Results for “security”

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

Provides comprehensive security patterns for Perl applications covering taint mode, input validation, safe file operations, SQL injection prevention, and web security.

Builds repeatable API security test suites in Postman covering OWASP API Security Top 10 vulnerabilities, with automated authentication, multi-role testing, and CI/CD integration via Newman.

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review". (gstack) Voice triggers (speech-to-text aliases): "see-so", "see so", "security review", "security check", "vulnerability scan", "run security".

Automate Securitytrails domain intelligence and reconnaissance operations through Composio's toolkit via Rube MCP.

Audits email infrastructure security by testing SPF, DKIM, DMARC, open relay, spoofing resilience, MTA-STS, TLS-RPT, and SMTP configuration using standard security tools.

Use this skill for fuzz tests for parsers, APIs, file handlers, encoders, validators, security-sensitive inputs. Trigger when the task involves security work related to Fuzzing Security Tests, implementation, audits, debugging, strategy, or validation.

Audits HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.

Conduct authorized iOS application security assessments using Frida, Objection, and static analysis to evaluate app security posture against OWASP MASTG standards.

Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and RBAC.

Security patterns for MCP servers including OAuth 2.0, rate limiting, input validation, and audit loggingUse when "mcp security, mcp authentication, mcp oauth, mcp rate limit, secure mcp server, mcp, security, oauth, authentication, rate-limiting, validation" mentioned.

Enforce Kubernetes Pod Security Standards at the namespace level using the built-in admission controller, with support for baseline and restricted profiles.

Static OWASP review of app code (injection, headers, deps). Use when "review security" or "check vulnerabilities". Session/route×gate/getSession → audit-auth-flows. Plan-only burndown → plan-security-audit. Table RLS → plan-rls-audit. LLM attacks → audit-llm-security.

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).

Routes security requests to specialist skills and performs STRIDE/DREAD threat modeling with a quick secret scan.

Assess security of SCADA HMI systems by evaluating authentication, communication, web interfaces, and hardening against IEC 62443 and NIST SP 800-82 guidelines.

Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.

Enables comprehensive security monitoring across Azure subscriptions, including cloud security posture management, workload protection, regulatory compliance assessment, and adaptive security controls.

Run security audits, vulnerability scans, compliance checks, and incident response workflows for application security.

Configure and manage GitHub Dependabot for automated dependency updates, security alerts, and vulnerability scanning across multiple ecosystems.

Trigger: security rules, credential leaks, auth tokens, input sanitization, threat model. Scope: Software security guidelines, threat prevention, secure data handling. Boundary: Excludes client-side web browser vulnerabilities.

Trigger: web security, XSS mitigation, secure cookies, CSRF, CSP headers, CORS policies. Scope: Frontend and browser-level security boundaries. Boundary: Excludes operating system file storage permissions.

Composite skill — full security pass across secrets, dependencies, code paths, and OWASP risks. Chains security-audit (broad) + socket-audit (npm supply chain) + semgrep (pattern scan) + code-security (code review for vulns) in parallel, reconciles into one severity-ranked report with remediation plan. Use quarterly per active repo or before any release of security-sensitive code.

Conduct authorized security assessments of LLM applications and AI agents, covering prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

Audit Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

Audits GitHub Actions workflows for exploitable vulnerabilities with concrete attack scenarios.

Assess cloud configuration risks including IAM privilege escalation, public storage exposure, network over-permissioning, and infrastructure-as-code misconfigurations.

Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails.

OWASP Top 10 + Supabase-first hardening burndown. Use when "security audit plan", "OWASP audit", "hardening plan", or "security burndown". App-layer auth flows → audit-auth-flows. Table RLS → plan-rls-audit. Key rotation → plan-secrets-audit. App LLM attacks → audit-llm-security.

Drafts combined Deed of Trust and Security Agreement instruments creating real property and UCC Article 9 personal property security interests for commercial financing. Use when drafting trust deeds, security agreements, commercial real estate financing documents, or combined real/personal property security instruments.

Fixes one security finding with the smallest safe patch, regression coverage, and verification.

Conducts systematic security code reviews to identify exploitable vulnerabilities, reporting only high-confidence findings after researching the codebase.

Analyzes cloud security posture, vulnerabilities, and attack paths using the Wiz API, including compliance assessment and resource inventory.

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic using the OWASP API Security Top 10 framework.

Aggregate security findings across AWS accounts, enable compliance standards like CIS and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security insights for organizational risk management.