dev-devops
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive security-first guidance for modern infrastructure, including mandatory image signing with Cosign, SBOM generation, and vulnerability scanning with Trivy.
- [EXTERNAL_DOWNLOADS]: The skill references and fetches resources from trusted organizations including Google (distroless images), GitHub (official Actions), Aqua Security (Trivy), and Sigstore (Cosign). These operations are documented neutrally as they align with best practices for supply chain security.
- [CREDENTIALS_UNSAFE]: The skill contains placeholder credentials such as
POSTGRES_PASSWORD: secretinreferences/docker.mdfor local development templates. These are benign examples for demonstration and do not expose sensitive environment secrets. - [COMMAND_EXECUTION]: The skill involves the execution of standard DevOps tooling (
kubectl,tofu,helm,docker,cosign) which is necessary for its primary purpose of infrastructure and delivery management.
Audit Metadata