24 [SKILL.mdのキュレーションコレクションは、セキュリティ作業のための機能です。 攻撃的なセキュリティ、SOCおよび検出工学、雲およびKubernetes 硬化、DFIR、脅威インテル、安全なプログラミング、リバースエンジニアリング、 迅速な改善と多言語コミュニケーション

3つのエージェントで同じスキルを実行します。Gemini CLI、Claude Code、および OpenAI Codex. 1つのcanonical skills/ツリーがあります。各プラットフォームの読み込み 薄いアダプターを通して。

リポジトリ URL:

含まれているもの

このリポジトリには、以下の24のスキルが含まれています。

##サイバーセキュリティの自動化

• [gemini-tool-orchestrator: 自然言語を安全に翻訳し、 nmap, 核, ffuf, semgrep, トリビー, 友人のスコープ化されたパイプライン。

あなたが所有するLMおよび代理店システム上のハイジャックおよびRAG中毒。

IOCsと俳優はSTIX、シグマ、YARA、ブロックリストにプロファイルします。

• [cloud-security-automation:AWS、Azure、GCP 姿勢、IaC スキャン、および コンソールのクリックではなく、コードとして出荷されるドリフトとフィックスワークフロー。

Trident SecOps Skills

A curated collection of 24 SKILL.md capabilities for security work — offensive security, SOC and detection engineering, cloud and Kubernetes hardening, DFIR, threat intel, secure programming, reverse engineering, prompt improvement, and multilingual communication.

The same skills run on three agents: Gemini CLI, Claude Code, and OpenAI Codex. There is one canonical skills/ tree; each platform reads it through a thin adapter.

Repository URL:

https://github.com/Garyson26/Trident-SecOps-Skills

What is included

This repository contains 24 skills, grouped below.

Cyber security automation

• gemini-tool-orchestrator: Translate natural-language intent into safe, scoped pipelines of nmap, nuclei, ffuf, semgrep, trivy, and friends.
• ai-redteam: Evaluate prompt injection, jailbreak, tool abuse, agent hijack, and RAG poisoning on LLM and agent systems you own.
• threat-intel-fusion: Collect, normalize, enrich, dedupe, and prioritize IOCs and actor profiles into STIX, Sigma, YARA, and blocklists.
• cloud-security-automation: AWS, Azure, GCP posture, IaC scanning, and drift-and-fix workflows shipped as code, not console clicks.
• detection-engineering: Author and tune Sigma, YARA, Suricata, KQL, SPL, and EQL detections with ATT&CK coverage and tests.
• kubernetes-security: Cluster hardening, admission control with Gatekeeper/Kyverno, runtime defense, and signed-image supply chain.
• purple-team-automation: Link Atomic Red Team, Caldera, and Stratus emulation to detection validation and coverage scoring.
• osint-recon-automation: Passive recon, asset graphing, and exposure monitoring for authorized scopes only.
• api-security-automation: REST, GraphQL, and gRPC assessment covering OWASP API Top 10, JWT abuse, BOLA, mass assignment, and replay.
• forensics-triage: DFIR across disk, memory, network, cloud, and identity with defensible timelines and chain of custody.
• bug-bounty-workflow: Scope-aware recon, dedupe, and high-signal reporting for HackerOne, Bugcrowd, Intigriti, and YesWeHack.
• smart-contract-audit: Solidity, Vyper, and Move audit with Slither, Foundry, Echidna, invariants, MEV, and bridge risk.

Core security

• offensive-security: Plan authorized offensive security assessments.
• exploit-development: Analyze lab vulnerabilities and safe proof of concept workflows.
• malware-reverse-engineering: Triage suspicious artifacts and produce defensive findings.
• devsecops: Harden CI/CD, infrastructure, containers, and releases.
• soc-operations: Triage alerts, hunt threats, and produce incident notes.
• cybersecurity-partner: Act as a practical security reviewer and advisor.

Engineering and language

• go-programming: Build, debug, test, and review idiomatic Go systems.
• python-programming: Build, test, type, package, and maintain Python code.