Security

jayrha Bundle

Safely upgrades project dependencies by inventorying outdated packages, reading changelogs and migration guides, staging upgrades in isolated commits, running tests at each step, and rolling back cleanly on failure. Use this skill when asked to "upgrade dependencies", "bump packages", "update npm/pip/cargo/go modules", "resolve a CVE / security advisory", "migrate to the latest version of <library>", "fix outdated dependencies", "do a dependency bump PR", or when a Dependabot/Renovate PR needs review and verification.

jayrha Bundle

Triages and prioritizes security vulnerabilities (CVEs) by combining CVSS base/temporal scores, real-world exploitability (EPSS, KEV, public PoCs), environmental exposure (internet-facing, network reachability, authentication), and business impact (data sensitivity, asset criticality) into a defensible, ranked remediation plan with SLAs. Use this skill when asked to triage CVEs, prioritize a vulnerability scan, assess whether a CVE is exploitable or reachable in a given environment, decide patch urgency, set remediation SLAs, write a vulnerability risk assessment, deduplicate scanner findings, or answer "how bad is CVE-XXXX-YYYYY for us?" / "should we drop everything to patch this?".

jayrha Bundle

Defines modern authentication and password policies aligned with NIST SP 800-63B, covering minimum length, blocklist/breach screening, rate limiting, MFA, password storage hashing, and account recovery. Use this skill when asked to "write a password policy", "review our authentication requirements", "implement NIST 800-63B", "decide password complexity rules", "configure password hashing", "set up MFA requirements", or audit an existing login/signup flow for security.

liberty91ltd Skill

Use when the user asks about CTI standard operating procedures (daily triage, IOC processing, flash-report cadence, threat-actor profile updates, briefing schedule), or wants to look up a specific SOP.

liberty91ltd Skill

AlienVault OTX API reference. Community threat intelligence pulses and indicator lookups.

liberty91ltd Skill

STIX 2.1 bundle creation reference. Object types, relationships, and JSON templates for structured threat intelligence sharing.

liberty91ltd Skill

CrowdStrike Falcon Intelligence (Intel API) reference. OAuth2 auth, Falcon Query Language, indicator (IOC) lookups, threat-actor entities, intel reports, MITRE ATT&CK mappings, malware families, vulnerabilities, rule sets.

liberty91ltd Skill

Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules. Routes to the right investigation or analysis skill, then auto-applies rigor skills (source rating, TLP, confidence, likelihood) on the output.

caixinyu2017-star Bundle

Use when running the final pre-submission audit for an AER, AER:Insights, or AEJ manuscript — length, format, cover letter, per-author disclosure statements, file packaging, and routing among the AEA journal family. Apply immediately before clicking submit.

annatchijova Skill

Hunt for violations of declared or implied security invariants across transitions — a property established at T0 (validation, authority, identity, integrity, namespace) must still hold when the effect happens at Tn. Use whenever auditing or debugging anything with state transitions, redirects, resume/checkpoint flows, approval gates, retries, batching, serialization, or multi-layer pipelines. Trigger on "the check exists but", "validated once", "re-materializes", "re-injects", "authorization decay", "does the check survive", "who approved this", "TOCTOU", "resume", "redirect", "checkpoint", "stale state", "the property is established here but used there", or whenever a security decision is made in one layer and consumed in another. Sibling of red-team-auditing — that skill earns verdicts on candidates; this one generates the highest-yield candidates by naming the invariant the system believes it keeps.

annatchijova Skill

Turn a plausible hypothesis into an earned verdict with the cheapest experiment that can kill it — binary oracle with a canary value, a negative control inside the same run, prediction stated before execution, novelty gate before writing, and every link in the evidence chain labelled by epistemic level. Use whenever a security finding, bug hypothesis, or root-cause claim needs to be confirmed before reporting, when building a PoC, when the user says "prove it", "confirm the bug", "reproduce", "is this real", "ready to submit", "write the report", or when a claim rests on source reading alone and runtime confirmation is possible. Trigger even when a PoC already exists — to review whether its controls actually isolate the claimed factor. Sibling of falsifiable-testing — that skill builds tests that can fail; this one builds the single experiment whose failure kills the hypothesis and whose success a reviewer cannot dismiss.

annatchijova Skill

Systematic assessment of a codebase's living, dead, and fossil modules — scan, categorize, prioritize, act. Use when the user says "audit the codebase", "find dead code", "what can we delete", "clean up the repo", "module archaeology", "codebase health", "what's unused", "technical debt inventory", or when a project has accumulated enough history that nobody is sure which modules are live and which are orphaned. Also trigger when the user asks "is this module still used?", "why do we have two copies of X?", or "what would break if I deleted Y?". Complements software-archaeology (which governs safe *modification* of individual modules) — this skill governs the *assessment* phase that decides which modules deserve that careful modification, which are candidates for bulk removal, and which need to be left alone with documentation. If software-archaeology is the surgeon, this skill is the triage nurse.

annatchijova Bundle

Build and verify append-only logs that prove no entry was altered, inserted, reordered, or dropped after the fact — a hash chain where each entry seals the previous one. Use this whenever you build or review an audit trail, ledger, chain of custody, provenance record, or any append-only log that could later be challenged; whenever you need to detect tampering rather than just record events; and whenever someone says "audit log", "tamper-evident", "tamper-proof", "hash chain", "ledger", "provenance", or "prove this wasn't changed". Push to use this even when the user only says "log every X" or "keep a record of Y" and that record might one day need to be trusted.

annatchijova Skill

Secret Lifecycle Discipline

annatchijova Skill

Threat Attribution Restraint

annatchijova Skill

Build the actor × resource × action matrix a system implicitly claims to enforce, then test the cells it never wrote a test for — because authorization bugs are absences, and you cannot grep for an absence. Use whenever a system has more than one kind of user, more than one tenant, or any object with an owner — multi-tenant SaaS, admin panels, org/team/workspace models, RBAC or ABAC policy, sharing and invitation flows, API keys with scopes, service accounts, feature flags that gate privilege. Trigger on "IDOR", "BOLA", "broken access control", "can user A see user B's data", "tenant isolation", "row-level security", "privilege escalation", "who can access this endpoint", "check permissions", "admin bypass", "scoped token", "impersonation", "we added a role", or a new endpoint that takes an object id. Sibling of invariant-hunting, which follows one property across a transition; this skill enumerates the whole grid so no cell is untested. It maps and tests authorization; it does not design the policy engine.

themarmack Skill

On-demand Category 1 researcher for narrow SDLC concerns — trunk-based development, ephemeral environments, IaC promotion patterns, secrets-handling lifecycle, golden paths / platform engineering, branch strategies, change-freeze patterns, feature-flag governance, blue-green vs canary. For a focused question, produces a research note with current-state-of-practice + regulated-org constraints + recommended approach. Output at vault/research/sdlc-best-practice/YYYY-MM-DD-{slug}.md. Use when the user asks to research a general SDLC practice or pattern that no topic-specific researcher covers — producing a fresh, cited research note — as opposed to Copilot (copilot-deep-dive), GitHub platform (github-platform-watch), regulator (financial-regulator-watch), or supply-chain (supply-chain-security-watch) questions.

themarmack Skill

On-demand Category 1 researcher for a specific GitHub Advanced Security feature — secret scanning push protection, code scanning autofix, security campaigns, dependency review action, security advisories database, custom auto-triage rules. For a chosen feature, produces a research note with current state, rollout caveats, regulated-org applicability, and recommendations. Output at vault/research/ghas/YYYY-MM-DD-{feature-slug}.md. Composes with ghas-config-reviewer (baseline-checking side) and the various GHAS-touching ops skills. Use when the user asks to research a single GHAS feature in depth — adoption, rollout, tuning, regulated-org caveats — producing a fresh, cited research note; not for checking a repo or org config against the baseline (ghas-config-reviewer), Dependabot strategy questions (dependabot-strategy), or platform-wide GitHub questions (github-platform-watch).

themarmack Bundle

iac-security-reviewer

themarmack Skill

Audit a GitHub organization's admin-surface settings — SAML / SCIM, EMU posture, base permissions, secret scanning + push-protection org defaults, allowed Actions list, runner groups, repository creation policies, IP allow-list — against the org's baseline. Uses `gh api` for live inspection where authenticated; falls back to a structured manual-checklist a human admin can walk through in the UI. Produces a posture report with `current_state` vs `expected_state` per item, severity, and remediation. Use during quarterly admin reviews, before audit conversations, or when troubleshooting a "why can't users do X" complaint that might be an org-wide policy.

themarmack Skill

Given a target repo's stack + risk profile, decide default vs advanced CodeQL setup, recommend a query suite (code-scanning / security-extended / security-and-quality), select custom packs (community + org's internal), document the alert triage workflow, and define the exception process. Produces an onboarding plan ready to hand to the repo owner. Use during repo GHAS onboarding or when refactoring a repo's existing CodeQL setup that's drowning in low-signal alerts or missing real ones.

themarmack Skill

Generate or review a `.github/dependabot.yml` for a target repo or service, calibrated to org policy (regulated-environment defaults from `dependabot-strategy` research) and the repo's actual stack. Handles grouped updates (security + version separately), schedule cadence per ecosystem, private-registry integration, auto-merge gating, reviewer routing, and the open-pull-requests-limit per ecosystem. Use whenever onboarding a repo to Dependabot, refactoring an existing config that's drowning the team in PRs, or auditing a sample of org repos for config consistency.

themarmack Skill

Assess a self-hosted runner pool (or a single runner image) against the org's runner-security baseline — ephemeral lifecycle, restricted network egress, runner-group scoping, OS image hardening, secret handling, log retention. Produces a posture report with current state vs expected per item. Use during runner-pool design review, after a runner-related incident, when planning a new restricted runner group for a regulated workload, or as part of quarterly GHAS posture audit.

themarmack Skill

Cross-reference a specific control question against the org's relevant compliance frameworks — NIST 800-53 / 800-218 SSDF, PCI-DSS 4.0, SOX ITGC, ISO 27001 / 27034 / 42001, CIS Controls / Benchmarks, FFIEC IT Handbook. For a single question (e.g., "what's the relevant SOX ITGC control objective for AI-generated code in production?"), produces a side-by-side mapping showing which frameworks address it, which control IDs match, and where they conflict. Use when drafting policy that cites multiple frameworks, responding to an audit ask, or building a compensating-control matrix for an exception request.

themarmack Skill

On-demand Category 1 researcher for software supply-chain security — SBOM standards (CycloneDX, SPDX), SLSA framework, Sigstore, in-toto, OpenSSF Scorecard, npm / PyPI / Maven malware trends, and major supply-chain incidents. Output at vault/research/supply-chain/YYYY-MM-DD-{slug}.md. Composes with sbom-reviewer (control side), daily-cve-digest (active matching side), and actions-workflow-hardener (workflow side). The Mini Shai-Hulud research at [[2026-06-20-actions-hardening-post-shai-hulud]] is the kind of output this skill produces on demand. Use when the user asks to research a supply-chain security standard, framework, ecosystem trend, or landscape question on demand — producing a fresh, cited research note — not for the scheduled stack-matched CVE roundup (daily-cve-digest), auditing a specific SBOM (sbom-reviewer), or dissecting one specific incident (incident-postmortem-research).

themarmack Skill

On-demand Category 1 researcher for publicly-reported dev-tooling / supply-chain / AI-system incidents relevant to a current bank decision. Pulls the public postmortem (vendor disclosure, CISA advisory, post-incident analyst commentary, peer-bank disclosure if applicable), distills the technique + the missing control + the lesson, and maps to the org's current posture. Output at vault/research/incident/YYYY-MM-DD-{slug}.md. The Mini Shai-Hulud research at [[2026-06-20-actions-hardening-post-shai-hulud]] is an existing instance of this skill's output. Use when the user asks to research, distill, or learn from a specific publicly-reported incident — producing a fresh, cited research note mapped to org posture — not for internal incidents (org incident-response process), the recurring news sweep (weekly-intelligence-digest), or landscape-level supply-chain questions (supply-chain-security-watch).

themarmack Skill

Run common saved searches against the GitHub enterprise audit log — Copilot policy changes, secret-scanning push-protection bypasses, SSO events, allowed-Actions list edits, content-exclusion changes. Each canonical search has a structured query (the `gh api`-equivalent of the audit log search syntax), the matching `action` types, expected normal volume, alert threshold, and what to do if results spike. Use during incident response (something changed and we need to know who/when), during quarterly audit prep, or proactively as part of a security-monitoring rhythm.

xiaotianna Bundle

Vercel Firewall expert guidance — automatic DDoS mitigation, the Vercel WAF (custom rules, IP blocking, managed rulesets, rate limiting), Attack Mode, system bypass, bot management, and the `vercel firewall` CLI. Use when configuring platform-level security, responding to attacks, or staging firewall rules.

craftos-dev Bundle

Connect to 100+ APIs (Google Workspace, Microsoft 365, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to interact with external services. Security: The MATON_API_KEY authenticates with Maton.ai but grants NO access to third-party services by itself. Each service requires explicit OAuth authorization by the user through Maton's connect flow. Access is strictly scoped to connections the user has authorized. Provided by Maton (https://maton.ai).

craftos-dev Bundle

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.

craftos-dev Bundle

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

craftos-dev Bundle

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

deangrant Bundle

Perform a read-only technical code review (correctness, security, performance, readability, testing, best practices). Use when reviewing a git diff or the full codebase. Never edit code or output rewritten snippets.

deangrant Bundle

Harden GraphQL APIs with TLS, trusted documents or demand control, input sanitization, introspection/error masking, and field auth. Use when locking down production GraphQL or reviewing DoS risk.

deangrant Bundle

Manage access and refresh token lifecycle: TTLs, rotation, reuse detection, revocation (RFC 7009), introspection (RFC 7662), JWKS, and DPoP. Use when implementing OAuth token services or hardening session security.

deangrant Bundle

Design file upload and download APIs: multipart vs presigned vs resumable, Range/206 downloads, Content-Disposition, and content validation. Use when adding binary transfer endpoints or reviewing upload security.