skills.rest
modu-ai
modu-aiOFFICIAL
Explore all skills by this author →
Website𝕏@MODU_AIGitHub

moai-ref-secops

Provides defensive security reference for CI/CD pipelines, containers, Kubernetes, and production APIs.

1.2k|222|Updated Sep 16, 2025
Search Tags:#owasp#rbac#kubernetes#container security#devsecops#api security#CI/CD hardening
One-click install
npx skills add https://github.com/modu-ai/moai-adk --skill moai-ref-secops
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: moai-ref-secops
Source: https://github.com/modu-ai/moai-adk/tree/main/internal/template/templates/.claude/skills/moai-ref-secops
Command: npx skills add https://github.com/modu-ai/moai-adk --skill moai-ref-secops

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Teams shipping software often lack a consolidated, defense-focused reference for the operational security layer: hardening CI/CD pipelines, scanning infrastructure-as-code, locking down containers and Kubernetes RBAC, and enforcing runtime API defenses like BOLA detection and rate limiting. This Skill supplies that reference so agents and engineers apply production-grade defensive patterns instead of ad-hoc guesses.

Core Features & Use Cases

  • DevSecOps Hardening: Covers pipeline pinning, least-privilege tokens, secret scanning (pre-commit and CI), IaC misconfiguration detection before apply, and SAST/DAST integration.
  • Container & Kubernetes Defense: Details image scanning and admission control, least-privilege RBAC, ServiceAccount token hygiene, container-escape hardening (non-root, read-only root, seccomp, dropped capabilities), and runtime threat detection.
  • API Operational Defense: Maps the OWASP API Top 10 to operational controls including server-side BOLA checks, rate limiting, WAF tuning, and GraphQL/REST depth and complexity limits.
  • Use Case: When reviewing a Kubernetes deployment, load this Skill to verify pods run non-root with read-only root filesystems, no ServiceAccount is bound to cluster-admin, and runtime detection alerts on escape attempts.

Quick Start

Ask the agent to review your CI/CD pipeline, Kubernetes manifests, or API gateway configuration against the defensive hardening checklists in this security reference.

Frequently Asked Questions about moai-ref-secops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden a CI/CD pipeline against supply chain attacks?▼

Pin the pipeline definition and third-party actions by version or digest, use least-privilege and short-lived federated tokens, run jobs on ephemeral isolated runners, and sign produced artifacts. Gate deploys behind protected branches and audit-log every run.

How to prevent container escape in Kubernetes?▼

Run containers as non-root with a read-only root filesystem, drop all Linux capabilities, apply a seccomp profile, disable privileged mode and privilege escalation, and avoid host path or runtime socket mounts. Enforce this baseline with PodSecurity admission or a policy engine.

What is the difference between this Skill and moai-ref-owasp-checklist?▼

This Skill covers the operational runtime layer: detecting BOLA in production traffic, enforcing rate limits, and tuning WAF rules. moai-ref-owasp-checklist covers dev-time secure coding like input validation, parameterized queries, and authentication design.

Does this Skill cover offensive security or penetration testing techniques?▼

No. It is strictly defensive, describing misconfigurations, detection methods, and hardening controls. It explicitly excludes exploit execution, container-escape attack steps, privilege-escalation procedures, and attack tooling.

How do I defend a GraphQL API against resource exhaustion?▼

Enforce query depth limits and complexity cost analysis on the live endpoint, use a persisted-query allowlist in production, disable introspection, and cap list field page sizes. Combine these with per-query timeouts and rate limits.

When should IaC scanning run in the deployment workflow?▼

IaC scanning must run as a CI gate before the apply stage, failing closed on high-severity findings like public buckets or wildcard IAM policies. Scanning after apply is detection only, not prevention.

Related Skills

Explore More Software Engineering Skills→
joonwon-spacejoonwon-space

security-review

Apply a security checklist to identify vulnerabilities in APIs and features.

Community
Basic
bigeasyfreemanbigeasyfreeman
2

OWASP Kubernetes / Infrastructure Security Skill

Audit Kubernetes and Docker deployments against the OWASP Kubernetes Top 10.

Community
Advanced
Muath2000Muath2000

supply-chain-analyst

Analyze software supply chain risks and generate SBOMs.

Community
Advanced
claudcherejiclaudchereji

security-engineer

Automate vulnerability scanning and compliance reporting for cloud infrastructure.

Community
Advanced