33 skills · sorted by relevance
Review HTTP response headers and restrict browser features an application does not need, such as camera, microphone, and location access. Guide Permissions-Policy settings that limit what attackers could use if the site is compromised.
Design layered protections for AI agents against malicious instructions, tool misuse, and data leakage. Provides guidance and code examples for input checks, isolated tool execution, permission limits, and audit logging to help review and strengthen agent security.
Map intrusion evidence to the seven stages of the Lockheed Martin Cyber Kill Chain, a model of attack progression. Show where defenses worked or missed activity, and recommend prioritized controls that could interrupt attacks earlier.
Validate at every layer data passes through to make bugs impossible
The English summary is being prepared. Showing the original description.
Systematic debugging frameworks for finding and fixing bugs - includes root cause analysis, defense-in-depth validation, and verification protocols
The English summary is being prepared. Showing the original description.
Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls. Use when building, deploying, or hardening agentic AI systems that invoke tools, access data, or interact with production infrastructure.
The English summary is being prepared. Showing the original description.
STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design. Use when conducting threat models, reviewing code for vulnerabilities, designing defense-in-depth, or scanning for hardcoded secrets.
The English summary is being prepared. Showing the original description.
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
The English summary is being prepared. Showing the original description.
Validate at every layer data passes through to make bugs impossible
The English summary is being prepared. Showing the original description.
Reduces attack surface across OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust principles. Use when hardening production infrastructure, meeting compliance requirements, or implementing defense-in-depth security.
The English summary is being prepared. Showing the original description.
Design comprehensive security architectures using defense-in-depth, zero trust principles, threat modeling (STRIDE, PASTA), and control frameworks (NIST CSF, CIS Controls, ISO 27001). Use when designing security for new systems, auditing existing architectures, or establishing security governance programs.
The English summary is being prepared. Showing the original description.
Configure host-based firewalls (iptables, nftables, UFW) and cloud security groups (AWS, GCP, Azure) with practical rules for common scenarios like web servers, databases, and bastion hosts. Use when exposing services, hardening servers, or implementing network segmentation with defense-in-depth strategies.
The English summary is being prepared. Showing the original description.
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement
The English summary is being prepared. Showing the original description.
Use when invalid data causes failures deep in execution, requiring validation at multiple system layers - validates at every layer data passes through to make bugs structurally impossible
The English summary is being prepared. Showing the original description.
Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.
The English summary is being prepared. Showing the original description.
Validate at every layer data passes through to make bugs impossible. Use when invalid data causes failures deep in execution, requiring validation at multiple system layers.
The English summary is being prepared. Showing the original description.
Implements CSRF protection using synchronizer tokens, double-submit cookies, and SameSite attributes. Use when securing web forms, protecting state-changing endpoints, or implementing defense-in-depth authentication.
The English summary is being prepared. Showing the original description.
REST API security hardening with authentication, rate limiting, input validation, security headers. Use for production APIs, security audits, defense-in-depth, or encountering vulnerabilities, injection attacks, CORS issues.
The English summary is being prepared. Showing the original description.
Apply security-conscious thinking when generating or modifying code. Enforces trust boundary awareness, input validation, injection prevention, secrets management, and defense-in-depth authorization. Use when generating code that handles user input, authentication, authorization, database queries, external APIs, or file operations, or when the user mentions 'security review', 'secure this', 'check for vulnerabilities', 'trust boundary', 'input validation', or 'OWASP'. Loaded automatically by the code-generating molecules (code-forge, refactor-safely, bug-fix). This skill governs the security posture of generated code -- not architecture (see architecture) and not code craft (see clean-code).
The English summary is being prepared. Showing the original description.
Validate at every layer data passes through to make bugs impossible
The English summary is being prepared. Showing the original description.
Implement layered collective defense using alarm signaling, role mobilization, and proportional response. Covers threat detection, alert propagation, immune response patterns, escalation tiers, and post-incident recovery for distributed systems and organizations. Use when designing defense-in-depth where no single guardian covers all threats, building incident response that scales with severity, or when current defense is over-reactive to every alert or under-reactive to genuine threats.
The English summary is being prepared. Showing the original description.
Validate at every layer data passes through to make bugs impossible
The English summary is being prepared. Showing the original description.
Multi-layer validation to catch bugs before they escape
The English summary is being prepared. Showing the original description.
Use when validation needs entry, business-logic, environment, and instrumentation guards so a bad value cannot reach the failure point — turns a local bug fix into a structural one.
The English summary is being prepared. Showing the original description.