Results for “go”

Configure Google Apigee security policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security to defend against OWASP API Top 10 threats.

Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.

Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions) by enforcing least privilege IAM roles, eliminating hardcoded secrets, scanning dependencies for vulnerabilities, validating input, securing function URLs, and enabling runtime monitoring.

Expert Australian Information Security Manual (ISM) advisor for government entities and their supply chains. Use for ISM control selection, gap analysis, system authorisation, IRAP assessment preparation, security documentation, and ASD compliance. Triggers on: ISM controls, ASD compliance, IRAP assessment, PROTECTED system scoping, Essential Eight vs ISM, system authorisation, NC/OS/ PROTECTED/SECRET/TOP SECRET classification markings, security objectives, ISM guidelines or chapters, control applicability markings, cybersecurity documentation for Australian government, and any question about the ASD Information Security Manual framework or Australian government cybersecurity obligations.

Analyzes DeFi protocol risk before deposit, decomposes headline APY into sustainable yield, emissions, and drag factors, and flags common rug-risk patterns in tokenomics, liquidity, and governance. Advisory only—no wallet access, no private key handling, no transaction signing, no on-chain execution.

Score the experience a new customer actually has, not just whether they activated. Grades the first 90 days on the moments that make someone feel taken care of, finds where the welcome goes cold, and hands back a scored audit with the specific fixes. Built for any post-sale team, customizable to your product and lifecycle. Trigger on "audit my onboarding", "score our onboarding experience", "why do new customers churn early", "grade our first 90 days", "where does onboarding go cold", "is our welcome any good", or any onboarding-quality question.

Use to sign off a QA period for audit or governance — stating what is being attested to, on what evidence, and with which limitations. Trigger for "sign off the QA period", "attest to our quality results", "monthly QA governance pack", "certify the quality figures", or being asked to confirm quality was assured for a period.

Bypasses safety filters on API-served LLMs using jailbreak templates, input obfuscation, and multi-model racing.

Sarbanes-Oxley Act compliance reference — SOX sections, internal controls, audit requirements, and IT governance. Use when evaluating SOX compliance, designing internal controls, or preparing for financial audits.

Run the quarter-boundary ritual — roll the quarter-scoped project folders, archive finished projects, grade the closing quarter's GOALS/OKRs, and draft the new quarter's goals behind an approval gate. Trigger on /quarter-rollover, "quarter rollover", "roll the quarter", "close out Q2", "new quarter setup", or when tools/quarter_path.py --check reports drift. Distinct from /triage-tasks (daily gate) and /audit (repo health check).

Configures and runs static analysis and linting tools across multiple languages, integrating with CI/CD and security platforms.

Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.

Cross-repository dependency audit. Scans package manifests for outdated packages, security advisories, version conflicts, and license issues. Produces a prioritized update plan. Supports Node.js, Python, Rust, and Go projects.

When the user wants to audit or optimize an App Store or Google Play listing. Also use when the user mentions 'ASO audit,' 'app store optimization,' 'optimize my app listing,' 'improve app visibility,' 'app store ranking,' 'audit my listing,' 'why aren't people downloading my app,' 'improve my app conversion,' 'keyword optimization for app,' or 'compare my app to competitors.' Use when the user shares an App Store or Google Play URL and wants to improve it.

Audit MCP server configurations for security issues including secrets exposure, shell injection, unpinned dependencies, and unapproved servers.

Performs authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.

> ⚠️ **AUTHORIZED USE ONLY** — This skill is intended for authorized security professionals only. Use only against systems you own or have explicit written permission to test. Unauthorized use may violate applicable laws.

Audit project dependencies for risk — known-vulnerable versions, unpinned ranges, abandoned packages, and badly outdated majors. Reads package.json, requirements.txt, go.mod, Cargo.toml. Pure Claude Code, no signup.

Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.

Perform language and framework-specific security best-practice reviews, write secure-by-default code, and generate prioritized vulnerability reports with suggested fixes.

Set up continuous fuzzing infrastructure for open-source projects using Google's OSS-Fuzz platform, including building and running fuzz harnesses locally and enrolling new projects.

Audit and fix internationalisation for any web or mobile app. Use when asked to "audit i18n", "fix translations", "add locale", "natural language", "translation quality", "hardcoded strings", "localisation", or "the Japanese feels like Google Translate".

Audit and manage dependencies across multi-language projects by scanning for vulnerabilities, license conflicts, and transitive dependency risks, with safe-upgrade planning.

Enforce deploy-time security controls that ensure only trusted, attested container images are deployed to Google Kubernetes Engine and Cloud Run.

Detects and prevents code injection attacks targeting serverless functions through static analysis, event source poisoning detection, and IAM policy auditing.

Plan and execute authorized spearphishing simulations for red team engagements, covering pretext development, payload creation, infrastructure setup, campaign execution, and post-campaign analysis.

Discover hidden directories, files, APIs, and administrative interfaces by enumerating URLs and testing authentication enforcement during authorized security assessments.

Classifies AI systems under the EU AI Act's risk tiers and maps compliance obligations for conformity, transparency, and human oversight.

Enforces GDPR-compliant deployment practices for Google Cloud Run, including Frankfurt region verification, PII-safe logging, data anonymization, retention policies, and CSP configuration.

Conduct cybersecurity assessments of electric power grid infrastructure, including NERC CIP compliance verification, substation automation security, and IEC 61850 protocol analysis.

Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages, and remediating affected accounts.

Identify and exploit SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.

Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.

Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps.

Audit historical Claude Code token usage from JSONL session files — shows total spend, cache hit rates, top costly sessions, weekly trends, and where tokens are going. Run after heavy sessions or weekly to measure optimization impact.

Conduct a maturity assessment against the NIST Cybersecurity Framework (CSF) 2.0, using Implementation Tiers to measure organizational cybersecurity posture and create improvement roadmaps.