Results for “security-properties”

Use this skill for property tests for parsers, validators, transforms, state machines, edge cases. Trigger when the task involves programming work related to Property Based Testing, implementation, audits, debugging, strategy, or validation.

Review protected asset policy and risky local data surfaces.

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

Route security, compliance, privacy, crypto/Web3, framework security, vulnerability review, and risk prompts. Use when prompts mention security-review, security scans, bounty hunting, HIPAA, PHI, compliance, Web3 risk, smart contracts, x402, LLM trading risk, or framework-specific security.

Provides guidance for property-based testing across multiple languages and smart contracts, helping detect patterns where PBT offers stronger coverage than example-based tests.

Provides canonical MSBuild property definition patterns including conditional defaults, composition, path normalization, target framework detection, and evaluation order for diagnosing and fixing property issues in .props and .csproj files.

Scans agent skills for security issues including prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Models threats for a service, feature, endpoint, integration, or architecture: assets, attackers, boundaries, flows, and abuse cases.

Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations. Use when the user needs a scoped security posture review; use the SAST, DAST, dependency-scanning, or threat-modeling skill when the request is limited to one specialist activity.

Security Practices — Cryptographic Safety, Memory Zeroization & Hardened I/O

Implements layered security for Flutter apps: code obfuscation, certificate pinning, secure storage, encryption, biometric authentication, and root/jailbreak detection.

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.

Security Review

Routes security, compliance, and threat-intelligence tasks to specialized sub-skills for threat modeling, penetration testing, incident response, and vulnerability scanning.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Run the Legal Builder Hub security-review gate on a candidate legal skill — inspect its manifest and body for unsafe behavior before any install is allowed.

Security Craft

Use this skill for auth boundaries, input validation, secrets, RLS, injection risks, destructive-action review. Trigger when the task involves security work related to Security Hardening, production implementation, audits, debugging, strategy, or validation.

One breach = game over. Threat modeling, OWASP Top 10, secure coding, security architecture, zero trust. The complete security skill for protecting your application from day one. Security isn't a feature you add later - it's a mindset that shapes every decision. This skill covers application security, not infrastructure security. Use when "security, owasp, xss, sql injection, csrf, authentication, authorization, secrets, api key, vulnerability, secure coding, security headers, rate limiting, input validation, sanitize, escape, security, owasp, authentication, authorization, vulnerabilities, secure-coding" mentioned.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Assess cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Chief Security Officer mode. (gstack)

Secure Quarkus applications with authentication, authorization, input validation, and secrets management best practices.

Guidance on security analysis, compliance auditing, and vulnerability assessment techniques relevant to legal and regulatory compliance tasks

Provides a comprehensive security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data exposure.

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

Enhance and standardize a property listing photo with auto-contrast, sharpening, and consistent sizing.

Analyzes email security including phishing dissection, SPF/DKIM/DMARC authentication checks, BEC fraud patterns, and OAuth token abuse research for authorized reviews.

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.