Skip to content
LiveNew tools this week
Submit
AIMarketly
devsecops-lookup logo

devsecops-lookup

Looks up OWASP DevSecOps Guideline phases, security tools, and pipeline checks. Returns tool configurations, CWE mappings, and integration patterns for CI/CD security. Use when user asks about "DevSecOps", "SAST", "DAST", "SCA", "container security", "IaC security", "secret detection", "gitleaks"...

majiayu000/claude-skill-registry0installs661starsDevOps & CI/CD

SKILL.md

Full skill instructions

DevSecOps Guideline Lookup

Reference for OWASP DevSecOps Guideline phases, tools, and security checks.

Pipeline Phases

PhaseActivityKey Tools
DevelopPre-commit checks, Secret detectionGitleaks, TruffleHog, pre-commit
BuildSAST, SCA, Container, IaCSemgrep, Trivy, Hadolint, tfsec
TestDAST, API Security, IASTOWASP ZAP, Nuclei, Postman
DeploySecurity Gates, Config validationPolicy-as-code, Admission controllers
OperateMonitoring, Vulnerability managementCNAPP, SIEM, Pentesting

Lookup Workflow

  1. Identify the Query Type:

    • Pipeline phase (develop, build, test, deploy, operate)
    • Tool name (gitleaks, semgrep, trivy, etc.)
    • Security activity (SAST, SCA, DAST, etc.)
    • CWE reference

  2. Search the Indexes:

    # Phase lookup
cat ${CLAUDE_PLUGIN_ROOT}/​skills/​devsecops-lookup/​pipeline-phases-index.json | jq '.phases["build"]'

# Tool lookup
cat ${CLAUDE_PLUGIN_ROOT}/​skills/​devsecops-lookup/​tools-index.json | jq '.tools["semgrep"]'

# Search by keyword
cat ${CLAUDE_PLUGIN_ROOT}/​skills/​devsecops-lookup/​tools-index.json | jq '[.tools | to_entries[] | select(.value.keywords | map(ascii_downcase) | any(contains("sast")))]'

# CWE to phase mapping
cat ${CLAUDE_PLUGIN_ROOT}/​skills/​devsecops-lookup/​pipeline-phases-index.json | jq '[.phases | to_entries[] | select(.value.cwes | any(contains("CWE-798")))]'

  3. Return Results with:

    • What it does (summary)
    • Installation command
    • Usage example
    • CI/​CD integration pattern
    • Official references

Response Format

### [Tool/​Activity Name]

**Phase**: [develop|build|test|deploy|operate]
**Category**: [secret-detection|sast|sca|container|iac|dast|misconfig]

**What It Does**:
[1-2 sentence summary]

**Installation**:
\`\`\`bash
[install command]
\`\`\`

**Basic Usage**:
\`\`\`bash
[usage command]
\`\`\`

**CI/​CD Integration** (GitHub Actions):
\`\`\`yaml
[workflow snippet]
\`\`\`

**CWE Coverage**: [list of CWEs]

**References**:
- [Tool URL]
- [OWASP DevSecOps Guideline URL]

Quick Reference: Tools by Phase

Develop (Pre-commit)

ToolPurposeInstall
GitleaksSecret detectionbrew install gitleaks
pre-commitHook managementpip install pre-commit
detect-secretsSecret patternspip install detect-secrets

Build (CI)

ToolPurposeInstall
SemgrepSASTpip install semgrep
TrivySCA + Containerbrew install trivy
HadolintDockerfile lintbrew install hadolint
tfsecTerraform securitybrew install tfsec
CheckovIaC securitypip install checkov

Test (CD/​Staging)

ToolPurposeInstall
OWASP ZAPDASTDocker
NucleiVulnerability scannergo install nuclei

Index Coverage

pipeline-phases-index.json

  • All DevSecOps pipeline phases
  • Activities per phase
  • Recommended tools
  • CWE mappings
  • OWASP DevSecOps Guideline references

tools-index.json

  • 15+ security tools
  • Installation commands
  • Usage patterns
  • CI/​CD integration examples
  • Output format specifications

Example Queries

User: "How do I scan for secrets in CI?" You: Look up gitleaks in tools-index.json

User: "What's the build phase?" You: Look up build in pipeline-phases-index.json

User: "Terraform security scanning?" You: Look up tfsec or checkov in tools-index.json

User: "CWE-798 prevention?" You: Search for CWE-798 in phases, return secret detection tools

External Resources