Results for “security”

Design Security Operations Centers with processes. TRIGGERS - Use when user needs help with soc-design related tasks.

Design Security Operations Centers with processes. TRIGGERS - Use when user needs help with soc-design related tasks.

Designing GitHub Actions workflows in depth: trigger strategy, security hardening, performance optimization, PR automation, and Reusable Workflow design.

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, and auditing SMB and LDAP signing enforcement.

Automates static analysis of Android APK/AAB files using MobSF to identify hardcoded secrets, insecure permissions, vulnerable components, and weak cryptography for pre-deployment security assessments or CI/CD integration.

Creates cross-platform agent skills from workflow descriptions, files, URLs, or screenshots. Supports single skills, multi-agent suites, template-based creation, cross-platform export, spec validation, and security auditing of third-party skills before install.

Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021). Covers consent requirements, cross-border transfer mechanisms (CAC security assessment, standard contracts, certification), separate consent triggers, and critical information infrastructure obligations. Keywords: PIPL, China data protection, CAC security assessment, cross-border transfer, separate consent, CIIO.

Expert guidance on secure coding practices, focusing on preventing common security errors made by AI during code generation. Use for: auditing AI-generated code, implementing secure design patterns, and ensuring code follows OWASP Top 10 standards. Covers input validation, authentication, cryptography, file handling, secure configuration, and business logic security.

Integrates OWASP ZAP for Dynamic Application Security Testing in CI/CD pipelines, configuring baseline, full, and API scans, interpreting findings, tuning policies, and establishing quality gates in GitHub Actions and GitLab CI.

Analyze amm operations. Use when you need to understand amm mechanisms, evaluate protocol security, or reference on-chain concepts.

Analyze cex operations. Use when you need to understand cex mechanisms, evaluate protocol security, or reference on-chain concepts.

Analyze mev operations. Use when you need to understand mev mechanisms, evaluate protocol security, or reference on-chain concepts.

Analyze vrf operations. Use when you need to understand vrf mechanisms, evaluate protocol security, or reference on-chain concepts.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration.

Review a ticket or PR through focused specialist lenses: scope, architecture, security, tests, AC coverage, and PR metadata.

Expert en DevSecOps avancé (SAST, DAST, SCA, container scanning, policy-as-code, GitGuardian, supply chain security, SBOM)

Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration.

Analyze cex operations. Use when you need to understand cex mechanisms, evaluate protocol security, or reference on-chain concepts.

OpenAPI/Swagger documentation agent for creating and maintaining comprehensive API specifications with schemas, examples, and security definitions

Runs a pre-deployment security audit of Solidity smart contracts in a Foundry project, combining static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing to catch reentrancy, access-control, and arithmetic bugs before deploying to an EVM chain.

Design and deploy IEC 62443-compliant conduit architecture for secure OT remote access, including jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to industrial control systems.

Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3.

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Guides setting up CI/CD pipelines with GitHub Actions, testing, and deployment strategies.

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

Production Fastify (TypeScript) patterns: schema validation, plugins, typed routes, error handling, security hardening, logging, testing with inject, and graceful shutdown

Use when a user asks for a concise Solana token research snapshot with market, trade, and security context

Customize an installed legal skill's settings — jurisdiction defaults, tone, autonomy, and enforced conditions — without weakening its security posture.

Secure Go backend services against common vulnerabilities. Use when implementing input validation, crypto, or SQL injection prevention in Go.

Perform code audits for quality, security, and maintainability. TRIGGERS - Use when user needs help with code-audit related tasks.

Perform code audits for quality, security, and maintainability. TRIGGERS - Use when user needs help with code-audit related tasks.

CI/CD pipeline engineering agent for GitHub Actions workflows with matrix builds, caching, artifacts, and security best practices

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.