ccc-security
Load ONE skill. Get the entire application security domain. From proactive auditing to reactive incident response, with AI-specific defenses included.
Sub-Skills
| # |
Skill |
Command |
Description |
| 1 |
security-audit |
/security-audit |
Comprehensive security audit — SAST, DAST, manual review |
| 2 |
prompt-injection-defense |
/prompt-injection-defense |
Defend AI-powered apps against prompt injection attacks |
| 3 |
dependency-audit |
/dependency-audit |
Audit npm/pip/cargo dependencies for known vulnerabilities |
| 4 |
secrets-scanner |
/secrets-scanner |
Scan codebase for hardcoded secrets, API keys, tokens |
| 5 |
owasp-top-10 |
/owasp-top-10 |
Check application against OWASP Top 10 vulnerabilities |
| 6 |
codeql-integration |
/codeql-integration |
Set up CodeQL for automated security analysis in CI |
| 7 |
variant-analysis |
/variant-analysis |
Find variants of known vulnerabilities across codebase |
| 8 |
incident-response |
/incident-response |
Security incident response playbook and remediation |
How To Use
Step 1: Tell me what security concern you have or what you want to audit.
Step 2: I'll confirm the scope (specific files, entire repo, specific vulnerability class) and your tech stack before routing.
Step 3: The specialist skill handles the work. You get comprehensive security coverage without loading 8 separate skills.
Routing Matrix
| Your Intent |
Route To |
Don't Confuse With |
| "Audit my app for security issues" / "Security review" |
security-audit |
owasp-top-10 (specific checklist, not full audit) |
| "Protect against prompt injection" / "AI safety" |
prompt-injection-defense |
security-audit (general, not AI-specific) |
| "Check my dependencies" / "npm audit" / "Are my packages safe?" |
dependency-audit |
secrets-scanner (credentials, not packages) |
| "Find hardcoded secrets" / "API keys in code" |
secrets-scanner |
dependency-audit (packages, not credentials) |
| "OWASP compliance" / "Top 10 vulnerabilities" |
owasp-top-10 |
security-audit (broader than OWASP) |
| "Set up CodeQL" / "Automated security scanning in CI" |
codeql-integration |
security-audit (manual review, not CI automation) |
| "Find similar bugs" / "This vulnerability might exist elsewhere" |
variant-analysis |
codeql-integration (setup, not analysis) |
| "We've been breached" / "Security incident" / "Respond to attack" |
incident-response |
security-audit (prevention, not response) |
Campaign Templates
Pre-Launch Security Review
secrets-scanner -> find and remove any hardcoded credentialsdependency-audit -> check all dependencies for known CVEsowasp-top-10 -> verify against OWASP Top 10 checklistsecurity-audit -> comprehensive manual review of auth, authz, input validationcodeql-integration -> set up automated scanning for ongoing protection- Deliver: security clearance report with all findings addressed and CI scanning active
AI Application Security
prompt-injection-defense -> harden all LLM-facing inputs and outputssecrets-scanner -> verify API keys for AI services are not exposedsecurity-audit -> review data flow between user input, LLM, and actionsowasp-top-10 -> standard web security around the AI features- Deliver: AI-hardened application with injection defenses and secure API key management
Incident Response
incident-response -> activate response playbook, contain the threatsecrets-scanner -> identify all potentially compromised credentialsvariant-analysis -> find related vulnerabilities the attacker may have exploitedsecurity-audit -> full post-incident audit to prevent recurrencecodeql-integration -> add detection rules for the vulnerability class- Deliver: incident resolved, credentials rotated, codebase hardened, CI rules added
Continuous Security Pipeline
codeql-integration -> set up CodeQL in GitHub Actionsdependency-audit -> configure automated dependency scanning (Dependabot/Snyk)secrets-scanner -> add pre-commit hooks for secret detectionowasp-top-10 -> create security test suite for CI- Deliver: automated security pipeline that catches issues before they reach production
Severity Classification
| Severity |
Response Time |
Examples |
| CRITICAL |
Immediate |
Hardcoded production secrets, RCE, SQL injection, active breach |
| HIGH |
Same day |
Authentication bypass, SSRF, insecure deserialization |
| MEDIUM |
This sprint |
XSS, CSRF, missing rate limiting, verbose error messages |
| LOW |
Backlog |
Information disclosure, missing security headers, weak algorithms |
Context Strategy
This CCC domain uses on-demand loading. Sub-skills have disable-model-invocation: true so they only load when explicitly invoked, keeping your context lean.
1---2name: ccc-security3description: CCC domain — complete security ecosystem — 8 skills in one. Security audits, prompt injection defense, dependency audits, secrets scanning, OWASP Top 10, CodeQL, variant analysis, and incident response.4---56# ccc-security78> Load ONE skill. Get the entire application security domain. From proactive auditing to reactive incident response, with AI-specific defenses included.910## Sub-Skills1112| # | Skill | Command | Description |13|---|-------|---------|-------------|14| 1 | security-audit | `/security-audit` | Comprehensive security audit — SAST, DAST, manual review |15| 2 | prompt-injection-defense | `/prompt-injection-defense` | Defend AI-powered apps against prompt injection attacks |16| 3 | dependency-audit | `/dependency-audit` | Audit npm/pip/cargo dependencies for known vulnerabilities |17| 4 | secrets-scanner | `/secrets-scanner` | Scan codebase for hardcoded secrets, API keys, tokens |18| 5 | owasp-top-10 | `/owasp-top-10` | Check application against OWASP Top 10 vulnerabilities |19| 6 | codeql-integration | `/codeql-integration` | Set up CodeQL for automated security analysis in CI |20| 7 | variant-analysis | `/variant-analysis` | Find variants of known vulnerabilities across codebase |21| 8 | incident-response | `/incident-response` | Security incident response playbook and remediation |2223## How To Use2425**Step 1:** Tell me what security concern you have or what you want to audit.2627**Step 2:** I'll confirm the scope (specific files, entire repo, specific vulnerability class) and your tech stack before routing.2829**Step 3:** The specialist skill handles the work. You get comprehensive security coverage without loading 8 separate skills.3031## Routing Matrix3233| Your Intent | Route To | Don't Confuse With |34|-------------|----------|--------------------|35| "Audit my app for security issues" / "Security review" | `security-audit` | `owasp-top-10` (specific checklist, not full audit) |36| "Protect against prompt injection" / "AI safety" | `prompt-injection-defense` | `security-audit` (general, not AI-specific) |37| "Check my dependencies" / "npm audit" / "Are my packages safe?" | `dependency-audit` | `secrets-scanner` (credentials, not packages) |38| "Find hardcoded secrets" / "API keys in code" | `secrets-scanner` | `dependency-audit` (packages, not credentials) |39| "OWASP compliance" / "Top 10 vulnerabilities" | `owasp-top-10` | `security-audit` (broader than OWASP) |40| "Set up CodeQL" / "Automated security scanning in CI" | `codeql-integration` | `security-audit` (manual review, not CI automation) |41| "Find similar bugs" / "This vulnerability might exist elsewhere" | `variant-analysis` | `codeql-integration` (setup, not analysis) |42| "We've been breached" / "Security incident" / "Respond to attack" | `incident-response` | `security-audit` (prevention, not response) |4344## Campaign Templates4546### Pre-Launch Security Review471. `secrets-scanner` -> find and remove any hardcoded credentials482. `dependency-audit` -> check all dependencies for known CVEs493. `owasp-top-10` -> verify against OWASP Top 10 checklist504. `security-audit` -> comprehensive manual review of auth, authz, input validation515. `codeql-integration` -> set up automated scanning for ongoing protection526. Deliver: security clearance report with all findings addressed and CI scanning active5354### AI Application Security551. `prompt-injection-defense` -> harden all LLM-facing inputs and outputs562. `secrets-scanner` -> verify API keys for AI services are not exposed573. `security-audit` -> review data flow between user input, LLM, and actions584. `owasp-top-10` -> standard web security around the AI features595. Deliver: AI-hardened application with injection defenses and secure API key management6061### Incident Response621. `incident-response` -> activate response playbook, contain the threat632. `secrets-scanner` -> identify all potentially compromised credentials643. `variant-analysis` -> find related vulnerabilities the attacker may have exploited654. `security-audit` -> full post-incident audit to prevent recurrence665. `codeql-integration` -> add detection rules for the vulnerability class676. Deliver: incident resolved, credentials rotated, codebase hardened, CI rules added6869### Continuous Security Pipeline701. `codeql-integration` -> set up CodeQL in GitHub Actions712. `dependency-audit` -> configure automated dependency scanning (Dependabot/Snyk)723. `secrets-scanner` -> add pre-commit hooks for secret detection734. `owasp-top-10` -> create security test suite for CI745. Deliver: automated security pipeline that catches issues before they reach production7576## Severity Classification7778| Severity | Response Time | Examples |79|----------|--------------|---------|80| CRITICAL | Immediate | Hardcoded production secrets, RCE, SQL injection, active breach |81| HIGH | Same day | Authentication bypass, SSRF, insecure deserialization |82| MEDIUM | This sprint | XSS, CSRF, missing rate limiting, verbose error messages |83| LOW | Backlog | Information disclosure, missing security headers, weak algorithms |8485## Context Strategy8687This CCC domain uses on-demand loading. Sub-skills have `disable-model-invocation: true` so they only load when explicitly invoked, keeping your context lean.
KevinZai