Skills

Drafts accurate, well-supported answers to vendor security and compliance questionnaires (SIG, CAIQ, custom due-diligence forms). Maps each question to existing policies and control evidence, writes clear responses, and flags any question where the honest answer is unknown or a control is missing rather than overstating posture.

Finds, validates, and fixes security vulnerabilities end to end, going beyond audit-only review to produce verified patches. Reproduces the issue, proposes a minimal fix, and confirms the vulnerability is closed without breaking existing behavior. Models a CodeMender-style workflow where multiple agents detect, validate, and patch code security issues at scale.

Converts product safety requirements into practical agent and LLM policies with abuse cases, escalation paths, safe defaults, audit events, and acceptance criteria.

Simulates realistic adversarial behavior against AI features to uncover prompt injection, data exfiltration, unsafe tool use, jailbreak, and authorization failures before launch.

Reviews Model Context Protocol servers for excessive permissions, unsafe tool design, prompt injection exposure, secret handling, authorization gaps, and auditability.

Designs low-risk secret rotation for applications and agents, covering inventory, overlapping credentials, automation, audit evidence, emergency revocation, and rollback.

Reviews applications and data flows for common privacy-regulation obligations (GDPR, CCPA/CPRA). Maps what personal data is collected, where it flows, and how long it is retained; checks for lawful basis, consent handling, data-subject rights, and third-party sharing; and produces a prioritized remediation list. Provides engineering guidance, not legal advice.

Decodes and reviews JSON Web Tokens and their surrounding auth flow for correctness and security. Explains header and claims, checks algorithm and key handling, validates expiration and audience/issuer claims, and flags common pitfalls such as the alg:none attack, weak secrets, missing validation, and over-long token lifetimes. Never treats token contents as trusted secrets to echo back.

Plans authorized penetration tests for systems you own or are permitted to assess. Defines scope, rules of engagement, and objectives; maps the attack surface; structures phases (recon, mapping, exploitation, post-exploitation, reporting) around a framework like the OWASP Testing Guide or PTES; and specifies safe handling of findings. Emphasizes explicit authorization and non-destructive testing.

Generates and validates Software Bills of Materials in CycloneDX or SPDX formats. Covers dependency inventory, transitive resolution, license and vulnerability annotation, VEX statements, container image SBOMs, and CI integration for supply-chain compliance. Helps teams meet regulatory requirements and track what is actually shipped.

Scans code, configuration, and git history for leaked credentials such as API keys, tokens, private keys, and connection strings. Classifies findings by severity and false-positive likelihood, and provides safe remediation steps including rotation, history scrubbing, and pre-commit prevention.

Reviews cloud IAM policies for least-privilege violations, overly broad wildcards, privilege escalation paths, and risky trust relationships across AWS, GCP, and Azure. Explains the risk of each finding and rewrites policies to grant only the permissions actually needed.

Configures HTTP security headers to harden web applications. Covers Content-Security-Policy (including nonces and strict-dynamic), HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, and cookie flags. Produces server/CDN configuration, explains tradeoffs, and provides a rollout plan using report-only mode to avoid breakage.

Red-teams LLM applications for prompt injection, jailbreaks, and data exfiltration risks. Generates adversarial test cases for direct and indirect injection, system prompt leakage, tool-call abuse, and unsafe output handling, then reports findings with severity ratings and concrete mitigations such as input isolation, output filtering, and least-privilege tools.

Detects and redacts personally identifiable information (PII) and sensitive data from text, logs, and structured datasets. Recommends anonymization techniques such as masking, tokenization, pseudonymization, k-anonymity, and differential privacy, and generates reusable redaction code while preserving analytical utility and referential integrity.

Performs systematic threat modeling for software systems using frameworks like STRIDE, PASTA, and Attack Trees. Identifies potential security threats, attack vectors, and vulnerabilities in system architectures. Produces prioritized risk assessments with mitigation strategies and security controls.

Security-first AI agent skill auditing. Reviews skill definitions, SKILL.md files, and agent configurations for dangerous patterns, excessive permissions, data exfiltration risks, and suspicious behaviors before installation. Provides a safety score and actionable recommendations.

Audits project dependencies for security vulnerabilities, license compliance, maintenance status, and bundle size impact. Identifies outdated packages, suggests alternatives for abandoned libraries, and flags risky transitive dependencies.

Performs comprehensive security analysis of code and configurations. Identifies OWASP Top 10 vulnerabilities, insecure patterns, missing input validation, authentication flaws, and secrets exposure. Provides remediation steps with secure code examples.