Security

Fetches crate metadata from crates.io and docs.rs APIs for Rust package discovery, and analyzes feature flags, dependency audits via RustSec Advisory DB, and MSRV compatibility.

Analyzes npm packages by fetching registry metadata, evaluating bundle size via the bundlephobia API, checking security advisories with npm audit, and mapping dependency trees using arborist.

Operates Redpanda's Agentic Data Plane: manages AI agents, MCP servers, LLM providers, budgets, guardrails, and Cedar access policies via the `rpk ai` CLI and API, including OAuth wiring and spend/transcript insights.

Assesses a project against all five SOC 2 Trust Service Criteria, producing a control-by-control PASS/PARTIAL/FAIL matrix with evidence references, remediation roadmap, and evidence collection checklist for audit readiness.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Provides an immutable audit and provenance layer for agentic systems, recording reasoning, telemetry, and actions for debugging, compliance, and learning.

Complete guide for using pass, the standard Unix password manager, covering installation, GPG setup, store initialization, daily usage, git sync, extensions, and troubleshooting.

Provides regulatory compliance assessments across data privacy, AI ethics, and localization laws, producing structured outputs with risk scores and remediation status.

Applies Brazil's LGPD framework to assess data processing legal bases, align with ANPD expectations, and classify personal data for privacy compliance.

Manages environment variables securely by validating against a schema, masking sensitive values, and injecting validated secrets into commands without exposing them.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues, using a structured checklist and verification process.

Audits Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield, covering CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Hardens Laravel applications against common vulnerabilities with guidance on authentication, authorization, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

Provides a security checklist and hardened Solidity patterns for auditing AMM contracts, liquidity pools, and swap flows, covering reentrancy, CEI ordering, donation attacks, oracle manipulation, slippage, admin controls, and integer math.

Operates the PWDEV Flow semantic audit trail: enable, record, query, summarize, or verify JSONL workflow events with integrity checks.

Diagnoses AWS architecture issues and reviews Well-Architected pillars using read-only AWS CLI commands, with confirmation required for any changes.

Otimiza imagens Docker com multi-stage builds, reduz tamanho, acelera builds e aplica práticas de segurança, incluindo análise de vulnerabilidades com Trivy.

Rotates GitHub account passwords and logs into security settings using an isolated browser, with manual 2FA handling and optional TOTP automation.

Implements Microsoft Entra ID authentication for React SPAs using MSAL.js and validates JWTs in Cloudflare Workers with jose, covering Authorization Code Flow with PKCE and common error fixes.

Implements secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities.

Browse and inspect MariaDB REST Service objects using read-only SHOW REST and SHOW CREATE REST statements to list services, schemas, views, procedures, functions, content sets, auth apps, roles, grants, and dump DDL for reverse-engineering or auditing.

Reviews staged and unstaged code changes for security vulnerabilities, code quality issues, and adherence to project conventions, reporting findings by severity.

Audits source code across C++, Android, iOS, and Web to classify files, detect embedded third-party libraries, and produce four-level verdicts with interactive HTML reports.

Assess cloud configuration risks including IAM privilege escalation, public storage exposure, network over-permissioning, and infrastructure-as-code misconfigurations.

Implements API gateways with Kong, Nginx, or Traefik, including rate limiting strategies, authentication, routing, and API management.

Analyzes AWS Cognito user pools and identity pools, covering authentication flows, MFA status, app client configuration, password policy, Lambda triggers, and federation setup.

Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.

Audit Okta identity and access management configurations with read-only API calls, covering user lifecycle, application assignments, MFA status, group and policy review, and system log analysis.

Manage and analyze SOPS-encrypted secret files, including key rotation, multi-provider encryption, and file-based secret operations. Covers encrypting and decrypting files, managing encryption keys (AWS KMS, GCP KMS, Azure Key Vault, PGP), auditing encrypted files, and comparing secret structures.

Audits WordPress plugin or theme PHP code for internationalization (i18n) correctness, including text-domain consistency, escaped translation helpers, placeholder usage, plurals, context, and text-domain loading. Produces a severity-ranked report of issues to fix before release.

Audits WordPress plugin and theme code for secret-handling issues: hardcoded credentials, weak randomness, insecure password storage, cookie flags, and secret leakage in logs.

Reference for SOC 2, PCI-DSS, HIPAA, and GDPR compliance requirements, including control checklists, evidence collection, and audit preparation guidance.

Orchestrates VPN switching, geo-block diagnostics, and leak-aware task resumption by coordinating shell, curl, WireGuard, Tailscale, DNS, IPinfo, and MoltGuard skills.

Blocks dangerous shell commands and warns on risky ones, applying a safety protocol before executing any command.

Enforces a principal-engineer self-review checklist on every code block before output, covering correctness, performance, security, naming, and testability.

Runs a structured 6-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring playbooks.