Results for “pr”

Perform dynamic security testing against running web applications and APIs to discover vulnerabilities through active probing and fuzzing. Use when the user requests dynamic application security testing or provides relevant inputs for this workflow.

Decision-grade entity research skill — produces a hypothesis-tested dossier on a specific company, person, nonprofit, or government org, not a generic profile. Forcing intake makes the user state their hypothesis upfront (what they already believe and want to verify or disprove) so the dossier tests it rather than confirms it. Output is an editable Word document (.docx) with verdict on the hypothesis, identity facts, 12-month activity timeline, network and reputation signals, red flags, conversation hooks tied to specific findings, and source-provenance audit log. Uses WebSearch + WebFetch + free APIs (SEC EDGAR, GitHub, ProPublica) as workhorses; optional BYOK MCPs enhance coverage. Use when the user asks for background research, diligence, or meeting prep on a specific entity (e.g., 'prep me for a meeting with [person/company]', 'due diligence on [company]'). Honors sensitivity exclusions for journalism + personal-vetting contexts.

Runs full Trailmark structural analysis by building a graph and computing pre-analysis passes for hotspots, taint, blast radius, privilege boundaries, and attack surface.

Pre-ship audit checklist for Ethereum dApps covering wallet connection, button flows, contract verification, branding, RPC config, and mobile deep linking.

Hardens AWS IAM configurations to enforce least privilege access across cloud accounts, covering policy scoping, permission boundaries, Access Analyzer integration, and credential rotation.

Analyze Windows memory dumps for signs of compromise using the Rekall memory forensics framework, including process injection, hidden processes, and rootkit detection.

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters.

Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce actionable intelligence for organizational decision-making.

Add programmable safety guardrails to LLM applications at runtime, including jailbreak detection, input/output validation, fact-checking, hallucination detection, PII filtering, and toxicity detection.

Conducts a GDPR data audit covering personal data mapping, lawful basis assessment, consent management, data retention policies, DSAR processes, and cross-border transfer compliance.

Provides a pre-deployment security checklist for OAuth-connected apps and external client apps, covering configuration, token policies, access control, and compliance.

Get best practices for developing applications with Helidon 4 (SE and MP). Use when working with Helidon SE or Helidon MP, HttpService routing, Helidon DB Client, MicroProfile Config, Helidon Security, or Helidon testing in Java 21+ projects.

Use when the team needs a testing plan covering unit, integration, end-to-end, contract, and security-adjacent checks for a product or feature. Trigger on requests to design practical testing strategy before or during implementation.

Code review guidelines covering code quality, security, and best practices.

Assist with IoT device setup, protocols, security hardening, and home automation integration.

Guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles, covering identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy in AWS, Azure, and GCP.

Expert HIPAA compliance assistant for healthcare and software contexts. Use this skill whenever the user mentions HIPAA, PHI (Protected Health Information), ePHI, covered entities, business associates, healthcare data privacy, medical records, health information security, BAA (Business Associate Agreements), or any compliance review involving patient data. Also trigger for requests to draft privacy notices, HIPAA policies, consent forms, security risk assessments, or breach notification letters. Use for developers building healthcare software who need technical safeguard guidance (encryption, access controls, audit logs), compliance officers reviewing documents or procedures, and anyone asking "is this HIPAA compliant?" or "what does HIPAA require for X?". When in doubt about whether a healthcare or data privacy question falls under this skill — use it.

Review GitHub PRs and GitLab MRs with structured analysis including blast radius, security scanning, test coverage delta, breaking change detection, and performance impact.

Audit environment-variable hygiene and secrets safety across local development and production with practical scanning, drift awareness, and rotation readiness.

Performs security-focused differential review of code changes (PRs, commits, diffs), adapting analysis depth to codebase size and generating comprehensive markdown reports.

Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.

Guides the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to establish or mature a CTI program.

Implement technical and organizational measures required by GDPR, including data mapping, DPIAs, data subject rights management, breach notification, and cross-border transfer mechanisms.

Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage.

Deploys Datadog Cloud SIEM, CSM, and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure.

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them.

Build a multi-factor asset criticality scoring model to weight vulnerability prioritization based on business impact, data sensitivity, and operational importance.

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

Orchestrates multi-stage attack-path planning and execution across reconnaissance, initial access, privilege escalation, lateral movement, and impact assessment for authorized penetration testing.

Review generated code for style, security, and architecture issues; suggest refactorings and performance improvements. Use after implementation is complete, before merging changes, or when refactoring existing code. Follows OWASP guidelines, SOLID principles, and best practices for maintainable code.

Design an application database schema from product flows and backend responsibilities. Use when the team needs core entities, relationships, lifecycle fields, indexes, audit needs, tenancy boundaries, and migration-minded schema planning for an MVP or production system.

Provides ISO 13485 internal audit methodology for medical device quality management systems, covering audit planning, execution, nonconformity classification, and external audit preparation.

Provides a comprehensive security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data exposure.

Run a heuristic evaluation of interactive UIs against Nielsen's 10 usability heuristics and interaction add-ons, scoring the rendered artifact and producing a prioritized fix list.

Verify supply chain integrity for AI agent plugins, tools, and dependencies by generating SHA-256 manifests, detecting tampered files, auditing dependency pinning, and enforcing promotion gates.

Configure Okta as a SAML 2.0 Identity Provider and implement SP-initiated and IdP-initiated SSO flows with attribute mapping, assertion encryption, and security hardening.