Results for “security”

Scan a codebase or selected changes for security issues, then request targeted patch files for findings. Independent agents verify reported issues and proposed fixes, while you review and apply patches yourself.

• Auditing an entire repository or a selected area
• Checking security issues in branch or pull request changes
• Scanning a single commit

Turn identified threats and business needs into specific, testable security requirements. Define priorities, explain the rationale, and develop security user stories, acceptance criteria, and test cases linked to the risks they address.

• Turn threat models into security requirements
• Write security user stories and acceptance criteria
• Develop security test cases

Analyze ModSecurity, AWS WAF, and Cloudflare logs for SQL injection, attempts to manipulate database queries through web requests. Groups related requests, tracks source IPs, classifies attack methods, and produces incident reports.

• Investigating suspected SQL injection attempts
• Tracking repeated attacks from the same source
• Connecting requests across an attack campaign

Checks application code, dependencies, and security controls to identify vulnerabilities and plan fixes. Includes Python scanners, reports, incident response workflows, and guidance for adding security checks to CI/CD, the automated build and deployment process.

• Checking code for exposed secrets and injection risks
• Prioritizing fixes for known dependency vulnerabilities
• Adding security checks to CI/CD pipelines

Retrieve security findings from Google Cloud Security Command Center for initial assessment. Filter active vulnerabilities, threats, and external exposures, inspect one finding’s full details, or group counts by category to understand the reported risks.

• Retrieving full details for a named security finding
• Listing active vulnerabilities or external exposures
• Summarizing active finding counts by category

Run repeated, independent security reviews of an entire repository or a selected directory. The skill combines validated findings and coverage records into a final report, helping reduce variation between individual reviews.

• Reviewing an entire repository through repeated security audits
• Running an intensive review of a selected directory
• Combining validated findings and coverage into one report

Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.

• Find structural causes shared by several vulnerabilities
• Compare security architecture options and costs
• Explain proposed changes with before-and-after diagrams

Run repeated, independent security audits of a repository or selected directory with Codex Security. It combines validated findings into a report that records the reviewed scope, exclusions, and any incomplete coverage.

• Run repeated security audits across a repository
• Audit a specific directory
• Combine validated findings from independent scans

Turn validated Codex Security findings into tracked issues in Linear, Jira, or GitHub, or draft GitHub security advisories. Checks duplicates and visibility, previews exact changes for approval, and verifies results after writing.

• Create issues for validated security findings
• Check whether a finding is already tracked
• Register a reviewed batch of findings

Establish a security baseline for a website or web app. Use this skill when configuring HTTPS and TLS, setting security headers, planning secrets management, evaluating CSP policies, doing a basic security audit, or hardening a site before launch. Triggers on security headers, HTTPS, TLS, CSP, content security policy, HSTS, secrets management, vulnerability scan, security audit, harden, OWASP, security baseline. Also triggers when a security review is required for compliance or before going live.

The English summary is being prepared. Showing the original description.

Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of Plinth Toolkit

The English summary is being prepared. Showing the original description.

Translate technical security work into the language of non-security audiences — board, executives, engineering, customer success, customers, legal, procurement, sales. Covers incident communication, post-mortem narrative, audit-findings-for-stakeholders, risk justification, security spend justification, and customer-facing breach disclosure. Use when the user mentions 'security comms,' 'communicate this finding,' 'explain to my boss,' 'board update,' 'executive summary,' 'incident communication,' 'breach notification,' 'customer disclosure,' 'security memo,' 'post-mortem narrative,' 'risk justification,' 'why this matters to the business,' 'translate this finding,' 'stakeholder update,' or has technical security work that needs to land with a non-security audience.

The English summary is being prepared. Showing the original description.

Use when identifying cybersecurity-specific regulations and incident reporting obligations. Covers NIS2, DORA, SEC cyber disclosure rules, CISA incident reporting, state breach notification laws, cyber insurance requirements, and security certification frameworks. USE FOR: NIS2, DORA, SEC cybersecurity rules, CISA, breach notification, incident reporting, SOC 2, ISO 27001, cyber insurance, FedRAMP, StateRAMP, CMMC, data breach response DO NOT USE FOR: implementing security controls (use security skills), security testing tools (use security/security-testing), general data privacy (use privacy-data-protection)

The English summary is being prepared. Showing the original description.

Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.

The English summary is being prepared. Showing the original description.

Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).

The English summary is being prepared. Showing the original description.

Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of cursor-rules-java project

The English summary is being prepared. Showing the original description.

Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).

The English summary is being prepared. Showing the original description.

Presents a risk framework for every configurable security control in NemoClaw. Use when evaluating security posture, reviewing sandbox security defaults, or assessing control trade-offs. Trigger keywords - nemoclaw security best practices, sandbox security controls risk framework, nemoclaw credential storage, credentials.json, api key security, openclaw security controls, nemoclaw security boundary, prompt injection, tool access control.

The English summary is being prepared. Showing the original description.

Guides Kubernetes security configuration with network restrictions, Pod execution rules, and role-based access control. Use its configuration examples to separate workloads, limit permissions, and enforce deployment requirements across a cluster.

• Restricting communication between application components
• Giving ServiceAccounts only the permissions they need
• Running Pods with restricted privileges

Configure GitHub Dependabot to keep dependencies, the packages a project relies on, updated. Organize update pull requests into groups, set schedules and exclusion rules, and configure security updates across projects with multiple packages or package systems.

• Create or revise dependabot.yml
• Group dependency updates into fewer pull requests
• Configure updates across a monorepo

Assess Bluetooth Low Energy devices by capturing wireless traffic, inspecting available data services, and checking pairing security. Identify signs of interception, reused commands, and data access that lacks authentication.

• Assess BLE security on IoT devices
• Check whether devices accept replayed commands
• Investigate suspicious pairing and device impersonation

Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.

• Investigating suspicious logins across multiple log sources
• Reconstructing an incident timeline
• Tracing suspicious processes and outbound traffic

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

• Define the assessment scope for systems handling controlled information
• Calculate an SPRS score and prioritize unmet security requirements
• Prepare security plans, remediation milestones, and assessment evidence

Review Python, JavaScript/TypeScript, and Go code for security issues using guidance for the project's languages and frameworks. Get prioritized findings, suggested improvements, or help writing new code with safer defaults.

• Review an existing application's security
• Create a report organized by severity
• Write new code with safer defaults