{"id":"e03d893f-bdd4-46fc-9b6e-565ae767f5e4","slug":"trident-secops-skills","kind":"skill","name":"Trident-SecOps-Skills","summary":"A curated collection of AI SecOps 24 SKILL.md capabilities for security work offensive security, SOC and detection engineering, cloud and Kubernetes hardening, DFIR, threat intel, secure programming,","owner":"Garyson26","repoUrl":"https://github.com/Garyson26/Trident-SecOps-Skills","license":"MIT","licenseTier":"permissive","trust":"community","stars":26,"match":null,"fewStars":false,"format":"skill","createdAt":"2026-06-01T10:17:52.000Z","addedAt":"2026-10-14T05:55:26.268Z","logoUrl":"https://avatars.githubusercontent.com/u/125772582?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","cloud-infra"],"tags":["ai-agents","ai-security","claude-plugin","codex","codex-plugin","gemini","security","security-automation"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-17T06:51:26.412Z","sample":false,"url":"https://conduits.dev/tools/trident-secops-skills","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# Trident SecOps Skills\n\n![Trident SecOps Skills banner](assets/banner.svg)\n\nA curated collection of 24 `SKILL.md` capabilities for security work —\noffensive security, SOC and detection engineering, cloud and Kubernetes\nhardening, DFIR, threat intel, secure programming, reverse engineering,\nprompt improvement, and multilingual communication.\n\nThe same skills run on three agents: **Gemini CLI**, **Claude Code**, and\n**OpenAI Codex**. There is one canonical `skills/` tree; each platform reads\nit through a thin adapter.\n\nRepository URL:\n\n```text\nhttps://github.com/Garyson26/Trident-SecOps-Skills\n```\n\n## What is included\n\nThis repository contains 24 skills, grouped below.\n\n### Cyber security automation\n\n- `gemini-tool-orchestrator`: Translate natural-language intent into safe,\n  scoped pipelines of nmap, nuclei, ffuf, semgrep, trivy, and friends.\n- `ai-redteam`: Evaluate prompt injection, jailbreak, tool abuse, agent\n  hijack, and RAG poisoning on LLM and agent systems you own.\n- `threat-intel-fusion`: Collect, normalize, enrich, dedupe, and prioritize\n  IOCs and actor profiles into STIX, Sigma, YARA, and blocklists.\n- `cloud-security-automation`: AWS, Azure, GCP posture, IaC scanning, and\n  drift-and-fix workflows shipped as code, not console clicks.\n- `detection-engineering`: Author and tune Sigma, YARA, Suricata, KQL, SPL,\n  and EQL detections with ATT&CK coverage and tests.\n- `kubernetes-security`: Cluster hardening, admission control with\n  Gatekeeper/Kyverno, runtime defense, and signed-image supply chain.\n- `purple-team-automation`: Link Atomic Red Team, Caldera, and Stratus\n  emulation to detection validation and coverage scoring.\n- `osint-recon-automation`: Passive recon, asset graphing, and exposure\n  monitoring for authorized scopes only.\n- `api-security-automation`: REST, GraphQL, and gRPC assessment covering\n  OWASP API Top 10, JWT abuse, BOLA, mass assignment, and replay.\n- `forensics-triage`: DFIR across disk, memory, network, cloud, and\n  identity with defensible timelines and chain of custody.\n- `bug-bounty-workflow`: Scope-aware recon, dedupe, and high-signal\n  reporting for HackerOne, Bugcrowd, Intigriti, and YesWeHack.\n- `smart-contract-audit`: Solidity, Vyper, and Move audit with Slither,\n  Foundry, Echidna, invariants, MEV, and bridge risk.\n\n### Core security\n\n- `offensive-security`: Plan authorized offensive security assessments.\n- `exploit-development`: Analyze lab vulnerabilities and safe proof of\n  concept workflows.\n- `malware-reverse-engineering`: Triage suspicious artifacts and produce\n  defensive findings.\n- `devsecops`: Harden CI/CD, infrastructure, containers, and releases.\n- `soc-operations`: Triage alerts, hunt threats, and produce incident notes.\n- `cybersecurity-partner`: Act as a practical security reviewer and advisor.\n\n### Engineering and language\n\n- `go-programming`: Build, debug, test, and review idiomatic Go systems.\n- `python-programming`: Build, test, type, package, and maintain Python code.\n- `assembly-programming`: Read, write, explain, and debug low-level assembly.\n- `prompt-enhancement`: Improve prompts, task specs, and agent instructions.\n- `multilingual`: Translate, localize, and improve multilingual content.\n- `claude-mythos-emulation`: Create Claude-like assistant behavior specs\n  without identity claims or proprietary prompt copying.\n\n## Install\n\n| Agent | Method | Command |\n| --- | --- | --- |\n| Gemini CLI | extension | `gemini extensions install https://github.com/Garyson26/Trident-SecOps-Skills --consent` |\n| Claude Code | plugin marketplace | `/plugin marketplace add Garyson26/Trident-SecOps-Skills` then `/plugin install trident-secops-skills@trident-secops` |\n| Codex | installer script | `./install.sh codex` (or `./install.ps1 -Platform codex`) |\n\nFull instructions, including manual and project-scoped installs, are in\n[INSTALL.md](INSTALL.md).\n\n### Why Codex needs a script\n\nGemini reads `skills/` and Claude's plugin manifest points at the same\ndirectory, so both install straight from the repository. Codex discovers\nskills under `.agents/skills`, so the installer copies the tree there.\n\n## Documentation\n\nRead the documentation set for installation details, usage patterns, and skill\nknowledge:\n\n- [Install](INSTALL.md)\n- [Usage](USAGE.md)\n- [Knowledge base](KNOWLEDGE_BASE.md)\n- [Comparison](COMPARISON.md)\n- [Contributing](CONTRIBUTING.md)\n- [Security policy](SECURITY.md)\n- [FAQ](FAQ.md)\n- [Roadmap](ROADMAP.md)\n- [Installation guide](docs/installation.md)\n- [Skill catalog](docs/skill-catalog.md)\n- [CLI usage](docs/cli-usage.md)\n- [Security boundaries](docs/security-boundaries.md)\n- [Cybersecurity workflows](docs/cybersecurity-workflows.md)\n- [Programming workflows](docs/programming-workflows.md)\n- [Prompting and multilingual workflows](docs/prompting-and-multilingual.md)\n- [Development and maintenance](docs/development-and-maintenance.md)\n- [Troubleshooting](docs/troubleshooting.md)\n\n## Safety model\n\nThe cyber security skills are written for authorized, defensive, educational,\nand lab-scoped work. They emphasize scope confirmation, safe proof, containment,\nreporting, and remediation. They intentionally avoid unauthorized access,\nstealth, persistence, credential theft, destructive activity, and malware\nimprovement.\n\n## Repository layout\n\nEach skill is self-contained:\n\n```text\nskills/\n└── skill-name/\n    ├── SKILL.md\n    └── agents/\n        └── openai.yaml\n```\n\n`skills/` is the single canonical tree — there are no duplicate copies\nelsewhere in the repository. Every skill is a directory holding a `SKILL.md`\nwhose YAML frontmatter supplies `name` and `description`, which is the format\nGemini CLI, Claude Code, and Codex all read. The `agents/openai.yaml` files\nprovide Codex interface metadata and are ignored by the other two agents.\n\nRun `bash scripts/validate.sh` to check the tree.\n\n## Source references\n\nThe installation docs were checked against each agent's published skill\nformat. Gemini references were verified on May 9, 2026; Claude and Codex\nreferences on September 16, 2026.\n\nGemini CLI:\n\n- Agent Skills overview:\n  https://geminicli.com/docs/cli/skills/\n- Managing Agent Skills:\n  https://geminicli.com/docs/cli/using-agent-skills/\n- Extension reference:\n  https://geminicli.com/docs/extensions/reference/\n- Command reference:\n  https://google-gemini.github.io/gemini-cli/docs/cli/cli-reference.html\n\nClaude Code:\n\n- Plugin reference:\n  https://code.claude.com/docs/en/plugins-reference\n- Plugin marketplaces:\n  https://code.claude.com/docs/en/plugin-marketplaces\n\nCodex:\n\n- Building skills:\n  https://learn.chatgpt.com/docs/build-skills\n"}