mcpbeat Sign in

Securing Cloud And Supply Chain Agent Skill

云原生与软件供应链安全防御。容器/K8s 加固、Service Mesh、CI/CD 安全、SLSA/SBOM/Sigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI/CD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code.

9k tokens
context cost
the whole folder, loaded on every use
4
files
instructions only
0
copies elsewhere
how many repositories repackaged it
238
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository
npx skills add https://github.com/telagod/code-abyss --skill securing-cloud-and-supply-chain

The instruction itself

1 sections, as written by the author

云原生与供应链安全

> 判断先于执行:决定「是否做 / 选什么 / 如何取舍」(栈、方案、架构、权衡)前,先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment,本秘典管 execution;冲突时以内核判断为准。

> 默认怀疑一切外来字节:镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签,能锁就锁,能最小就最小。

路由

| 意图 | 秘典 | 核心 |

|------|------|------|

| 容器/K8s 加固 | container-and-k8s | 容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission |

| 软件供应链 | supply-chain | SLSA、Sigstore、SBOM、CI/CD OIDC、attestation、VEX |

| 云 IAM 与 Secrets | cloud-iam-and-secrets | IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity |

何时使用

| 场景 | 用本 skill | 不用 |

|------|-----------|------|

| K8s manifest / Helm chart 安全审查 | ✅ | — |

| CI/CD pipeline (GitHub Actions / GitLab CI) 加固 | ✅ | — |

| Terraform / Pulumi / CloudFormation 评审 | ✅ | — |

| AWS/GCP/Azure IAM policy 审查 | ✅ | — |

| 镜像扫描与签名链路设计 | ✅ | — |

| 应用层 Web/API 漏洞 (SQLi/XSS/SSRF) | — | 用 securing-systems |

| 红队 C2/横移/免杀 | — | 用 securing-systems/red-team |

| 集群部署/Helm 模板编写 (非安全视角) | — | 用 provisioning-infrastructure |

| 一般架构设计与权衡 | — | 用 designing-architectures |

通用铁律

  • Least privilege by default — 任何 Role/IAM/SA/Token 起手就是空集合,按需求逐项添加,禁通配 * 与 Action: *。
  • Immutable infrastructure — 镜像用 digest 不用 tag,IaC state 不允许人工 drift,部署后只重建不改造。
  • Sign everything, verify everywhere — 镜像、artifact、commit、SBOM 必须签名;准入控制必须 verify,否则等于没签。
  • Secrets never in plaintext — 不进 git、不进 env file、不进 ConfigMap、不进 Terraform state;Vault/Secret Manager + 短期凭证。
  • Defense in depth — 镜像扫描 + admission policy + runtime detection + network policy + audit log,单层失守不致命。
  • OIDC over long-lived tokens — CI 到云、Pod 到云、Service 到 Service 一律 federated identity,废弃 access key。
  • Provenance is non-negotiable — 不知道来源的二进制不上生产;SLSA L3+ 是目标线。
  • Zero trust east-west — 内网即外网,mTLS 默认开启,NetworkPolicy 默认拒绝。

执行链

审查:清单 → 威胁建模 → 配置对照 → 风险分级 → 修复 PR → 验证回归
应急:定位失陷面 → 撤凭证 → 隔离工作负载 → 取证镜像 → 根因 → 加固准入

优先级红线

| 红线 | 立即处置 |

|------|---------|

| Secrets 已进 git history | 撤销凭证 → rewrite history → 通报 |

| 公网暴露 K8s API server | 关闭 → IP 白名单 → 审计访问日志 |

| privileged: true Pod 跑业务 | 拒绝准入 → 重构镜像 → PSS restricted |

| CI 用 long-lived AWS key | 切 OIDC → 撤销 key → 审计旧密钥使用 |

| Action: * IAM policy | 收敛权限 → CloudTrail 审计实际使用 |

与其他 skill 联动

  • 应用层漏洞(SQLi、XSS、反序列化、代码污点)→ securing-systems/code-audit、pentest
  • 红队对抗与 C2 → securing-systems/red-team
  • SOC 检测/Sigma/IR → securing-systems/blue-team
  • 集群与 Helm/GitOps 部署(非安全视角)→ provisioning-infrastructure
  • API/认证架构设计 → designing-architectures/security-arch
  • DevOps 流水线工程实践 → automating-devops

输出约束

  • 反例使用 RFC 5737 (192.0.2.0/24、198.51.100.0/24) 或 example.com
  • 凭证一律 <REDACTED> / AKIA<EXAMPLE> 占位
  • 发现真实泄漏只报位置和处置流程,不复述完整值
  • 修复方案必须给出最小权限策略片段,不抛"参考最佳实践"了事

Other skills for the same job

different authors, same section of the catalogue
Azure Kubernetes Automatic Readiness
by microsoft
vendor ×3

Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic.

13k tokens
Capacity
by microsoft
vendor ×3

Discovers available Azure OpenAI model capacity across regions and projects. Analyzes quota limits, compares availability, and recommends optimal deployment locations based on capacity requirements. USE FOR: find capacity, check quota, where can I deploy, capacity discovery, best region for capacity, multi-project capacity search, quota analysis, model availability, region comparison, check TPM availability. DO NOT USE FOR: actual deployment (hand off to preset or customize after discovery), quota increase requests (direct user to Azure Portal), listing existing deployments.

6k tokens scripts
Customize
by microsoft
vendor ×3

Interactive guided deployment flow for Azure OpenAI models with full customization control. Step-by-step selection of model version, SKU (GlobalStandard/Standard/ProvisionedManaged), capacity, RAI policy (content filter), and advanced options (dynamic quota, priority processing, spillover). USE FOR: custom deployment, customize model deployment, choose version, select SKU, set capacity, configure content filter, RAI policy, deployment options, detailed deployment, advanced deployment, PTU deployment, provisioned throughput. DO NOT USE FOR: quick deployment to optimal region (use preset).

8k tokens
Deploy Model
by microsoft
vendor ×3

Unified Azure OpenAI model deployment skill with intelligent intent-based routing. Handles quick preset deployments, fully customized deployments (version/SKU/capacity/RAI policy), and capacity discovery across regions and projects. USE FOR: deploy model, deploy gpt, create deployment, model deployment, deploy openai model, set up model, provision model, find capacity, check model availability, where can I deploy, best region for model, capacity analysis. DO NOT USE FOR: listing existing deployments (use foundry_models_deployments_list MCP tool), deleting deployments, agent creation (use agent/create), project creation (use project/create).

26k tokens scripts
Preset
by microsoft
vendor ×3

Intelligently deploys Azure OpenAI models to optimal regions by analyzing capacity across all available regions. Automatically checks current region first and shows alternatives if needed. USE FOR: quick deployment, optimal region, best region, automatic region selection, fast setup, multi-region capacity check, high availability deployment, deploy to best location. DO NOT USE FOR: custom SKU selection (use customize), specific version selection (use customize), custom capacity configuration (use customize), PTU deployments (use customize).

9k tokens
Lamindb
by christophacham
×3

This skill should be used when working with LaminDB, an open-source data framework for biology that makes data queryable, traceable, reproducible, and FAIR. Use when managing biological datasets (scRNA-seq, spatial, flow cytometry, etc.), tracking computational workflows, curating and validating data with biological ontologies, building data lakehouses, or ensuring data lineage and reproducibility in biological research. Covers data management, annotation, ontologies (genes, cell types, diseases, tissues), schema validation, integrations with workflow managers (Nextflow, Snakemake) and MLOps platforms (W&B, MLflow), and deployment strategies.

22k tokens
Latchbio Integration
by christophacham
×3

Latch platform for bioinformatics workflows. Build pipelines with Latch SDK, @workflow/@task decorators, deploy serverless workflows, LatchFile/LatchDir, Nextflow/Snakemake integration.

12k tokens
Modal
by christophacham
×3

Run Python code in the cloud with serverless containers, GPUs, and autoscaling. Use when deploying ML models, running batch processing jobs, scheduling compute-intensive tasks, or serving APIs that require GPU acceleration or dynamic scaling.

17k tokens

How to use it

Copy the folder

Take telagod/securing-cloud-and-supply-chain from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.