Agent Skills

Secure APIs: input validation, rate limiting, CORS, HMAC signing, API key management, mutual TLS, and OWASP API Security Top 10.

Checks

Metadata only

Evidence

1 source

Apply CIS Benchmarks for hardening Linux, Docker, and Kubernetes: baseline scanning with kube-bench, InSpec, and OpenSCAP.

Checks

Metadata only

Evidence

1 source

Conduct systematic code reviews covering logic, security, performance, readability, and test coverage with structured feedback.

Checks

Metadata only

Evidence

1 source

Scan container images for vulnerabilities with Trivy/Grype, enforce policies with OPA/Kyverno, and sign images with Cosign.

Checks

Metadata only

Evidence

1 source

Configure CSP, HSTS, X-Frame-Options, Permissions-Policy, and Subresource Integrity headers to harden web application security.

Checks

Metadata only

Evidence

1 source

Audit npm, pip, and cargo dependencies: CVE scanning, SBOM generation, license compliance, automated PRs with Renovate/Dependabot.

Checks

Metadata only

Evidence

1 source

Design CI/CD pipelines with build, test, security scan, staging, and production promotion stages using GitHub Actions or similar.

Checks

Metadata only

Evidence

1 source

Gather context, classify threats, document findings, create cases, and acknowledge Elastic Security alerts with explicit operator review.

Checks

Metadata only

Evidence

1 source

Implement privacy-by-design: data minimization, consent management, right-to-erasure workflows, and DPIA documentation.

Checks

Metadata only

Evidence

1 source

Audit and implement GDPR compliance: lawful basis, data subject rights, consent management, DPIAs, and breach notification.

Checks

Metadata only

Evidence

1 source

Review a Google Cloud architecture against the security pillar of the Well-Architected Framework and turn findings into prioritized actions.

Checks

Metadata only

Evidence

1 source

Implement secure JWT: short-lived access tokens, rotating refresh tokens, JWK rotation, token revocation, and PKCE for SPAs.

Checks

Metadata only

Evidence

1 source

Implement OAuth 2.0 and OpenID Connect flows: authorization code with PKCE, refresh tokens, JWK rotation, and client credential grants.

Checks

Metadata only

Evidence

1 source

Mitigate OWASP Top 10 vulnerabilities: injection, broken auth, XSS, CSRF, SSRF, insecure deserialization, and security misconfiguration.

Checks

Metadata only

Evidence

1 source

Apply OWASP Testing Guide methodology: reconnaissance, enumeration, exploitation, privilege escalation, and responsible disclosure.

Checks

Metadata only

Evidence

1 source

Defend LLM applications against prompt injection: input sanitization, output validation, tool-call allowlisting, and sandboxing.

Checks

Metadata only

Evidence

1 source

Produce repository-grounded threat models covering assets, trust boundaries, attacker capabilities, abuse paths, and actionable mitigations.

Checks

Metadata only

Evidence

1 source

Detect leaked secrets with gitleaks/trufflehog, rotate compromised credentials, and set up pre-commit secret scanning hooks.

Checks

Metadata only

Evidence

1 source

Audit and implement secrets management with environment variables, secret stores, rotation policies, and zero-secret-in-code patterns.

Checks

Metadata only

Evidence

1 source

Integrate security throughout SDLC: threat modeling, SAST/DAST in CI, security code review, dependency scanning, and shift-left practices.

Checks

Metadata only

Evidence

1 source

Systematically identify injection flaws, broken auth, IDOR, secrets exposure, and dependency vulnerabilities in web projects.

Checks

Metadata only

Evidence

1 source

Harden software supply chain: Sigstore signing, SLSA provenance, reproducible builds, artifact attestations, and Cosign verification.

Checks

Metadata only

Evidence

1 source

Implement zero trust networking: mutual TLS, service mesh (Istio/Linkerd), identity-aware proxies, and least-privilege access policies.

Checks

Metadata only

Evidence

1 source