DevSecOps

Overview

A portable Agent Skill for Codex, Claude Code, and Hermes Agent. It helps agents assess and improve secure software delivery with practical, risk-based guidance.

The skill uses evidence, ownership, verification, and residual-risk tracking to turn security concerns into actionable engineering decisions.

Install

Install for All Three Agents

The recommended installer is the open skills CLI:

npx --yes skills add Thanarak-q/devsecops \
  --global \
  --yes \
  --agent codex claude-code hermes-agent

This command installs devsecops for Codex, Claude Code, and Hermes Agent. Start a new agent session after installation.

To inspect the package without installing it:

npx --yes skills add Thanarak-q/devsecops --list

Install for One Agent

Replace the agent name with codex, claude-code, or hermes-agent:

npx --yes skills add Thanarak-q/devsecops \
  --global \
  --yes \
  --agent codex

Update or Remove

npx --yes skills update devsecops --global --yes
npx --yes skills remove devsecops --global --yes

Manual Install (macOS/Linux)

git clone https://github.com/Thanarak-q/devsecops.git
cd devsecops

Copy devsecops/SKILL.md to the agent you use:

# Codex / universal Agent Skills location
mkdir -p "$HOME/.agents/skills/devsecops"
cp devsecops/SKILL.md "$HOME/.agents/skills/devsecops/SKILL.md"

# Claude Code
mkdir -p "$HOME/.claude/skills/devsecops"
cp devsecops/SKILL.md "$HOME/.claude/skills/devsecops/SKILL.md"

# Hermes Agent
mkdir -p "${HERMES_HOME:-$HOME/.hermes}/skills/devsecops"
cp devsecops/SKILL.md "${HERMES_HOME:-$HOME/.hermes}/skills/devsecops/SKILL.md"

What It Does

Use this skill to assess or improve:

• secure SDLC and CI/CD practices;
• threat models and architecture decisions;
• SAST, SCA/SBOM, IaC, secrets, and DAST controls;
• cloud, Kubernetes, dependency, and supply-chain security;
• observability, monitoring, resilience, and chaos experiments;
• security baselines, licenses, exceptions, and Security Champions programs.

It does not treat a clean scan as proof of security. Findings must include evidence, ownership or an assignment path, remediation, verification, and residual risk.

Example

A user asks:

Assess this repository's CI/CD security.

The agent maps the repository, pipeline, environments, artifacts, identities, and available evidence. It then selects only the controls justified by the risk, such as secrets handling, dependency scanning, artifact provenance, least-privileged deployment credentials, and rollback readiness.

Each material finding identifies the affected scope, evidence, severity rationale, remediation, verification method, and owner or needs-assignment state. Active testing or production changes remain gated by explicit authorization.

How It Works

1. Inspect the current state across code, infrastructure, delivery, dependencies, and evidence.
2. Define scope and risk by identifying assets, data, trust boundaries, exposure, owners, and authorization.
3. Select relevant controls based on the request, technology, workflow, signal quality, and business impact.
4. Prioritize actionable findings with evidence, remediation, verification, and residual risk.
5. Validate the result with appropriate tests, scans, configuration checks, runtime evidence, or controlled experiments.
6. Report decisions and follow-up without overstating coverage or compliance.

When to Use It

Use this skill for DevSecOps adoption, security posture assessments, CI/CD hardening, threat modeling, code or IaC reviews, dependency and SBOM work, authorized application testing, observability, resilience, policy, license, or Security Champions requests.

For a simple security question, use the relevant guidance directly. For active scanning, fuzzing, credential testing, chaos experiments, or production changes, confirm explicit authorization and a safe operating boundary first.

What You Get

For a non-trivial task, the agent should produce:

• a clear scope, assumptions, and authorization boundary;
• prioritized findings or decisions with evidence and severity rationale;
• owners or a needs-assignment state, remediation paths, and verification methods;
• a practical implementation sequence with validation and rollback plans;
• metrics or acceptance criteria, residual risks, exceptions, and follow-up actions.

Safety

The skill requires authorized scope before active scanning, DAST, fuzzing, penetration testing, chaos experiments, credential testing, or production changes. It protects sensitive data, prefers reversible actions, and does not invent scan results, exploitability, compliance status, organizational ownership, or remediation evidence.

Package

devsecops/
├── SKILL.md
├── agents/openai.yaml
└── adapters/claude.md

The package contains independently authored operational guidance. Do not add copied wording, chapter structures, examples, exercises, or tables from copyrighted material without the necessary permission or license.