Results for “security-boundaries”

Builds and queries multi-language source code graphs for security analysis, including blast radius, taint propagation, privilege boundaries, and entry point enumeration.

`analysis-agent`/`task-agent`/`review-agent`: use for changed assets, trust boundaries, reachable abuse paths, impact, or control placement; skip without a security delta.

Use this skill when reviewing Model Context Protocol (MCP) servers, clients, connectors, tool manifests, hosted MCP deployments, OAuth flows, prompt/tool boundaries, or MCP marketplace choices for security, least privilege, data exposure, prompt injection, and destructive-action risk.

Use `analysis-agent` to analyze permissions, secrets, sensitive data, trust boundaries, and injection; `task-agent` to implement controls; and `review-agent` to assess evidence. Skip self-review and no-trust-impact work.

Audits Rust codebases for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

Resolves legacy references to the security-guardian capability by routing to the current runtime equivalent.

Use when symbolic mathematics must cross into NumPy vector evaluation or SciPy numerical algorithms: lambdify contracts, domains, dtypes, parameters, residuals, tolerances, and symbolic-versus-numeric verification. Do not use for work confined entirely to one of those libraries.

Configure and deploy HashiCorp Boundary for identity-aware zero trust infrastructure access with dynamic credential brokering, session recording, and Vault integration.

A validation *boundary* is any point where data crosses from a system you do not

Design and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.

AI safety and responsible AI practices

Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.

Assess cloud configuration risks including IAM privilege escalation, public storage exposure, network over-permissioning, and infrastructure-as-code misconfigurations.

Laravel 安全最佳实践，涵盖认证/授权、验证、CSRF、批量赋值、文件上传、密钥、速率限制和安全部署。

Use this when the system needs clear analysis of trusted versus untrusted execution contexts, external inputs, client/server boundaries, provider callbacks, or admin-level code paths. Trigger on requests about trust boundaries, attack surfaces, or where verification must happen.

Reviews authorization, tenant isolation, roles, ownership, row access, admin boundaries, sharing, and privilege escalation.

Detects scope creep in client requests and drafts a polite, firm boundary reply with a change-order option.

Decide which work is safe to delegate to worker agents. Use before delegating tasks that may require user interaction, approval, authentication, external writes, or shared-state mutation.

Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.

Route security, compliance, privacy, crypto/Web3, framework security, vulnerability review, and risk prompts. Use when prompts mention security-review, security scans, bounty hunting, HIPAA, PHI, compliance, Web3 risk, smart contracts, x402, LLM trading risk, or framework-specific security.

Enforces bulk-safety rules, sharing model requirements, CRUD/FLS security, SOQL injection prevention, PNB test coverage, and modern Apex idioms for Salesforce development.

Perform language and framework-specific security best-practice reviews, write secure-by-default code, and generate prioritized vulnerability reports with suggested fixes.

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes in API designs, configuration schemas, and cryptographic library ergonomics.

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.

Guides implementing authentication, authorization, input validation, and OWASP Top 10 prevention with secure code patterns and validation checkpoints.

Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.

Implements AI safety guardrails including input validation, output filtering, robustness testing, human oversight, and monitoring to prevent harmful outputs and ensure system reliability.

Use this when reviewing a feature, service, API, auth design, integration, job system, or deployment plan for security weaknesses, unsafe trust assumptions, input risks, or privilege issues.

Deliberately disables or degrades security controls to verify detection and response capabilities, including WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess.

Adds input and output guardrails to an agent, including validation, content filtering, domain scoping, and rate limiting, with TypeScript examples and wiring instructions.