Looks up OWASP DevSecOps Guideline phases, security tools, and pipeline checks. Returns tool configurations, CWE mappings, and integration patterns for CI/CD security. Use when user asks about "DevSecOps", "SAST", "DAST", "SCA", "container security", "IaC security", "secret detection", "gitleaks", "semgrep", "trivy", "pipeline security", "シークレット検出", "静的解析", "動的解析", "コンテナセキュリティ", "セキュリティゲート".
/plugin marketplace add naporin0624/claude-web-audit-plugins/plugin install web-audit-tools@web-audit-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
pipeline-phases-index.jsontools-index.jsonReference for OWASP DevSecOps Guideline phases, tools, and security checks.
| Phase | Activity | Key Tools |
|---|---|---|
| Develop | Pre-commit checks, Secret detection | Gitleaks, TruffleHog, pre-commit |
| Build | SAST, SCA, Container, IaC | Semgrep, Trivy, Hadolint, tfsec |
| Test | DAST, API Security, IAST | OWASP ZAP, Nuclei, Postman |
| Deploy | Security Gates, Config validation | Policy-as-code, Admission controllers |
| Operate | Monitoring, Vulnerability management | CNAPP, SIEM, Pentesting |
Identify the Query Type:
Search the Indexes:
# Phase lookup
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/pipeline-phases-index.json | jq '.phases["build"]'
# Tool lookup
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/tools-index.json | jq '.tools["semgrep"]'
# Search by keyword
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/tools-index.json | jq '[.tools | to_entries[] | select(.value.keywords | map(ascii_downcase) | any(contains("sast")))]'
# CWE to phase mapping
cat ${CLAUDE_PLUGIN_ROOT}/skills/devsecops-lookup/pipeline-phases-index.json | jq '[.phases | to_entries[] | select(.value.cwes | any(contains("CWE-798")))]'
Return Results with:
### [Tool/Activity Name]
**Phase**: [develop|build|test|deploy|operate]
**Category**: [secret-detection|sast|sca|container|iac|dast|misconfig]
**What It Does**:
[1-2 sentence summary]
**Installation**:
\`\`\`bash
[install command]
\`\`\`
**Basic Usage**:
\`\`\`bash
[usage command]
\`\`\`
**CI/CD Integration** (GitHub Actions):
\`\`\`yaml
[workflow snippet]
\`\`\`
**CWE Coverage**: [list of CWEs]
**References**:
- [Tool URL]
- [OWASP DevSecOps Guideline URL]
| Tool | Purpose | Install |
|---|---|---|
| Gitleaks | Secret detection | brew install gitleaks |
| pre-commit | Hook management | pip install pre-commit |
| detect-secrets | Secret patterns | pip install detect-secrets |
| Tool | Purpose | Install |
|---|---|---|
| Semgrep | SAST | pip install semgrep |
| Trivy | SCA + Container | brew install trivy |
| Hadolint | Dockerfile lint | brew install hadolint |
| tfsec | Terraform security | brew install tfsec |
| Checkov | IaC security | pip install checkov |
| Tool | Purpose | Install |
|---|---|---|
| OWASP ZAP | DAST | Docker |
| Nuclei | Vulnerability scanner | go install nuclei |
User: "How do I scan for secrets in CI?"
You: Look up gitleaks in tools-index.json
User: "What's the build phase?"
You: Look up build in pipeline-phases-index.json
User: "Terraform security scanning?"
You: Look up tfsec or checkov in tools-index.json
User: "CWE-798 prevention?" You: Search for CWE-798 in phases, return secret detection tools
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.