4.8K skills · sorted by relevance
Coordinate Paperclip vulnerability response from confidential report review and private fixes to local testing, CVE identifier requests, advisory publication, and immediate security releases, with human assistance for reporter communication.
Review and strengthen security in claude-flow v3 by addressing dependency risks, password hashing, credential generation, input validation, file paths, and command execution. It also guides threat modeling and tests for security-critical code.
Review and strengthen security in claude-flow v3 by addressing dependency risks, password hashing, credential generation, input validation, file paths, and command execution. It also guides threat modeling and tests for security-critical code.
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
Match identified security threats with controls that prevent, detect, or help recover from attacks. Use the mappings to find coverage gaps, prioritize security spending, and create remediation plans with multiple layers of protection.
Investigate excessive privileges inside Kubernetes pods by reviewing security settings, runtime events, and audit logs. Use admission policies to restrict risky configurations and Falco monitoring to detect suspicious privilege changes and container activity.
Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.
Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.
Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.
Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.
Audit AWS, Azure, and GCP configurations against CIS Benchmarks, security configuration guidelines. Use automated scan results to identify failed checks, prioritize fixes, report compliance by area, and establish ongoing monitoring for configuration changes.
Analyze git history to map contributors to security-sensitive files, identify reliance on too few people, and find stale areas. Export CSV and JSON results for ownership reviews, graph exploration, and comparison with CODEOWNERS.
Analyze git history to map contributors to security-sensitive files, identify reliance on too few people, and find stale areas. Export CSV and JSON results for ownership reviews, graph exploration, and comparison with CODEOWNERS.
Implement an authorized fix for a reviewed security issue, check the plan against current code, and add regression tests to catch recurrence. Verify affected components and open a pull request that closes the issue while respecting disclosure rules.
Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.
Review pull requests, commits, branch differences, or local patches for security vulnerabilities. Inspect changed and deleted text files, trace relevant supporting code, and return validated findings, review comments, and a report describing coverage gaps.
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
Evaluate supplied security findings against repository code and security policy without running the software. Classify each claim as confirmed, not actionable, or needing review, then rank relevant findings by exploitability and explain evidence gaps and next steps.
Analyze git history to map contributors to security-sensitive files and identify ownership gaps. Estimate bus factor, a measure of dependence on few people, group files that change together, and export CSV or JSON for further analysis.
Run a quick code security review for exposed credentials, injection risks, unsafe page content, vulnerable dependencies, and authentication issues. Receive findings grouped by severity, with file locations and suggested fixes to prioritize remediation.
Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".
The English summary is being prepared. Showing the original description.
Migrate Spring Security 5 to Spring Security 6 configuration. Use when removing WebSecurityConfigurerAdapter, replacing @EnableGlobalMethodSecurity with @EnableMethodSecurity, converting antMatchers to requestMatchers, or updating to lambda DSL configuration style. Covers SecurityFilterChain beans and authentication manager changes.
The English summary is being prepared. Showing the original description.
LLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain, and AI red teaming for authorized assessments
The English summary is being prepared. Showing the original description.
Use when you need to design, review, or improve security in Quarkus applications — including Quarkus Security with JWT/OIDC, basic auth, @RolesAllowed / @Authenticated / @PermitAll, SecurityIdentity, permission checks, path-based authorization in configuration, exception mapping for auth failures, and sensitive-data-safe logging. This should trigger for requests such as Add Quarkus security support; Review Quarkus security configuration; Improve API authorization in Quarkus; Add JWT/OIDC security in Quarkus; Harden Quarkus authorization rules. Part of Plinth Toolkit
The English summary is being prepared. Showing the original description.