Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →云原生与软件供应链安全防御。容器/K8s 加固、Service Mesh、CI/CD 安全、SLSA/SBOM/Sigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI/CD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code.
.claude/skills/telagod-securing-cloud-and-supply-chain/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 261% | 0% |
| case-02 | ✗→✓ | ▲ Improved | 172% | 0% |
| case-22 | ✓→✗ | ▼ Worse | 60% | 0% |
| case-06 | ✓→✓ | ＝ Same ✓ | 57% | 0% |
| case-07 | ✓→✓ | ＝ Same ✓ | 92% | 0% |
> 判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。
> 默认怀疑一切外来字节：镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签，能锁就锁，能最小就最小。
| 意图 | 秘典 | 核心 | |------|------|------| | 容器/K8s 加固 | container-and-k8s | 容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission | | 软件供应链 | supply-chain | SLSA、Sigstore、SBOM、CI/CD OIDC、attestation、VEX | | 云 IAM 与 Secrets | cloud-iam-and-secrets | IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity |
| 场景 | 用本 skill | 不用 | |------|-----------|------| | K8s manifest / Helm chart 安全审查 | ✅ | — | | CI/CD pipeline (GitHub Actions / GitLab CI) 加固 | ✅ | — | | Terraform / Pulumi / CloudFormation 评审 | ✅ | — | | AWS/GCP/Azure IAM policy 审查 | ✅ | — | | 镜像扫描与签名链路设计 | ✅ | — | | 应用层 Web/API 漏洞 (SQLi/XSS/SSRF) | — | 用 securing-systems | | 红队 C2/横移/免杀 | — | 用 securing-systems/red-team | | 集群部署/Helm 模板编写 (非安全视角) | — | 用 provisioning-infrastructure | | 一般架构设计与权衡 | — | 用 designing-architectures |
* 与 Action: *。审查：清单 → 威胁建模 → 配置对照 → 风险分级 → 修复 PR → 验证回归
应急：定位失陷面 → 撤凭证 → 隔离工作负载 → 取证镜像 → 根因 → 加固准入| 红线 | 立即处置 | |------|---------| | Secrets 已进 git history | 撤销凭证 → rewrite history → 通报 | | 公网暴露 K8s API server | 关闭 → IP 白名单 → 审计访问日志 | | privileged: true Pod 跑业务 | 拒绝准入 → 重构镜像 → PSS restricted | | CI 用 long-lived AWS key | 切 OIDC → 撤销 key → 审计旧密钥使用 | | Action: * IAM policy | 收敛权限 → CloudTrail 审计实际使用 |
securing-systems/code-audit、pentestsecuring-systems/red-teamsecuring-systems/blue-teamprovisioning-infrastructuredesigning-architectures/security-archautomating-devops192.0.2.0/24、198.51.100.0/24) 或 example.com<REDACTED> / AKIA<EXAMPLE> 占位| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-06 | pass→pass | 14,619 | 14,975 | +2% | 1 | 1 | 0% | 2,418 | 3,793 | +57% | 0 | 0 | — |
case-07 | pass→pass | 9,584 | 11,750 | +23% | 1 | 1 | 0% | 1,711 | 3,285 | +92% | 0 | 0 | — |
case-01 | fail→pass | 9,906 | 22,540 | +128% | 1 | 1 | 0% | 1,449 | 5,228 | +261% | 0 | 0 | — |
case-02 | fail→pass | 9,157 | 11,411 | +25% | 1 | 1 | 0% | 1,158 | 3,147 | +172% | 0 | 0 | — |
case-03 | fail→fail | 7,030 | 7,883 | +12% | 1 | 1 | 0% | 423 | 1,927 | +356% | 0 | 0 | — |
case-04 | pass→pass | 26,580 | 31,961 | +20% | 1 | 1 | 0% | 4,888 | 7,384 | +51% | 0 | 0 | — |
case-05 | pass→pass | 11,226 | 12,920 | +15% | 1 | 1 | 0% | 1,963 | 3,597 | +83% | 0 | 0 | — |
case-08 | pass→pass | 11,137 | 15,876 | +43% | 1 | 1 | 0% | 1,695 | 3,750 | +121% | 0 | 0 | — |
case-09 | pass→pass | 17,266 | 17,616 | +2% | 1 | 1 | 0% | 2,658 | 3,964 | +49% | 0 | 0 | — |
case-10 | pass→pass | 13,035 | 14,910 | +14% | 1 | 1 | 0% | 2,211 | 3,413 | +54% | 0 | 0 | — |
case-11 | pass→pass | 16,798 | 21,844 | +30% | 1 | 1 | 0% | 2,888 | 5,115 | +77% | 0 | 0 | — |
case-12 | pass→pass | 13,756 | 22,877 | +66% | 1 | 1 | 0% | 2,232 | 4,944 | +122% | 0 | 0 | — |
case-13 | pass→pass | 17,665 | 18,404 | +4% | 1 | 1 | 0% | 2,971 | 4,550 | +53% | 0 | 0 | — |
case-14 | pass→pass | 14,386 | 17,313 | +20% | 1 | 1 | 0% | 2,506 | 4,538 | +81% | 0 | 0 | — |
case-15 | pass→pass | 12,292 | 9,907 | -19% | 1 | 1 | 0% | 2,024 | 2,790 | +38% | 0 | 0 | — |
case-16 | pass→pass | 16,066 | 12,640 | -21% | 1 | 1 | 0% | 2,585 | 3,300 | +28% | 0 | 0 | — |
case-17 | pass→pass | 11,306 | 15,301 | +35% | 1 | 1 | 0% | 1,942 | 3,684 | +90% | 0 | 0 | — |
case-18 | pass→pass | 12,789 | 13,447 | +5% | 1 | 1 | 0% | 2,132 | 3,513 | +65% | 0 | 0 | — |
case-19 | pass→pass | 14,420 | 12,892 | -11% | 1 | 1 | 0% | 2,243 | 3,197 | +43% | 0 | 0 | — |
case-20 | pass→pass | 4,622 | 8,104 | +75% | 1 | 1 | 0% | 982 | 2,853 | +191% | 0 | 0 | — |
case-21 | pass→pass | 15,126 | 21,599 | +43% | 1 | 1 | 0% | 2,464 | 3,455 | +40% | 0 | 0 | — |
case-22 | pass→fail | 15,221 | 17,929 | +18% | 1 | 1 | 0% | 2,471 | 3,951 | +60% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +5 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.