Agent skill
secure-by-design-pattern-library
Secure-by-design architecture patterns for Kubernetes. Zero trust, defense in depth, least privilege, and fail-secure patterns with implementation examples and threat models.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/patterns/skills/secure-by-design-pattern-library
SKILL.md
Secure-by-Design Pattern Library
When to Use This Skill
Building security into architecture from the ground up, not bolting it on afterward. These patterns enforce security properties at the application, network, and admission control layers, making violations visible and costly.
Implementation
See the full implementation guide in the source documentation.
Techniques
Integration Patterns
End-to-End Deployment
Complete example combining all patterns:
- Zero trust mTLS communication
- Defense in depth pod hardening
- Least privilege RBAC configuration
- Fail secure admission controls
Security Audit Checklist
Verification checklist before deployment:
- Zero Trust: mTLS policies in place
- Defense in Depth: Pod security contexts enforced
- Network Policies: Default-deny rules configured
- Least Privilege: Minimal RBAC permissions
- Fail Secure: Admission webhooks with failurePolicy: Fail
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
Didn't find tool you were looking for?