Marketplace
Everything your AI needs, in one place.
Ready-made agents, skills, personas, prompts, templates and tools. Each one is checked before it goes live, works with any model, and installs in a click. Rate what you use so the best rises to the top.
- 143.8K
- listings
- 1
- installs
- 0
- reviews
- 38.7K
- publishers
A service that does a whole job for you - research, coding, support - and reports back.
Step-by-step instructions an AI follows for one kind of task. Install once, reuse everywhere.
A voice and set of rules layered onto any model: tone, audience, do's and don'ts.
A ready-to-use prompt with fill-in-the-blank variables and notes on when it works best.
A complete routing setup - models, rules and settings - in one file you can apply in a minute.
A single function an AI can call: a calculator, a search, a database lookup.
A language model endpoint with its price, speed and quality declared so the router can compare it.
building-devsecops-pipeline-with-gitlab-ci
Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security tem
building-vulnerability-dashboard-with-defectdojo
Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Ji
detecting-aws-credential-exposure-with-trufflehog
Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into
detecting-dependency-confusion
Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-
detecting-supply-chain-attacks-in-ci-cd
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposur
generating-and-analyzing-sboms
Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency
implementing-code-signing-for-artifacts
Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in deployment
implementing-devsecops-security-scanning
Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Use when setting up automated
implementing-infrastructure-as-code-security-scanning
Implements automated security scanning for Infrastructure as Code using Checkov, tfsec, and KICS to detect misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts, plus p
implementing-policy-as-code-with-open-policy-agent
Implements policy-as-code enforcement with Open Policy Agent (OPA) and Gatekeeper for Kubernetes and CI/CD pipelines, covering writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission
implementing-runtime-application-self-protection
Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy confi
implementing-secret-scanning-with-gitleaks
This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring
implementing-semgrep-for-custom-sast-rules
Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.
integrating-dast-with-owasp-zap-in-pipeline
Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan
integrating-sast-into-github-actions-pipeline
Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and merge-blockin
performing-container-image-hardening
Harden container images by minimizing attack surface, stripping unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to
performing-container-security-scanning-with-trivy
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed secret
performing-sca-dependency-scanning-with-snyk
This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source dependencies in CI/CD pipelines. It addresses scanning package manifests and lockfiles, a
scanning-containers-with-trivy-in-cicd
Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and to
scanning-iac-and-images-with-trivy
Scans container images, Infrastructure-as-Code (Terraform, CloudFormation, Kubernetes manifests, Dockerfile, Helm), filesystems, git repos, and SBOMs with Trivy's vuln, misconfig, secret, and license
scanning-kubernetes-manifests-with-kubesec
Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it. Use w
securing-github-actions-workflows
Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation: pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets, prev
secrets-gitleaks
Hardcoded secret detection and prevention in git repositories and codebases using Gitleaks. Identifies passwords, API keys, tokens, and credentials through regex-based pattern matching and entropy ana
security-engineer
安全工程师 Agent — 覆盖渗透测试、安全架构评审、DevSecOps、漏洞管理、安全监控与应急响应、合规审计、代码安全审查等全领域安全工作。能动手执行扫描、分析、加固、报告，不只是出方案。
Find
Search or browse by kind. Every card shows who made it, how many people installed it and what they think.
Install
One click. You get a manifest the router understands, plus copy-paste snippets for the CLI, Python and YAML.
Rate and publish
Leave a star rating after you have used it. Made something useful? Publish it - free listings go live immediately.
Prefer the terminal? osr stack apply registry://starter installs the starter template.