Results for “command-interception”

ACTIVATE THIS SKILL FOR ANY SHELL COMMAND OR FILE READ. Check curl, wget, rm, sudo, apt, dpkg, chmod, dd, format, powershell, bash, sh. Check pipe patterns like | sh or | bash. Check shell wrappers like bash -c, xargs, find -exec. Check cloud CLI (aws, gcloud, kubectl, terraform). Check when user says sysadmin told me, Stack Overflow says, is this safe, can I run. Block reading of .env, .ssh, .aws, and credential files. This skill blocks dangerous commands and warns on risky ones. ALWAYS apply the safety protocol from this document before responding about any command.

Detect container escape attempts using Falco, seccomp, and auditd, with rules for privileged containers, Docker socket access, and kernel module loading.

Run a command inside a running Docker container

Conduz investigação de incidentes com método: triagem, hipóteses, mitigação, RCA e postmortem, priorizando evidências e confirmação humana.

Master of defensive Bash scripting for production automation, CI/CD pipelines, and system utilities. Expert in safe, portable, and testable shell scripts.

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Detect prompt injections and jailbreak attempts in LLM applications using Meta's 86M parameter classifier. Filter user inputs, third-party data, and RAG documents with low latency and multilingual support.

Deliberately disables or degrades security controls to verify detection and response capabilities, including WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess.

Scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues before deployment. Intercepts deploy commands and blocks until critical items pass.

Bash Pipeline Analysis

Blocks dangerous shell commands and warns on risky ones, applying a safety protocol before executing any command.

Security controls for RAG. Indirect prompt-injection via retrieved documents, PII detection/redaction (Microsoft Presidio, AWS Comprehend), multi-tenant isolation, ACL-aware retrieval with row-level/metadata filtering, data-leakage prevention, jailbreak hardening on retrieved context, GDPR right-to-be-forgotten in vector DBs. USE WHEN: user mentions "prompt injection RAG", "indirect prompt injection", "PII redaction", "Presidio", "ACL RAG", "row-level security", "multi-tenant RAG isolation", "GDPR vector DB", "right to be forgotten", "jailbreak", "data leakage RAG" DO NOT USE FOR: hallucination detection - use `rag-guardrails`; tenancy scaling patterns - use `rag-production`; audit tracing schema - use `rag-observability`

Scan infrastructure-as-code — Dockerfiles, Compose, Terraform, and GitHub Actions — for security misconfigurations like running as root, world-writable files, unpinned actions, and hardcoded secrets. Pure Claude Code, no signup.