Network Developer Interfaces

Name: Network Developer Interfaces
Author: sodejm

ASecurity

Assess developer and runtime interfaces (Docker, Docker Registry, RMI, JDWP, Erlang EPMD, ADB, distcc, SVN, AJP, FastCGI) with execution effect classification, canary verification, cleanup receipts, and developer privilege candidate routing.

2 stars
0 votes
0 copies
1 view
Added October 15, 2026

securitypythonjavabashdockerkubernetesdebuggingapi

Works with

Security analysis

A100/100

Scanned October 15, 2026

npx -y skills add sodejm/copilot-operation-plugin-for-security --skill network-developer-interfaces --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Network Developer Interfaces?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Network Developer Interfaces

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/sodejm-network-developer-interfaces-copilot-operation-plugin-for-s/badge)](https://www.skillsdirectory.com/skills/sodejm-network-developer-interfaces-copilot-operation-plugin-for-s)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: network-developer-interfaces
description: Assess developer and runtime interfaces (Docker, Docker Registry, RMI, JDWP, Erlang EPMD, ADB, distcc, SVN, AJP, FastCGI) with execution effect classification, canary verification, cleanup receipts, and developer privilege candidate routing.
---

# Developer and Runtime Interfaces

1. **Protocol-Specific Developer & Debugging Interface Probes**:
   - Assess exposure of container runtimes (Docker API, Docker Registry), debugging ports (Java RMI, JDWP, Erlang EPMD, ADB), distributed build tools (distcc, SVN), and gateway interfaces (AJP, FastCGI) across approved targets.
   - Ground assessments in observed protocol responses, versions, and configurations.

2. **Execution Effect Classification & Plan Binding**:
   - Explicitly declare `ExecutionEffect`: `read_only`, `non_destructive`, `state_change`, `code_execution`.
   - Require explicit authorization flags (`--allow-code-execution`, `--allow-state-change`) bound to the approved action plan before attempting intrusive probes.

3. **Application vs Infrastructure Specialist Routing**:
   - Route application behavior to web/API workflows and cluster paths to Kubernetes context establishment (`cops-web-specialist`, `cops-cloud-specialist`, `cops-pentest-specialist`).
   - Prepare cluster handoff with an exact destination policy and a JSON kubeconfig. The handoff validates the current context and allowed API hostname offline; it does not verify connectivity.

4. **Inaccessible != Secure Truth Boundary**:
   - Strictly mark unreachable, filtered, or connection-refused services as `inaccessible` (with `auth_prerequisite: unknown`). Never claim unverified services are protected or secure.

5. **Canary Validation and Verifiable Cleanup Receipts**:
   - Validate access controls using benign canary identifiers (`canary_docker_probe`, `canary_debug_probe`) without disrupting production workflows.
   - Emit verified `CleanupReceipt` records confirming rollback and artifact removal (`verified_removed`).

6. **CLI Invocation**:
   ```bash
   python3 -m cops developer-services assess --mode live --targets dev01.corp.internal --destination-policy destination-policy.json --canary-id "canary_docker_probe" --output dev_report.json
   python3 -m cops developer-services handoff --kind cluster --target-host dev01.corp.internal --destination-policy destination-policy.json --cluster lab-cluster --kubeconfig kubeconfig.json --output cluster_handoff.json
   python3 -m cops developer-services candidates dev_report.json --output dev_candidates.json
   python3 -m cops developer-services cleanup dev_report.json --output cleanup_receipts.json
   python3 -m cops developer-services inspect dev_report.json
   ```