# Adversarial Security

> Subagent Scope Guard

- Skill: `gonzalezpazmonica/adversarial-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add gonzalezpazmonica/adversarial-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gonzalezpazmonica/adversarial-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gonzalezpazmonica (https://skillmd.com/u/gonzalezpazmonica)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/gonzalezpazmonica/adversarial-security

---


## Subagent Scope Guard

> If you were dispatched as a subagent to execute a specific delegated task,
> **skip this skill's full orchestration workflow**. Execute only the assigned
> task, report result (DONE / DONE_WITH_CONCERNS / BLOCKED), and return.
> This guard prevents runaway skill activation in nested agent contexts.

# Adversarial Security Skill

## §0 Prerequisitos (gate de arranque)

```
Doble opt-in (SPEC-186):                     → si no: ❌ ABORT
  bash scripts/savia-double-optin-check.sh \
    --skill adversarial-security --confirm-autonomous
Requiere AMBOS: ADVERSARIAL_SECURITY_ENABLED=true Y flag explicito.
```

## §1 Vulnerability Scoring

**CVSS simplificado para proyectos internos**:

| Factor | Peso | Valores |
|--------|------|---------|
| Attack Vector | 0.3 | Network (1.0), Adjacent (0.7), Local (0.5), Physical (0.2) |
| Complexity | 0.2 | Low (1.0), High (0.5) |
| Privileges | 0.2 | None (1.0), Low (0.6), High (0.3) |
| Impact | 0.3 | High (1.0), Medium (0.6), Low (0.3) |

score = sum(factor × peso) × 10 → escala 0-10

## §2 STRIDE Mapping

| Categoría | Pregunta clave | Controles típicos |
|-----------|---------------|-------------------|
| Spoofing | ¿Puedo suplantar a otro? | Auth, MFA, tokens |
| Tampering | ¿Puedo modificar datos? | Integridad, signing, HMAC |
| Repudiation | ¿Puedo negar una acción? | Audit logs, timestamps |
| Info Disclosure | ¿Puedo acceder a datos? | Encryption, access control |
| DoS | ¿Puedo tumbar el servicio? | Rate limiting, WAF |
| Elevation | ¿Puedo escalar privilegios? | RBAC, least privilege |

## §3 OWASP Top 10 Checklist

1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable Components
7. Auth Failures
8. Software/Data Integrity Failures
9. Logging Failures
10. SSRF

## §4 Dependency Audit

```bash
# npm: audit de dependencias
npm audit --json 2>/dev/null | jq '.vulnerabilities | length'
# pip: safety check
pip-audit --format=json 2>/dev/null
# dotnet: audit
dotnet list package --vulnerable --format json 2>/dev/null
```

## §5 Security Score Formula

score = 100 - (critical×25 + high×10 + medium×3 + low×1)
Cada fix verificado recupera los puntos. Floor: 0.