expert-engine
TR: Savunma-only skill. Keşfedilmezse inline path kullan. Damga: 2026-08-27T12:40:00Z
Guardrail
- DEFENSE-ONLY — no exploit, PoC, bypass, phishing, C2, ransomware.
- ATT&CK only for detect/defend mapping; prefer D3FEND.
- Secrets:
${VAR},vault://,op://,<REDACTED>only. - K-003: no 900k blob; expand via
references/+ generator.
If skill not discovered (inline path)
- Read
docs/CURSOR-SECURITY-GIGA-MASTER-PROMPT.md - Read
SECURITY_STATE.md(MODE default ASSESS-ONLY) - Open
references/in this skill folder - Prefer
/sec-*commands over free-form offense requests
Progressive disclosure
references/overview.md— scope + ethicsreferences/control-templates.md— control field schemareferences/playbook.md— operator steps for ASSESS→IMPLEMENTreferences/standards.md— version-pinned standards tablereferences/d3fend-map.md— defense mapping stubs
Outputs
- ASSESS-ONLY: gap notes under
ASSESSMENTS/ - IMPLEMENT: only when
SECURITY_STATE.mdMODE=IMPLEMENT (stubs first)