Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Securing Cloud And Supply Chain · telagod | DecimalAI

securityby telagod

Securing Cloud And Supply Chain

telagod/securing-cloud-and-supply-chain

Source telagod/code-abyss ↗License MIT

云原生与软件供应链安全防御。容器/K8s 加固、Service Mesh、CI/CD 安全、SLSA/SBOM/Sigstore、云 IAM、Secrets 管理、IaC 安全。

SkillScore91Maintained

Automatic

Security & AppSec pack

Last verified 8/24/2026

What it changes

Passed 20 of 22 test cases with the skill, and 19 of 22 without it.

Without skill86%

With skill91%

Checks it passed that the model alone missed

Disables privileged container execution by specifying privileged false or restricted mode.
Provides a parameterized database query snippet that replaces direct string concatenation.
Identifies the SQL injection vulnerability caused by string concatenation in the database query.

and 1 more in the full report

2 fixed18 passed either way1 still failing1 broke

Pass-rate lift: +5 pp
Tokens: +78%
Agent turns: 0%
Response time: +20%

Model gemini-3.6-flashMeasured 8/24/2026v120 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/telagod-securing-cloud-and-supply-chain/SKILL.md https://app.decimal.ai/s/telagod-securing-cloud-and-supply-chain/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add telagod-securing-cloud-and-supply-chain, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/telagod-securing-cloud-and-supply-chain/ and pins it in .decimal/skills.lock

decimalai skills add telagod-securing-cloud-and-supply-chain

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/telagod-securing-cloud-and-supply-chain/SKILL.md https://app.decimal.ai/s/telagod-securing-cloud-and-supply-chain/SKILL.md

Raw file: /s/telagod-securing-cloud-and-supply-chain/SKILL.md ↗ · machine-readable summary at /s/telagod-securing-cloud-and-supply-chain.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 2

Prompt

We noticed unexpected database queries executing on our e-commerce platform. Here is the Node.js Express route code: `app.get('/search', (req, res) => { db.query('SELECT * FROM items WHERE name = ' + req.query.q); })`. Please analyze the code, explain the vulnerability, and provide a secure parameterization fix.

What was checked, without and with the skill
Checked	Without skill	With skill
Identifies the SQL injection vulnerability caused by string concatenation in the database query.	Missed	Passed
Provides a parameterized database query snippet that replaces direct string concatenation.	Missed	Passed

case-02 · gemini-3.6-flash · 8/24/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md71 lines4 files

云原生与供应链安全

判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。

默认怀疑一切外来字节：镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签，能锁就锁，能最小就最小。

路由

意图	秘典	核心
容器/K8s 加固	container-and-k8s	容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission
软件供应链	supply-chain	SLSA、Sigstore、SBOM、CI/CD OIDC、attestation、VEX
云 IAM 与 Secrets	cloud-iam-and-secrets	IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity

何时使用

场景	用本 skill	不用
K8s manifest / Helm chart 安全审查	✅	—
CI/CD pipeline (GitHub Actions / GitLab CI) 加固	✅	—
Terraform / Pulumi / CloudFormation 评审	✅	—
AWS/GCP/Azure IAM policy 审查	✅	—
镜像扫描与签名链路设计	✅	—
应用层 Web/API 漏洞 (SQLi/XSS/SSRF)	—	用 `securing-systems`
红队 C2/横移/免杀	—	用 `securing-systems/red-team`
集群部署/Helm 模板编写 (非安全视角)	—	用 `provisioning-infrastructure`
一般架构设计与权衡	—	用 `designing-architectures`

通用铁律

Least privilege by default — 任何 Role/IAM/SA/Token 起手就是空集合，按需求逐项添加，禁通配 * 与 Action: *。
Immutable infrastructure — 镜像用 digest 不用 tag，IaC state 不允许人工 drift，部署后只重建不改造。
Sign everything, verify everywhere — 镜像、artifact、commit、SBOM 必须签名；准入控制必须 verify，否则等于没签。
Secrets never in plaintext — 不进 git、不进 env file、不进 ConfigMap、不进 Terraform state；Vault/Secret Manager + 短期凭证。
Defense in depth — 镜像扫描 + admission policy + runtime detection + network policy + audit log，单层失守不致命。
OIDC over long-lived tokens — CI 到云、Pod 到云、Service 到 Service 一律 federated identity，废弃 access key。
Provenance is non-negotiable — 不知道来源的二进制不上生产；SLSA L3+ 是目标线。
Zero trust east-west — 内网即外网，mTLS 默认开启，NetworkPolicy 默认拒绝。

执行链

Track record

Benchmark

20 / 22

test cases passed, vs 19 / 22 without

Adoption

Users: 1
Times used: 10

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

telagod / code-abyss

skills/securing-cloud-and-supply-chain/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 3 files

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

telagod/architecting-security安全架构与治理：威胁建模 (STRIDE/PASTA/LINDDUN)、零信任身份架构、IAM/SSO/MFA/PAM、合规框架 (SOC2/PCI/HIPAA/GDPR)、DLP、隐私工程、安全控制设计。Use when designing security architecture, threat modeling new systems, implementing zero-trust identity, designing IAM/SSO/PAM, building compliance evidence chains, or planning privacy-by-design.Close match+27 pp pass-rate lift

More skills from the same source and nearby in the registry, with their headline benchmark lift.