Results for “swot”

Provides best practices for implementing authentication, authorization, input validation, CSRF protection, secrets management, rate limiting, and dependency security in Spring Boot services.

Drafts a federally-defensible SOW or PWS the prime issues to a subcontractor / teaming partner — same FAR 37.102(d) / 37.602 / 16.601(c)(2) / 16.306(d) discipline a contracting officer applies, opposite seat. USE WHEN the user asks to "write a SOW for our sub", "draft a PWS for [Partner]", "build the teaming-partner statement of work", "convert this SOO into a sub SOW", "we need a SOW the sub will sign", or any variant of authoring a downstream work statement. Walks the upstream 3-phase tree (acquisition intake → 6 scope blocks → 14-section assembly), pulls scope from the active Theseus KG (requirements, deliverables, work_scope_items, performance_standards), enforces FAR 37.102(d) "no FTEs in body", emits a chat-only staffing handoff for the prime's cost build, writes Markdown for `renderers` → .docx. DO NOT USE FOR prime proposal prose (`proposal-generator`), reverse-engineering an RFP (`rfp-reverse-engineer`), pricing the sub (`price-to-win`), or clause audit (`compliance-auditor`).

Configure Okta as a SAML 2.0 Identity Provider and implement SP-initiated and IdP-initiated SSO flows with attribute mapping, assertion encryption, and security hardening.

Federal Other Transaction (OT) prototype bid strategist for 10 USC 4021 research and 10 USC 4022 prototype/4022(f) production-follow-on agreements. USE WHEN the user asks to "build an OT bid", "respond to this OT solicitation", "estimate should-cost for an OT prototype", "is this milestone price reasonable", "compare 4022(d) cost-share paths", "team with an NDC to avoid 1/3 cost share", "OT price-to-win", or "TRL milestone phasing" — any milestone-based prototype scoping, OT cost stack, or 4022(d) cost-share strategy question. Reconstructs the AO's TRL phasing from the active workspace KG, picks the 4022(d) path that minimizes our exposure, builds a per-milestone cost stack from BLS OEWS + GSA CALC+ + GSA Per Diem, and emits a JSON envelope handed to `proposal-generator`. DO NOT USE FOR FAR-based contracts (`price-to-win`/`proposal-generator`), incumbent research (`competitive-intel`), FAR clause audit (`compliance-auditor`), or prime-to-sub SOW drafting (`subcontractor-sow-builder`).

Assess JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.

Applies the Sarbanes-Oxley Act to assess financial-reporting integrity and IT general controls, mapping executive certification and internal-control areas to auditable evidence for public companies.

Audit criteria, severity definitions, report JSON schema, and quality thresholds for wp-audit agents

Configure SAML 2.0 single sign-on for Google Workspace with a third-party identity provider, enabling centralized authentication and enforcing organization-wide access policies.

Composite skill — full security pass across secrets, dependencies, code paths, and OWASP risks. Chains security-audit (broad) + socket-audit (npm supply chain) + semgrep (pattern scan) + code-security (code review for vulns) in parallel, reconciles into one severity-ranked report with remediation plan. Use quarterly per active repo or before any release of security-sensitive code.

Implement secure JWT signing and verification with HMAC-SHA256, RSA-PSS, and EdDSA, including token expiration, claims validation, and defense against common JWT attacks.

Analyze WAF logs from ModSecurity, AWS WAF, or Cloudflare to detect SQL injection attack campaigns, classify injection types, and generate incident reports with OWASP classification.

JWT implementation, token management, refresh patterns, and security.

Chief Security Officer mode. (gstack)

Secure Quarkus applications with authentication, authorization, input validation, and secrets management best practices.

Systematic Obsidian vault audit and normalization — structure, frontmatter, wikilinks, broken links, Git hygiene.

Builds, configures, and manages AWS Cognito user pools, identity pools, authentication flows, and integrations with other AWS services.

Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Detect SSO and OAuth token replay and SaaS lateral movement using identity telemetry from Microsoft Entra ID and Okta.

Federal Organizational Conflict of Interest (OCI) sweeper backed by FAR Subpart 9.5 (9.501-9.508) and the active Theseus workspace knowledge graph. USE WHEN the user asks about OCI risk on a bid, organizational conflicts, incumbent conflicts, biased ground rules, unequal access to information, impaired objectivity, or any pre-bid OCI due diligence. Pulls `company`, `incumbent`, `subcontractor`, `customer`, `program_office`, and prior-contract relationships from the workspace KG, classifies each potential conflict into one of the three FAR 9.505 classes (biased ground rules, unequal access, impaired objectivity), and emits a structured findings envelope with mitigation recommendations (firewall, NDA, recusal, novation). DO NOT USE FOR FAR clause coverage audit (use `compliance-auditor`), proposal prose (use `proposal-generator`), competitor research (use `competitive-intel`), or pricing (use `price-to-win`).

Conduct passive OSINT reconnaissance on target organizations using a MITRE ATT&CK framework. Discovers employees, email patterns, subdomains, infrastructure, leaked credentials, and cloud assets with confidence-scored findings.

Routes authentication and authorization testing efforts by identifying the primary attack surface — login mechanics, object authorization, browser trust boundaries, or identity protocols such as JWT/OAuth/SAML — before selecting a deeper skill.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Deep web exploitation beyond initial scanning. Covers SQLi (blind, OOB, second-order), NoSQL injection (MongoDB, operator bypass), GraphQL injection (introspection, batching, mutation abuse), XSS (reflected/stored/DOM with full source-sink analysis), SSTI (Jinja2/Twig/Freemarker/ERB engine identification and RCE), SSRF chains, file upload bypass (polyglot creation), XXE (blind, DOCX/SVG injection, Content-Type switching), deserialization (Java/PHP/Python/.NET), command injection, path traversal (LFI wrapper bypasses), race conditions, CSRF, JWT attacks (none/key confusion/kid injection), HTTP request smuggling (CL.TE/TE.CL/H2), CRLF injection, open redirect bypass chains, CORS exploitation, web cache deception/poisoning, OAuth misconfiguration, prototype pollution, session management, and business logic flaws. Uses sqlmap (advanced modes), commix, xsser, wapiti, davtest, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and code snippets for immediate use. Ch