RedHatProductSecurity

RedHatProductSecurity/prodsec-skills

Plugin Claude Code

Plugin marketplace listing 2 plugins: prodsec-skills, prodsec-skills-ge-core.

RedHatProductSecurity/prodsec-skills

Plugin Claude Code

Security guidance skills for AI coding assistants. Covers cryptography, web security, supply chain, MCP servers, Kubernetes, API gateways, fuzzing, static analysis, audit workflows, and more.

RedHatProductSecurity/prodsec-skills

Instructions file CodexOpenCode

Instructions for RedHatProductSecurity/prodsec-skills, covering agents.md — context for ai assistants, what this repo is, repository layout, skill format and how to reference a skill.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Apply suggested security fixes from a prior code review. Use when the user wants to remediate security findings with before/after code diffs, severity filtering, and explicit approval before modifying code.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Analyze OCI container images for security vulnerabilities, misconfigurations, supply chain risks, and hardening gaps. Use when reviewing container images from Red Hat, Quay.io, Docker Hub, or any OCI-compliant registry. Covers CVE analysis, config security, EOL component detection, credential exposure, and TLS/crypto…

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Use when performing security code review of source files, git commits, or entire codebases against OWASP Top 10 (2021), CWE/SANS Top 25, and OWASP WSTG v4.2 patterns; applicable to any language or framework.

RedHatProductSecurity/prodsec-skills

Plugin Claude Code

GE Core — 12 curated security skills for developers writing code daily: injection defense, web application security, secrets detection, container hardening, OpenShift/Kubernetes access control, dependency auditing, authentication, secure-by-design, audit logging, and AI security.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Security-focused review of AI-generated or AI-assisted code. Use when reviewing code produced by AI coding assistants, auditing AI-generated patches, verifying AI-assisted contributions before merge, or when a review needs to account for failure modes specific to AI code generation.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Secure AI-powered products and infrastructure. Use when integrating LLM APIs, deploying model-serving infrastructure, building agent workflows, connecting MCP servers, or reviewing AI system architecture for security gaps.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Enforce standard authentication for external data source connections. Use when integrating, configuring, or reviewing connections from AI systems to external databases, APIs, or data services.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Harden container images and runtime configuration. Use when building, reviewing, or auditing Containerfiles, Dockerfiles, container compose files, or Kubernetes pod security settings.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Supply chain security audit using CLI vulnerability scanners, license compliance checks, and supply chain risk assessment. Use when auditing project dependencies for known CVEs, license concerns, and supply chain health.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Apply when reviewing or writing code that processes untrusted input, constructs queries or commands, or handles user-supplied data. Covers SQL, LDAP, OS command injection, prototype pollution, and general validation strategy.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Enforce logging of access to sensitive external data sources in AI systems. Use when designing, building, or reviewing audit and logging capabilities for AI systems accessing external databases or data services.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Configure Kubernetes RBAC bindings, service accounts, namespaces, resource quotas, and service types for pods. Use when writing, reviewing, or auditing Deployments, ServiceAccounts, Roles, RoleBindings, ResourceQuotas, or Services for least-privilege access control.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Review OpenShift Security Context Constraints for correct privilege levels. Use when auditing pod security, reviewing SCC assignments, or configuring container runtime permissions on OpenShift clusters.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Detect hardcoded secrets in source code using pattern-based scanning for API keys, tokens, passwords, private keys, and connection strings. Use before committing, during code review, or for post-incident history scanning. Self-contained — no external tools required.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Apply Secure by Design, by Default, and in Deployment (SD3) principles. Use when reviewing default configurations, setup processes, update mechanisms, or evaluating whether a system fails open or closed.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Review web application security controls against OWASP-aligned risks. Use when building, auditing, or reviewing server-side web applications that handle user input, sessions, authentication, or access control.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C/C++ code to find buffer overflows and use-after-free bugs.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Secure the administrative interface of model registries. Use when building, deploying, or reviewing model registry access controls and admin interfaces.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C/C++ projects.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Enforce that AI agents have their own identity separate from human users. Use when designing, building, or reviewing agent identity management, agent authentication, or agent permission models.

RedHatProductSecurity/prodsec-skills

Skill Claude CodeCodex

Enforce SPIFFE/SPIRE plus mTLS for agent-to-agent communication. Use when designing, building, or reviewing authentication between AI agents or multi-agent systems.