Security

Guides backend development across API design, authentication, databases, performance, security, scalability, and testing, with quick decision guides and defaults for production-ready systems.

Configures and troubleshoots network infrastructure: DNS records, reverse proxies, SSL certificates, firewalls, CDNs, and load balancers.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Routes security, compliance, and threat-intelligence tasks to specialized sub-skills for threat modeling, penetration testing, incident response, and vulnerability scanning.

Enforces a read-only rule for filesystem junctions and symlinks, blocking writes, deletes, and git commits that resolve outside the current project root.

Applies the Sarbanes-Oxley Act to assess financial-reporting integrity and IT general controls, mapping executive certification and internal-control areas to auditable evidence for public companies.

Applies the DORA framework to manage ICT risk and operational resilience for EU financial entities, covering governance, incident reporting, resilience testing, third-party risk, and threat intelligence sharing.

Applies the GDPR framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Applies the HIPAA framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Applies the FedRAMP framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Applies the PCI-DSS framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Conducts authorized security assessments to identify vulnerabilities, map them to OWASP and MITRE frameworks, and provide remediation guidance with responsible disclosure planning.

Applies the DevSecOps framework to structure analysis, guide decision-making, and produce actionable recommendations for engineering and operations contexts.

Classifies AI systems under the EU AI Act's risk tiers and maps compliance obligations for conformity, transparency, and human oversight.

Applies the ISO 27001 framework to identify, assess, and mitigate security risks in systems, processes, and data handling, providing structured analysis and recommendations.

Applies PCI-DSS v4.0, FINTRAC, SOX, and FDX compliance frameworks across outputs, with a primary focus on payment card industry standards.

Runs a structured security audit across six phases: attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, covering code, infrastructure, APIs, bots, payments, AI agents, and compliance.

Guides Firebase development with best practices for security rules, data modeling, and avoiding common pitfalls.

Secure Perl applications against injection, taint, and web vulnerabilities with validated patterns for input handling, file operations, process execution, and DBI queries.

Hardens Django applications against common vulnerabilities with production settings, authentication, authorization, SQL injection and XSS prevention, and secure deployment configurations.

Provides a security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data handling.

Guides HIPAA-specific healthcare privacy and security work, routing to implementation and review skills with decision gates and guardrails.

Audits a codebase for production readiness using local evidence, scoring ship/block risk and listing concrete fixes without sending repo data to external services.

Secure Quarkus applications with authentication, authorization, input validation, and secrets management best practices.

Diagnoses Linux server issues across CPU, memory, disk, I/O, and network, and manages systemd services, SSH, and Fail2Ban on Ubuntu, Debian, and AlmaLinux.

Performs structured code reviews of git branches, tracking findings in a living document and optionally running deep architectural analysis with subagents.

Audits type safety documentation against the live codebase and fixes errors, gaps, or stale information to keep docs authoritative.

Audits and iteratively fixes chat-based AI user interfaces against production best practices drawn from Claude, ChatGPT, and modern conversational AI, covering layout, rendering, input, responsiveness, scrolling, streaming, and accessibility.

Audits the course learn experience for section coverage, sidebar rendering, layout, design token compliance, tenant isolation, accessibility, data flow, and component quality. Use when reviewing course UI code quality or diagnosing learn experience issues. Pass a course slug or "all".

Adds input and output guardrails to an agent, including validation, content filtering, domain scoping, and rate limiting, with TypeScript examples and wiring instructions.

Scans Python and JavaScript codebases for bugs, security vulnerabilities, code smells, and anti-patterns, producing a prioritized fix list with line numbers, severity ratings, and suggested corrections.

Runs DNS, email security, SSL, WHOIS, and network checks by calling the dnsrobot.net API, with no API key required.

Builds, configures, and manages AWS Cognito user pools, identity pools, authentication flows, and integrations with other AWS services.

Runs a structured security audit across six phases: attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team analysis, and a final verdict, with optional Python automation scripts.

Provides guidance on Firebase best practices, including security rules, data modeling, and avoiding common pitfalls.

Guides backend development across API design, authentication, security, performance, architecture, and testing, with decision guides and defaults for production-ready systems.