Кураторская коллекция из 24 SKILL.md возможностей для работы в области безопасности — Наступательная безопасность, SOC и разработка обнаружения, облачные и Kubernetes закаливание, DFIR, информация об угрозах, безопасное программирование, обратная инженерия, Быстрое улучшение и многоязычное общение.

Те же навыки работают на трех агентах: Gemini CLI, Claude Code, и Кодекс OpenAI Есть одно каноническое дерево skills/; каждая платформа читает Через тонкий адаптер.

Репозиторий URL:

Что включено

Этот репозиторий содержит 24 навыка, сгруппированных ниже.

###Кибербезопасность

• [[Т2]]: переводить намерение естественного языка в безопасное сферические трубопроводы nmap, ядер, ffuf, semgrep, trivy и друзей.
• [[Т3]]: Оценка быстрой инъекции, джейлбрейка, злоупотребления инструментами, агента Угон и отравление RAG на LLM и принадлежащих вам системах агентов.
• [[Т4]]: Собирайте, нормализуйте, обогащайте, выводите и расставляете приоритеты МОК и актерские профили в STIX, Sigma, YARA и блок-листы. cloud-security-automation: AWS, Azure, GCP, сканирование IaC и рабочие процессы, отправляемые в виде кода, а не консольных кликов.
• [[Т6]]: Автор и мелодия Sigma, YARA, Suricata, KQL, SPL,

Trident SecOps Skills

A curated collection of 24 SKILL.md capabilities for security work — offensive security, SOC and detection engineering, cloud and Kubernetes hardening, DFIR, threat intel, secure programming, reverse engineering, prompt improvement, and multilingual communication.

The same skills run on three agents: Gemini CLI, Claude Code, and OpenAI Codex. There is one canonical skills/ tree; each platform reads it through a thin adapter.

Repository URL:

https://github.com/Garyson26/Trident-SecOps-Skills

What is included

This repository contains 24 skills, grouped below.

Cyber security automation

• gemini-tool-orchestrator: Translate natural-language intent into safe, scoped pipelines of nmap, nuclei, ffuf, semgrep, trivy, and friends.
• ai-redteam: Evaluate prompt injection, jailbreak, tool abuse, agent hijack, and RAG poisoning on LLM and agent systems you own.
• threat-intel-fusion: Collect, normalize, enrich, dedupe, and prioritize IOCs and actor profiles into STIX, Sigma, YARA, and blocklists.
• cloud-security-automation: AWS, Azure, GCP posture, IaC scanning, and drift-and-fix workflows shipped as code, not console clicks.
• detection-engineering: Author and tune Sigma, YARA, Suricata, KQL, SPL, and EQL detections with ATT&CK coverage and tests.
• kubernetes-security: Cluster hardening, admission control with Gatekeeper/Kyverno, runtime defense, and signed-image supply chain.
• purple-team-automation: Link Atomic Red Team, Caldera, and Stratus emulation to detection validation and coverage scoring.
• osint-recon-automation: Passive recon, asset graphing, and exposure monitoring for authorized scopes only.
• api-security-automation: REST, GraphQL, and gRPC assessment covering OWASP API Top 10, JWT abuse, BOLA, mass assignment, and replay.
• forensics-triage: DFIR across disk, memory, network, cloud, and identity with defensible timelines and chain of custody.
• bug-bounty-workflow: Scope-aware recon, dedupe, and high-signal reporting for HackerOne, Bugcrowd, Intigriti, and YesWeHack.
• smart-contract-audit: Solidity, Vyper, and Move audit with Slither, Foundry, Echidna, invariants, MEV, and bridge risk.

Core security

• offensive-security: Plan authorized offensive security assessments.
• exploit-development: Analyze lab vulnerabilities and safe proof of concept workflows.
• malware-reverse-engineering: Triage suspicious artifacts and produce defensive findings.
• devsecops: Harden CI/CD, infrastructure, containers, and releases.
• soc-operations: Triage alerts, hunt threats, and produce incident notes.
• cybersecurity-partner: Act as a practical security reviewer and advisor.

Engineering and language

• go-programming: Build, debug, test, and review idiomatic Go systems.
• python-programming: Build, test, type, package, and maintain Python code.