Results for “security-advisories”

Use `analysis-agent` to analyze permissions, secrets, sensitive data, trust boundaries, and injection; `task-agent` to implement controls; and `review-agent` to assess evidence. Skip self-review and no-trust-impact work.

Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.

Implements AI safety guardrails including input validation, output filtering, robustness testing, human oversight, and monitoring to prevent harmful outputs and ensure system reliability.

Scan and audit AI agent skills for security risks before installation, producing a PASS/WARN/FAIL verdict with findings and remediation guidance.

Review protected asset policy and risky local data surfaces.

Agent profile for review prompt injection, tool boundaries, untrusted content, data exfiltration, and human approval gates. Use when Codex needs a specialist agent perspective for planning, implementation, review, debugging, validation, or handoff in this domain.

Audit Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.

AI Safety Specialist IA — Expert en sécurité IA (alignment, guardrails, filtrage de contenu, test de biais, red teaming)

Draft privacy policies, terms of service, disclaimers, and legal notices. Creates GDPR-compliant texts, cookie policies, and data processing agreements. Use PROACTIVELY for legal documentation, compliance texts, or regulatory requirements.

Route security, compliance, privacy, crypto/Web3, framework security, vulnerability review, and risk prompts. Use when prompts mention security-review, security scans, bounty hunting, HIPAA, PHI, compliance, Web3 risk, smart contracts, x402, LLM trading risk, or framework-specific security.

Use with analysis-agent, task-agent, or review-agent for task-local authentication lifecycle and recovery risk. Do not use without that decision or as task owner.