使用方法
- 复制安装命令，在自己的智能体环境安装前先检查源码包。
- 从原始文档核对所需工具、凭据和支持的宿主。
- 说明输入材料与期望交付物，并对照来源检查输出。
npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill security-automation开始前需了解
- 安装不包含模型订阅、API 额度或访问文件的权限。
- 仓库星数和安装量反映活跃情况，不等于独立质量或安全测试。
仓库原始内容
按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。
Security Automation
Automate security operations for scale and efficiency.
Security Pipeline
yaml
# .github/workflows/security.yml
name: Security Pipeline
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Secret Scanning
uses: trufflesecurity/trufflehog@main
- name: SAST
uses: returntocorp/semgrep-action@v1
- name: Dependency Scan
run: npm audit --audit-level=high
- name: Container Scan
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
- name: Compliance Check
run: |
checkov -d . --framework terraformAutomated Remediation
python
# Auto-remediation script
def remediate_public_s3(bucket_name):
"""Remove public access from S3 bucket."""
s3 = boto3.client('s3')
s3.put_public_access_block(
Bucket=bucket_name,
PublicAccessBlockConfiguration={
'BlockPublicAcls': True,
'IgnorePublicAcls': True,
'BlockPublicPolicy': True,
'RestrictPublicBuckets': True
}
)SOAR Integration
yaml
playbook:
name: Suspicious Login Response
trigger: alert.type == "suspicious_login"
actions:
- enrich_ip:
source: threat_intel
- if_condition: ip.is_malicious
then:
- block_ip:
firewall: cloudflare
- disable_user:
duration: 1h
- notify:
channel: security
- create_ticket:
priority: highCompliance as Code
python
# Checkov custom check
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
class S3Encryption(BaseResourceCheck):
def __init__(self):
name = "Ensure S3 bucket has encryption enabled"
id = "CUSTOM_S3_1"
supported_resources = ['aws_s3_bucket']
super().__init__(name=name, id=id, ...)
def scan_resource_conf(self, conf):
if 'server_side_encryption_configuration' in conf:
return CheckResult.PASSED
return CheckResult.FAILEDBest Practices
- Start with high-impact automations
- Test in staging first
- Include manual review gates
- Monitor automation effectiveness
- Regular rule updates
Related Skills
- github-actions - CI/CD automation
- policy-as-code - Policy enforcement
