[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CF823A75K84ANRZJS5X849":3,"skill-same:01M6CF823A75K84ANRZJS5X849":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":57,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":59,"install":60,"resources":73},"01M6CF823A75K84ANRZJS5X849","securing-cloud-and-supply-chain",null,"云原生与软件供应链安全防御。容器\u002FK8s 加固、Service Mesh、CI\u002FCD 安全、SLSA\u002FSBOM\u002FSigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI\u002FCD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code.","telagod\u002Fcode-abyss","telagod","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F39987513?v=4","01M6CF4EH93PP5CWH3J34Z66DP","01M6CF4EN6W4QFXK3PRE9W29X8",245,"MIT","https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-cloud-and-supply-chain\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"securing cloud and supply chain","cloud","iam","pipelines","iac","use","安全","secrets","slsa","sigstore","hardening","kubernetes","SBOM","ci","service mesh","code","supply chain security","mesh","security","2026-11-10 10:12:30",false,"---\nname: securing-cloud-and-supply-chain\ndescription: 云原生与软件供应链安全防御。容器\u002FK8s 加固、Service Mesh、CI\u002FCD 安全、SLSA\u002FSBOM\u002FSigstore、云 IAM、Secrets 管理、IaC 安全。Use when hardening Kubernetes clusters, auditing CI\u002FCD pipelines, implementing supply chain security, managing cloud IAM, or reviewing IaC code.\nuser-invocable: false\n---\n\n# 云原生与供应链安全\n\n> **判断先于执行**：决定「是否做 \u002F 选什么 \u002F 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 `skills\u002F_kernel\u002Fsecurity\u002FSKILL.md`——它管 judgment，本秘典管 execution；冲突时以内核判断为准。\n\n> 默认怀疑一切外来字节：镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签，能锁就锁，能最小就最小。\n\n## 路由\n\n| 意图 | 秘典 | 核心 |\n|------|------|------|\n| 容器\u002FK8s 加固 | [container-and-k8s](references\u002Fcontainer-and-k8s.md) | 容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission |\n| 软件供应链 | [supply-chain](references\u002Fsupply-chain.md) | SLSA、Sigstore、SBOM、CI\u002FCD OIDC、attestation、VEX |\n| 云 IAM 与 Secrets | [cloud-iam-and-secrets](references\u002Fcloud-iam-and-secrets.md) | IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity |\n\n## 何时使用\n\n| 场景 | 用本 skill | 不用 |\n|------|-----------|------|\n| K8s manifest \u002F Helm chart 安全审查 | ✅ | — |\n| CI\u002FCD pipeline (GitHub Actions \u002F GitLab CI) 加固 | ✅ | — |\n| Terraform \u002F Pulumi \u002F CloudFormation 评审 | ✅ | — |\n| AWS\u002FGCP\u002FAzure IAM policy 审查 | ✅ | — |\n| 镜像扫描与签名链路设计 | ✅ | — |\n| 应用层 Web\u002FAPI 漏洞 (SQLi\u002FXSS\u002FSSRF) | — | 用 `securing-systems` |\n| 红队 C2\u002F横移\u002F免杀 | — | 用 `securing-systems\u002Fred-team` |\n| 集群部署\u002FHelm 模板编写 (非安全视角) | — | 用 `provisioning-infrastructure` |\n| 一般架构设计与权衡 | — | 用 `designing-architectures` |\n\n## 通用铁律\n\n1. **Least privilege by default** — 任何 Role\u002FIAM\u002FSA\u002FToken 起手就是空集合，按需求逐项添加，禁通配 `*` 与 `Action: *`。\n2. **Immutable infrastructure** — 镜像用 digest 不用 tag，IaC state 不允许人工 drift，部署后只重建不改造。\n3. **Sign everything, verify everywhere** — 镜像、artifact、commit、SBOM 必须签名；准入控制必须 verify，否则等于没签。\n4. **Secrets never in plaintext** — 不进 git、不进 env file、不进 ConfigMap、不进 Terraform state；Vault\u002FSecret Manager + 短期凭证。\n5. **Defense in depth** — 镜像扫描 + admission policy + runtime detection + network policy + audit log，单层失守不致命。\n6. **OIDC over long-lived tokens** — CI 到云、Pod 到云、Service 到 Service 一律 federated identity，废弃 access key。\n7. **Provenance is non-negotiable** — 不知道来源的二进制不上生产；SLSA L3+ 是目标线。\n8. **Zero trust east-west** — 内网即外网，mTLS 默认开启，NetworkPolicy 默认拒绝。\n\n## 执行链\n\n```\n审查：清单 → 威胁建模 → 配置对照 → 风险分级 → 修复 PR → 验证回归\n应急：定位失陷面 → 撤凭证 → 隔离工作负载 → 取证镜像 → 根因 → 加固准入\n```\n\n## 优先级红线\n\n| 红线 | 立即处置 |\n|------|---------|\n| Secrets 已进 git history | 撤销凭证 → rewrite history → 通报 |\n| 公网暴露 K8s API server | 关闭 → IP 白名单 → 审计访问日志 |\n| privileged: true Pod 跑业务 | 拒绝准入 → 重构镜像 → PSS restricted |\n| CI 用 long-lived AWS key | 切 OIDC → 撤销 key → 审计旧密钥使用 |\n| `Action: *` IAM policy | 收敛权限 → CloudTrail 审计实际使用 |\n\n## 与其他 skill 联动\n\n- 应用层漏洞（SQLi、XSS、反序列化、代码污点）→ `securing-systems\u002Fcode-audit`、`pentest`\n- 红队对抗与 C2 → `securing-systems\u002Fred-team`\n- SOC 检测\u002FSigma\u002FIR → `securing-systems\u002Fblue-team`\n- 集群与 Helm\u002FGitOps 部署（非安全视角）→ `provisioning-infrastructure`\n- API\u002F认证架构设计 → `designing-architectures\u002Fsecurity-arch`\n- DevOps 流水线工程实践 → `automating-devops`\n\n## 输出约束\n\n- 反例使用 RFC 5737 (`192.0.2.0\u002F24`、`198.51.100.0\u002F24`) 或 `example.com`\n- 凭证一律 `\u003CREDACTED>` \u002F `AKIA\u003CEXAMPLE>` 占位\n- 发现真实泄漏只报位置和处置流程，不复述完整值\n- 修复方案必须给出最小权限策略片段，不抛\"参考最佳实践\"了事\n","# 云原生与供应链安全\n\n> **判断先于执行**：决定「是否做 \u002F 选什么 \u002F 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核 `skills\u002F_kernel\u002Fsecurity\u002FSKILL.md`——它管 judgment，本秘典管 execution；冲突时以内核判断为准。\n\n> 默认怀疑一切外来字节：镜像、依赖、IaC 模块、CI runner、IAM trust。能签就签，能锁就锁，能最小就最小。\n\n## 路由\n\n| 意图 | 秘典 | 核心 |\n|------|------|------|\n| 容器\u002FK8s 加固 | [container-and-k8s](references\u002Fcontainer-and-k8s.md) | 容器逃逸、RBAC、PSS、NetworkPolicy、Service Mesh、Admission |\n| 软件供应链 | [supply-chain](references\u002Fsupply-chain.md) | SLSA、Sigstore、SBOM、CI\u002FCD OIDC、attestation、VEX |\n| 云 IAM 与 Secrets | [cloud-iam-and-secrets](references\u002Fcloud-iam-and-secrets.md) | IAM 反模式、AssumeRole、Vault、KMS、IaC、Workload Identity |\n\n## 何时使用\n\n| 场景 | 用本 skill | 不用 |\n|------|-----------|------|\n| K8s manifest \u002F Helm chart 安全审查 | ✅ | — |\n| CI\u002FCD pipeline (GitHub Actions \u002F GitLab CI) 加固 | ✅ | — |\n| Terraform \u002F Pulumi \u002F CloudFormation 评审 | ✅ | — |\n| AWS\u002FGCP\u002FAzure IAM policy 审查 | ✅ | — |\n| 镜像扫描与签名链路设计 | ✅ | — |\n| 应用层 Web\u002FAPI 漏洞 (SQLi\u002FXSS\u002FSSRF) | — | 用 `securing-systems` |\n| 红队 C2\u002F横移\u002F免杀 | — | 用 `securing-systems\u002Fred-team` |\n| 集群部署\u002FHelm 模板编写 (非安全视角) | — | 用 `provisioning-infrastructure` |\n| 一般架构设计与权衡 | — | 用 `designing-architectures` |\n\n## 通用铁律\n\n1. **Least privilege by default** — 任何 Role\u002FIAM\u002FSA\u002FToken 起手就是空集合，按需求逐项添加，禁通配 `*` 与 `Action: *`。\n2. **Immutable infrastructure** — 镜像用 digest 不用 tag，IaC state 不允许人工 drift，部署后只重建不改造。\n3. **Sign everything, verify everywhere** — 镜像、artifact、commit、SBOM 必须签名；准入控制必须 verify，否则等于没签。\n4. **Secrets never in plaintext** — 不进 git、不进 env file、不进 ConfigMap、不进 Terraform state；Vault\u002FSecret Manager + 短期凭证。\n5. **Defense in depth** — 镜像扫描 + admission policy + runtime detection + network policy + audit log，单层失守不致命。\n6. **OIDC over long-lived tokens** — CI 到云、Pod 到云、Service 到 Service 一律 federated identity，废弃 access key。\n7. **Provenance is non-negotiable** — 不知道来源的二进制不上生产；SLSA L3+ 是目标线。\n8. **Zero trust east-west** — 内网即外网，mTLS 默认开启，NetworkPolicy 默认拒绝。\n\n## 执行链\n\n```\n审查：清单 → 威胁建模 → 配置对照 → 风险分级 → 修复 PR → 验证回归\n应急：定位失陷面 → 撤凭证 → 隔离工作负载 → 取证镜像 → 根因 → 加固准入\n```\n\n## 优先级红线\n\n| 红线 | 立即处置 |\n|------|---------|\n| Secrets 已进 git history | 撤销凭证 → rewrite history → 通报 |\n| 公网暴露 K8s API server | 关闭 → IP 白名单 → 审计访问日志 |\n| privileged: true Pod 跑业务 | 拒绝准入 → 重构镜像 → PSS restricted |\n| CI 用 long-lived AWS key | 切 OIDC → 撤销 key → 审计旧密钥使用 |\n| `Action: *` IAM policy | 收敛权限 → CloudTrail 审计实际使用 |\n\n## 与其他 skill 联动\n\n- 应用层漏洞（SQLi、XSS、反序列化、代码污点）→ `securing-systems\u002Fcode-audit`、`pentest`\n- 红队对抗与 C2 → `securing-systems\u002Fred-team`\n- SOC 检测\u002FSigma\u002FIR → `securing-systems\u002Fblue-team`\n- 集群与 Helm\u002FGitOps 部署（非安全视角）→ `provisioning-infrastructure`\n- API\u002F认证架构设计 → `designing-architectures\u002Fsecurity-arch`\n- DevOps 流水线工程实践 → `automating-devops`\n\n## 输出约束\n\n- 反例使用 RFC 5737 (`192.0.2.0\u002F24`、`198.51.100.0\u002F24`) 或 `example.com`\n- 凭证一律 `\u003CREDACTED>` \u002F `AKIA\u003CEXAMPLE>` 占位\n- 发现真实泄漏只报位置和处置流程，不复述完整值\n- 修复方案必须给出最小权限策略片段，不抛\"参考最佳实践\"了事\n",{"name":5,"description":7,"user-invocable":48},"main","2544577cf03a67522466450000731e52c64a5184","skills\u002Fsecuring-cloud-and-supply-chain",35,"https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss","https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002Fcode-abyss","https:\u002F\u002Fgithub.com\u002Ftelagod","2026-07-19 23:15:32",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add telagod\u002Fcode-abyss --skill securing-cloud-and-supply-chain",{"tool":66,"command":67},"bunx","bunx skills add telagod\u002Fcode-abyss --skill securing-cloud-and-supply-chain",{"tool":69,"command":70},"pnpm","pnpm dlx skills add telagod\u002Fcode-abyss --skill securing-cloud-and-supply-chain","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-cloud-and-supply-chain\u002FSKILL.md",true,[74,80,84],{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fcloud-iam-and-secrets.md","REFERENCE","参考文档",11237,"https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-cloud-and-supply-chain\u002Freferences\u002Fcloud-iam-and-secrets.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fcontainer-and-k8s.md",10716,"https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-cloud-and-supply-chain\u002Freferences\u002Fcontainer-and-k8s.md",{"path":85,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fsupply-chain.md",10887,"https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-cloud-and-supply-chain\u002Freferences\u002Fsupply-chain.md",[89,96,104,111,122,134],{"skillNo":90,"name":91,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":47},"01M6CF94Y2R0JYCS270NC9BKM5","parse-error","https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fskill-contract\u002Fparse-error\u002Ftools\u002Fparse-error\u002FSKILL.md",[],[95],"parse error",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":47},"01M6CF925B128W5YAHWVYSJQTG","multi-script","too many scripts","https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fskill-contract\u002Fmulti-script\u002Ftools\u002Fmulti-script\u002FSKILL.md",[],[103],"multi script",{"skillNo":105,"name":106,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":47},"01M6CF8ZYT3KZ4ZZAATFJH0DV4","missing-description","https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fskill-contract\u002Fmissing-description\u002Ftools\u002Fmissing-description\u002FSKILL.md",[],[110],"missing description",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":47},"01M6CF8XB2Z8NAPYW3W7S7KW1S","invalid-tools","invalid tool name","https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fskill-contract\u002Finvalid-tools\u002Ftools\u002Finvalid-tools\u002FSKILL.md",[],[118,119,120,121],"Tools","invalid tools","Bash","tool",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":131,"publishedAt":47},"01M6CF8TTPYFV83HSF057F95QM","clash-skill","first duplicate","https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fskill-contract\u002Fduplicate\u002Ftools\u002Falpha\u002FSKILL.md",[128],{"categoryNo":129,"categoryName":130,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[132,133],"clash skill","first",{"skillNo":135,"name":124,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":47},"01M6CF8RAHFEPXNB6SWBR2T49M","second duplicate","https:\u002F\u002Fgithub.com\u002Ftelagod\u002Fcode-abyss\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fskill-contract\u002Fduplicate\u002Fdomains\u002Falpha\u002FSKILL.md",[139],{"categoryNo":129,"categoryName":130,"taxonomyType":20,"taxonomyTypeDesc":21},[132]]