Workflows and skills
Learn about the security workflows and built-in skill available in the IBM Bob Premium Package for DevSecOps.
The IBM Bob Premium Package for DevSecOps includes security workflows and a built-in skill that you can run from the Bob chat panel.
Fix supply chain vulnerabilities workflow
Remediates dependency vulnerabilities across your entire project, running your test suite at each stage to confirm no regressions are introduced.
To start the workflow, open the Bob chat panel and start a workflow named Fix Supply Chain Vulnerabilities.
Attack surface scan
A strategic, top-down AI security scan. Rather than examining every file individually, the scan builds a model of your project and then hunts for vulnerabilities based on that understanding.
To run the scan, enter /attack-surface-scan in the Bob chat panel.
The attack surface scan uses Bobcoins. Larger or more complex projects consume more.
File sweep scan
An exhaustive, bottom-up AI security scan. The scan reads every eligible source file one by one and applies a multi-round review process to identify vulnerabilities.
To run the scan, enter /file-sweep-scan in the Bob chat panel.
The file sweep scan uses more Bobcoins than the attack surface scan and takes more time on large projects. Use it when you need thorough per-file coverage rather than rapid triage.
Ansible automation skill
The DevSecOps package registers an /ansible-automation skill that gives Bob Ansible expertise. The skill covers the full lifecycle: writing new playbooks and roles, refactoring and reviewing existing content, converting shell scripts and runbooks, and validating work through a fixed gate sequence.
The skill is bundled with the extension. No manual installation is required.
| Command | What it does |
|---|---|
/ansible-automation | Shows a guided menu of available actions. |
/ansible-automation setup MCP servers using npx and a python venv | Configures Ansible MCP servers using npx and a Python virtual environment. |
/ansible-automation setup MCP servers using docker | Configures Ansible MCP servers using Docker. |
/ansible-automation create a playbook for <target> | Generates a new playbook for the specified path or target. Replace <target> with your path. |
/ansible-automation validate the playbooks and run molecule tests | Validates playbooks and runs Molecule tests. |
Terraform DevOps skill
The DevSecOps package registers a /terraform-devops skill that acts as a full Terraform lifecycle companion inside the IDE. The skill covers creating brand-new Terraform configurations from scratch, refactoring existing configurations into HashiCorp-idiomatic modules, writing plan-mode test suites using mock providers, validating configurations, and guiding plan-and-deploy cycles.
The skill is bundled with the extension. It optionally connects to HashiCorp's Terraform MCP server to pull live Registry data.
| Command | What it does |
|---|---|
/terraform-devops | Shows a guided menu of available actions. |
/terraform-devops create Terraform for @booking_service/ on IBM Cloud Code Engine | Creates brand-new Terraform configurations from scratch by reading what the application actually needs. |
/terraform-devops refactor @infra/terraform/ into modules | Refactors existing configurations into HashiCorp-idiomatic modules. |
/terraform-devops write tests and validate | Writes plan-mode test suites using mock providers (no cloud credentials needed) and validates everything. |
/terraform-devops plan and deploy infra/terraform to the dev workspace | Guides a full plan-and-deploy cycle with mandatory human approval at every destructive step. |
/terraform-devops setup the Terraform MCP server | Connects to HashiCorp's Terraform MCP server to pull live Registry data (provider versions, module details, Sentinel policies). |