drift against organizational security standards, (7) Implementing least-privilege access controls.
AgentSecOps/SecOpsAgentKit
ir-velociraptor
Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale. Use when: (1) Conducting forensic investigations across multiple endpoints, (2) Hunting for indicators of compromise or suspicious activities, (3) Collecting endpoint telemetry and artifacts for incident analysis, (4) Performing live response and evidence preservation, (5) Monitoring endpoints for security events, (6) Creating custom forensic artifacts for specific threat scenarios.
AgentSecOps/SecOpsAgentKit
forensics-osquery
SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases. Enables rapid evidence collection, threat hunting, and incident response across Linux, macOS, and Windows endpoints. Use when: (1) Investigating security incidents and collecting forensic artifacts, (2) Threat hunting across endpoints for suspicious activity, (3) Analyzing running processes, network connections, and persistence mechanisms, (4) Collecting system state during incident response, (5) Querying file hashes, user activity, and system configuration for compromise indicators, (6) Building detection queries for continuous monitoring with osqueryd.
AgentSecOps/SecOpsAgentKit
detection-sigma
Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM platforms. Use when: (1) Creating detection rules for security monitoring, (2) Converting rules between SIEM platforms (Splunk, Elastic, QRadar, Sentinel), (3) Threat hunting with standardized detection patterns, (4) Building detection-as-code pipelines, (5) Mapping detections to MITRE ATT&CK tactics, (6) Implementing compliance-based monitoring rules.
AgentSecOps/SecOpsAgentKit
pytm
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification, (3) Integrating threat modeling into CI/CD pipelines and shift-left security practices, (4) Analyzing system architecture for security threats across trust boundaries, (5) Producing threat reports with STRIDE categories and mitigation recommendations, (6) Maintaining threat models as code for version control and automation.
AgentSecOps/SecOpsAgentKit
container-grype
Container vulnerability scanning and dependency risk assessment using Grype with CVSS severity ratings, EPSS exploit probability, and CISA KEV indicators. Use when: (1) Scanning container images and filesystems for known vulnerabilities, (2) Integrating vulnerability scanning into CI/CD pipelines with severity thresholds, (3) Analyzing SBOMs (Syft, SPDX, CycloneDX) for security risks, (4) Prioritizing remediation based on threat metrics (CVSS, EPSS, KEV), (5) Generating vulnerability reports in multiple formats (JSON, SARIF, CycloneDX) for security toolchain integration.
Didn't find tool you were looking for?