Results for “elastic-security”

Use when implementing elk functionality with production-grade patterns and safeguards.

Designs Elasticsearch indexes and mappings, tunes queries, sizes clusters, and handles operations like shard/replica strategy, ILM, monitoring, troubleshooting, and safe reindexing or upgrades.

Queries video analytics incidents, alerts, metrics, and sensor data from Elasticsearch via the VA-MCP server.

AWS infrastructure management — EKS, ECR, VPC, RDS, ElastiCache, S3, Route53, ACM, Secrets Manager, CloudWatch, IAM

Detect insider threats by modeling normal user and entity behavior with Elasticsearch, computing anomaly scores, and correlating low-confidence indicators into high-confidence alerts.

安全专家入口。用于 Codex CLI 的 $expert-security 调用。 适用于威胁建模、漏洞评估、安全代码审查、安全架构设计、DevSecOps、安全运营、事件响应、合规审计和完整安全健康评估。 触发词：安全专家、威胁建模、STRIDE、OWASP、SAST、DAST、SBOM、漏洞评估、代码审计、事件响应、合规审计、SOC、等保、GDPR、PIPL、隐私政策审查

Secure Laravel applications with best practices for authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and deployment configurations.

Expert knowledge for Azure Elastic SAN development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when creating iSCSI volumes, AVS datastores, snapshots, CMK encryption, or AKS-integrated workloads, and other Azure Elastic SAN related development tasks. Not for Azure NetApp Files (use azure-netapp-files), Azure Managed Lustre (use azure-managed-lustre), Azure Container Storage (use azure-container-storage), Azure Virtual Machines (use azure-virtual-machines).

ES|QL Query Skill

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Exploit misconfigured Active Directory Certificate Services ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.

Implements layered security for Flutter apps: code obfuscation, certificate pinning, secure storage, encryption, biometric authentication, and root/jailbreak detection.

Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline.

Audit Solidity smart contracts for reentrancy, oracle manipulation, token decimals, SafeERC20, ERC-4626 inflation, infinite approvals, and MEV vulnerabilities with a pre-deployment checklist.

Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.

Implement AES-256-GCM encryption for files and data at rest, including key derivation, IV management, and authenticated encryption.

Provides expert-level guidance on implementing and applying app security concepts, including design, optimization, debugging, and best practices.

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Enforce idiomatic Kotlin conventions for null safety, immutability, sealed classes, coroutines, extension functions, DSL builders, and Gradle Kotlin DSL.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Provides a pre-deployment security checklist for OAuth-connected apps and external client apps, covering configuration, token policies, access control, and compliance.

Implements or verifies the six-layer type safety chain from Drizzle schema through Zod, services, API routes, and React hooks, including regeneration after DB changes and bootstrapping in new folders.

Supply-chain malware infection scanner. IoC-based local scan + safe eradication for npm/PyPI worm campaigns (Mini Shai-Hulud 1st/2nd, S1ngularity, lottie-player). Detects OS persistence (LaunchAgent/systemd), IDE-hook implants (.claude/.vscode/.github/workflows), lockfile-pinned malicious versions, and known C2/Session-Protocol exfil traces. Orchestrates credential rotation in the correct order so revocation does not trigger the `rm -rf ~/` retaliation payload. Don't use for static SAST (Sentinel), skill/MCP/`.claude/` supply-chain audit (Chain), Sigma/YARA rule authoring (Vigil), or incident coordination (Triage).

Train reinforcement learning agents using PPO, SAC, DQN, TD3, DDPG, and A2C algorithms with a scikit-learn-like API. Supports custom Gymnasium environments, vectorized environments, callbacks, and model persistence.

Use this skill when the user asks about cybersecurity for a trucking carrier — protecting ELD data, customer information, financial systems, EDI integrations, fleet telematics, ransomware risk, vendor / shipper data sharing, incident response, and FMCSA cyber-recommendations. Reference NIST + CISA cybersecurity frameworks.

Regex/parser/DSL design specialist for grammar authoring and ReDoS-safe regex. Not for REST APIs (Gateway) or DB schemas (Schema).

Design and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.

Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.

Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant data protection, automating backup creation, integrity verification, snapshot retention, and restore testing.

Enforces idiomatic Kotlin conventions across null safety, immutability, sealed hierarchies, coroutines, extension functions, DSL builders, and Gradle Kotlin DSL.

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.

Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly escalate privileges across the entire AD environment.