Results for “dom-security”

Agent profile for review prompt injection, tool boundaries, untrusted content, data exfiltration, and human approval gates. Use when Codex needs a specialist agent perspective for planning, implementation, review, debugging, validation, or handoff in this domain.

Exploit Document Object Model (DOM) Based Cross-Site Scripting (XSS) vulnerabilities. Unlike Reflected or Stored XSS, the attack payload is executed purely on the client-side as a result of modifying the DOM environment, often without the payload ever reaching the backend server.

Trigger: security rules, credential leaks, auth tokens, input sanitization, threat model. Scope: Software security guidelines, threat prevention, secure data handling. Boundary: Excludes client-side web browser vulnerabilities.

Design and deploy IEC 62443-compliant conduit architecture for secure OT remote access, including jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to industrial control systems.

Conduct authorized security assessments of LLM applications and AI agents, covering prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

When tackling a task that requires domain expertise beyond general coding ability — architecture patterns, framework-specific gotchas, deployment strategies, security anti-patterns, or specialized workflows — call the windags_skill_graft MCP tool with your task description. You'll receive expert knowledge including decision trees, failure modes, worked examples, and anti-patterns from a library of 503+ curated skills. Only graft when the task genuinely requires specialized knowledge. Simple tasks (rename a variable, fix a typo, format code) do not need grafting.