精选的24种SKILL.md安全工作能力—— 攻势安全、SOC与检测工程、云与Kubernetes等领域 加固、DFIR、威胁情报、安全编程、逆向工程， 快速改进和多语言交流。

同样的技能适用于三个代理：Gemini CLI、Claude Code，以及 OpenAI Codex。有一个规范的skills/树;每个平台的描述为 通过一个薄的适配器。

存储库网址：

包含了什么

本仓库包含24项技能，按以下分组。

网络安全自动化

• gemini-tool-orchestrator：将自然语言意图翻译为安全， nmap、nuclei、ffuf、semgrep、trivy 和 friends 的管线。
• ai-redteam：评估快速注入、越狱、工具滥用、代理 劫持，以及你拥有的大型语言模型和代理系统被RAG毒害。
• threat-intel-fusion：收集、归一化、丰富、去重和优先级 IOC和actor配置文件集成STIX、Sigma、YARA和黑名单。
• cloud-security-automation：AWS、Azure、GCP 态势、IaC 扫描，以及 漂移修复的工作流程以代码形式发布，而非控制台点击。
• detection-engineering：作者及曲调：Sigma、YARA、Suricata、KQL、SPL，

Trident SecOps Skills

A curated collection of 24 SKILL.md capabilities for security work — offensive security, SOC and detection engineering, cloud and Kubernetes hardening, DFIR, threat intel, secure programming, reverse engineering, prompt improvement, and multilingual communication.

The same skills run on three agents: Gemini CLI, Claude Code, and OpenAI Codex. There is one canonical skills/ tree; each platform reads it through a thin adapter.

Repository URL:

https://github.com/Garyson26/Trident-SecOps-Skills

What is included

This repository contains 24 skills, grouped below.

Cyber security automation

• gemini-tool-orchestrator: Translate natural-language intent into safe, scoped pipelines of nmap, nuclei, ffuf, semgrep, trivy, and friends.
• ai-redteam: Evaluate prompt injection, jailbreak, tool abuse, agent hijack, and RAG poisoning on LLM and agent systems you own.
• threat-intel-fusion: Collect, normalize, enrich, dedupe, and prioritize IOCs and actor profiles into STIX, Sigma, YARA, and blocklists.
• cloud-security-automation: AWS, Azure, GCP posture, IaC scanning, and drift-and-fix workflows shipped as code, not console clicks.
• detection-engineering: Author and tune Sigma, YARA, Suricata, KQL, SPL, and EQL detections with ATT&CK coverage and tests.
• kubernetes-security: Cluster hardening, admission control with Gatekeeper/Kyverno, runtime defense, and signed-image supply chain.
• purple-team-automation: Link Atomic Red Team, Caldera, and Stratus emulation to detection validation and coverage scoring.
• osint-recon-automation: Passive recon, asset graphing, and exposure monitoring for authorized scopes only.
• api-security-automation: REST, GraphQL, and gRPC assessment covering OWASP API Top 10, JWT abuse, BOLA, mass assignment, and replay.
• forensics-triage: DFIR across disk, memory, network, cloud, and identity with defensible timelines and chain of custody.
• bug-bounty-workflow: Scope-aware recon, dedupe, and high-signal reporting for HackerOne, Bugcrowd, Intigriti, and YesWeHack.
• smart-contract-audit: Solidity, Vyper, and Move audit with Slither, Foundry, Echidna, invariants, MEV, and bridge risk.

Core security

• offensive-security: Plan authorized offensive security assessments.
• exploit-development: Analyze lab vulnerabilities and safe proof of concept workflows.
• malware-reverse-engineering: Triage suspicious artifacts and produce defensive findings.
• devsecops: Harden CI/CD, infrastructure, containers, and releases.
• soc-operations: Triage alerts, hunt threats, and produce incident notes.
• cybersecurity-partner: Act as a practical security reviewer and advisor.

Engineering and language

• go-programming: Build, debug, test, and review idiomatic Go systems.
• python-programming: Build, test, type, package, and maintain Python code.