Security

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Audits codebases against HIPAA Security Rule safeguards, mapping findings to 45 CFR sections and tracing PHI data flows.

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.

Guides secure design and review of Lightning Web Components, covering DOM safety, Apex data exposure, and Lightning Web Security.

Queries real-time vulnerability intelligence from NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK via a remote MCP server, offering seven tools for CVE lookup, search, and trending analysis.

Applies the California Consumer Privacy Act framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Applies the SOC 2 framework to identify, assess, and mitigate security risks in systems, processes, and data handling.

Monitors authorized threat intelligence feeds and maps adversary TTPs to MITRE ATT&CK, NIST CSF, and ISO 27001 frameworks to produce actionable intelligence reports with IOCs and defensive recommendations.

Applies ISO/IEC 42001 to establish, audit, or certify an AI Management System, mapping controls to clauses 4-10 and producing governance plans.

Bypasses safety filters on API-served LLMs using jailbreak templates, input obfuscation, and multi-model racing.

Audita infraestrutura e pipeline em busca de vulnerabilidades, credenciais vazadas, IAM excessivo e exposição pública, com recomendações de hardening e classificação de severidade.

Reviews code diffs or explicit file sets through independent correctness and QA lenses, producing a severity-ordered verdict for pre-merge audits or review gates.

Deploy Caddy on a remote Linux host to expose a local HTTP backend as trusted HTTPS, prioritizing a user-owned domain with Let's Encrypt HTTP-01 and falling back to DuckDNS DNS-01 when needed.

Scans local repos and AI agent skill folders for security drift, saves trusted baselines, and compares changes after updates to highlight risky new capabilities.

Manages environment variables securely by masking sensitive values, validating schemas, and injecting secrets into commands without exposing them.

Explains cryptographic primitives and provides Python implementations for encryption, hashing, key exchange, and digital signatures.

Assesses cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Coordinates five specialized coding agents (linter, perf, refactor, security, test) to enforce quality gates across the development lifecycle, from lint enforcement through performance profiling, refactoring, security auditing, and test coverage.

Configures and runs static analysis and linting tools across multiple languages, integrating with CI/CD and security platforms.

Implements container security with image scanning, runtime protection, image signing, and security policies using tools like Falco, Trivy, and Notary.

Analyzes AWS S3 buckets for storage class distribution, lifecycle policies, access patterns, and cost optimization, including security posture checks like encryption and public access.

Analyzes cloud security posture, vulnerabilities, and attack paths using the Wiz API, including compliance assessment and resource inventory.

Scans dependencies, containers, IaC, and code for vulnerabilities using Snyk, summarizing findings by severity and suggesting fixes.

Manages BIND9 DNS servers by discovering zones, validating configuration, checking DNSSEC status, and reporting query patterns and statistics.

Scaffolds and reviews custom WordPress REST API endpoints, covering registration, authorization, input validation, response shaping, and security best practices.

Configures and secures Spring Boot Actuator HTTP endpoints, including custom paths, ports, SSL, authentication, and CORS.

Scans a single file against the OWASP Top 10:2025, tracks cross-file connections, and maintains a persistent findings record.

Reviews pull request diffs for correctness, security, maintainability, and test coverage, providing severity-ranked findings and a close-out recommendation.

Drafts a federally-defensible SOW or PWS the prime issues to a subcontractor / teaming partner — same FAR 37.102(d) / 37.602 / 16.601(c)(2) / 16.306(d) discipline a contracting officer applies, opposite seat. USE WHEN the user asks to "write a SOW for our sub", "draft a PWS for [Partner]", "build the teaming-partner statement of work", "convert this SOO into a sub SOW", "we need a SOW the sub will sign", or any variant of authoring a downstream work statement. Walks the upstream 3-phase tree (acquisition intake → 6 scope blocks → 14-section assembly), pulls scope from the active Theseus KG (requirements, deliverables, work_scope_items, performance_standards), enforces FAR 37.102(d) "no FTEs in body", emits a chat-only staffing handoff for the prime's cost build, writes Markdown for `renderers` → .docx. DO NOT USE FOR prime proposal prose (`proposal-generator`), reverse-engineering an RFP (`rfp-reverse-engineer`), pricing the sub (`price-to-win`), or clause audit (`compliance-auditor`).

Scaffold the local env file with required variable stubs from .env.example and code, open it for the user to fill, and verify completeness by key names only — never reading secret values

Track compliance requirements and generate audit trail reports. Use when auditing controls, checking policies, generating audit trails.

Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

Provides a structured deep-dive into CORS misconfiguration vulnerabilities with exact payloads for every PortSwigger lab variant, including zero-day escalation techniques and blue-team detection guidance.

Detect and exploit Server-Side Template Injection vulnerabilities across multiple template engines including Jinja2, Twig, Freemarker, and Velocity, with payloads for sandbox escape and remote code execution. Includes detection methodology, bypass techniques, and fix patterns.

Detect and exploit DOM-based XSS vulnerabilities by auditing JavaScript for tainted data flow from controllable sources to dangerous sinks, with payloads and bypass techniques for client-side testing.