Security

Set up and use 1Password CLI (op) for signing in, reading, and injecting secrets, with a required tmux session to manage authentication.

Implements AI safety guardrails including input validation, output filtering, robustness testing, human oversight, and monitoring to prevent harmful outputs and ensure system reliability.

Guides implementation of data protection and privacy controls for regulatory frameworks such as GDPR, HIPAA, SOC 2, and PCI-DSS, including audits, retention policies, and data subject requests.

Provides expert-level guidance on implementing and applying app security concepts, including design, optimization, debugging, and best practices.

Configure authentication and authorization for a MariaDB REST Service: create REST auth apps, link them to services, add REST users, and manage REST roles and privileges.

Prevents destructive operations on production systems and restricts edits to a specified directory when running agents autonomously.

Implement GDPR data protection requirements, including consent management, data subject rights, and privacy by design for processing EU personal data.

Resolves legacy references to the security-guardian capability by routing to the current runtime equivalent.

Resolves legacy references to the security-reviewer capability and routes to the current runtime implementation.

Performs security scanning, compliance checks, deployment planning, and infrastructure setup, with optional dependency auditing and bundle size analysis.

Runs an evidence-first, read-only workflow over large codebases via an external JSONL REPL server, retrieving only minimal file slices and greps to produce cited architecture and audit reports.

Detect container escape attempts using Falco, seccomp, and auditd, with rules for privileged containers, Docker socket access, and kernel module loading.

Guides building secure admin panels with RBAC, audit logging, and step-up controls for privileged actions.

Discovers, installs, and manages AI agent skills from agentskill.sh, including searching, installing mid-session, scanning for security issues, and providing feedback.

Manage a HashiCorp Vault PKI secrets engine to act as a certificate authority, issuing and rotating short-lived X.509 certificates for services and microservices.

Configures Istio service mesh on Kubernetes for traffic management, mTLS security, and observability, including canary routing, authorization policies, and telemetry.

Implements layered security for Flutter apps: code obfuscation, certificate pinning, secure storage, encryption, biometric authentication, and root/jailbreak detection.

Implements service mesh with Istio or Linkerd, covering traffic management, mTLS, circuit breakers, and observability for microservices on Kubernetes.

Implements Kubernetes network policies for micro-segmentation, covering ingress/egress rules, Calico and Cilium, with a Python CLI for managing and validating policies.

Automates security and compliance checks using OPA policies, Trivy vulnerability scanning, AWS CIS benchmark verification, and Kubernetes remediation scripts.

Analyzes AWS WAF web ACLs, rules, IP sets, and logging configurations, and retrieves blocked/allowed request metrics from CloudWatch.

Manage and inspect OPA policies, Gatekeeper constraints, and Rego rules, including discovery, testing, and audit analysis.

Conducts a GDPR data audit covering personal data mapping, lawful basis assessment, consent management, data retention policies, DSAR processes, and cross-border transfer compliance.

Analyzes container security posture, image assurance, compliance, and runtime alerts on the Aqua Security platform via its API.

Analyzes AWS CloudTrail events and trails, including trail health, API activity, security investigations, resource changes, and event selector audits, with parallel execution and anti-hallucination guardrails.

Reads and audits Auth0 tenant configuration, applications, connections, rules, actions, users, and logs using the Management API with a discovery-first, read-only approach.

Manages and analyzes Clerk authentication resources, including users, organizations, and sessions, with commands for user growth, auth health, and membership review.

Monitors Drata compliance posture by querying the Drata public API for control status, evidence collection, personnel compliance, and asset inventory, then produces a structured audit-readiness report.

Filters user-generated content for safety using Google Model Armor via the gws CLI.

Audits frontend codebases for security vulnerabilities and bad practices, covering XSS, CSRF, DOM issues, CSP, input validation, file uploads, and Node.js/NPM dependencies across web, React, Astro, Twig, Node.js, and Bun.

Monitors security and configures Google Workspace, including reviewing audit logs and enforcing Drive sharing policies.

Generates audit logs and usage reports for Google Workspace accounts via the Admin SDK Reports API.

Enforces the Vikingo Studio standard for WordPress plugins and repos: naming taxonomy, plugin headers, folder structure, versioning, release flow, private update channel, admin UI rules, security baseline, and pre-release checklist.

Audits WordPress plugin and theme PHP code for advanced security issues beyond basic sanitization, including object injection, SSRF, CSRF, mass assignment, file inclusion, mail header injection, ZipSlip, type juggling, and TOCTOU races.

Audits WordPress plugin or theme PHP code for common security mistakes including missing nonce checks, capability checks, input sanitization, output escaping, SQL preparation, AJAX exposure, file traversal, and unsafe redirects.

Build WordPress admin tables by extending WP_List_Table, covering required overrides, pagination, bulk actions, and CSRF protection.