Securing Cloud And Supply Chain

This is your go-to when you need to lock down Kubernetes clusters, audit CI/CD pipelines, or review infrastructure as code from a security lens. It covers container escapes, RBAC tightening, admission policies, supply chain attestation with SLSA and Sigstore, cloud IAM anti-patterns, and secrets management. The philosophy is paranoid by design: sign everything, verify everywhere, least privilege by default, and treat internal networks like hostile territory. You'll get concrete policy snippets and minimum-permission examples instead of vague best practice platitudes. If you're debugging why your Terraform has wildcard actions or your GitHub Actions are leaking AWS keys, this skill will walk you through the fix and the OIDC migration path.

GitHub stars: 224
last updated: Jun 10, 2026

View on GitHub

Install

$ npx -y skills add telagod/code-abyss --skill securing-cloud-and-supply-chain --agent claude-code

Installs into .claude/skills of the current project.

Files

云原生与供应链安全

判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。

默认怀疑一切外来字节：镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签，能锁就锁，能最小就最小。

路由

意图	秘典	核心
容器/K8s 加固	container-and-k8s	容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission
软件供应链	supply-chain	SLSA、Sigstore、SBOM、CI/CD OIDC、attestation、VEX
云 IAM 与 Secrets	cloud-iam-and-secrets	IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity

何时使用

场景	用本 skill	不用
K8s manifest / Helm chart 安全审查	✅	—
CI/CD pipeline (GitHub Actions / GitLab CI) 加固	✅	—
Terraform / Pulumi / CloudFormation 评审	✅	—
AWS/GCP/Azure IAM policy 审查	✅	—
镜像扫描与签名链路设计	✅	—
应用层 Web/API 漏洞 (SQLi/XSS/SSRF)	—	用 `securing-systems`
红队 C2/横移/免杀	—	用 `securing-systems/red-team`
集群部署/Helm 模板编写 (非安全视角)	—	用 `provisioning-infrastructure`
一般架构设计与权衡	—	用 `designing-architectures`