Security

Broken access control - IDOR, privilege escalation, JWT abuse, mass assignment, forced browsing - for web apps and APIs.

Manage Boat (boat.dev, formerly Box by Ascii) cloud sandboxes via API, CLI, and SSH.

Reporting phase — generate structured pentest report from findings.

Maintenance of the nu-validator coverage benchmark: defend the invariants (nu-only = 0, xref audit green), follow up a nu-validator upstream update (submodule…

Triage one nu-only fixture from tests/external/snapshots/diff/nu-only.json by reading the spec, then drive its verdict to match-error, match-clean, or nu-over…

Sync benchmark cross-reference blocks onto GitHub Issue bodies via `yarn bench:xref`, manage `tests/external/bench/issue-xref.config.ts` mappings, and run the…

Use when doing ANY task involving Supabase.

Configure Claude Code authentication for Cyrus — API key, OAuth token, or third-party provider.

Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases.

Prepare R packages for CRAN submission by checking for common ad-hoc requirements not caught by devtools::check().

API security testing — OWASP API Top 10, BOLA/IDOR chains, mass assignment, excessive data exposure, rate limiting.

Engagement-level methodology reference — PTES/OWASP/NIST/OSSTMM mapping, rules of engagement, legal boundaries, evidence handling, cleanup.

Security advisory feed package for OpenClaw-related threats and vulnerabilities.

Operate SonarQube-enabled repositories through the SonarQube CLI (`sonar`): verify authentication, discover project keys, inspect project metadata, issues…

Use before any repository task governed by RabiRoute plan admission, including bug fixes, features, UI, assets, config, data, docs, prompts, skills, builds…

Prepare, audit, or revise Nature-ready Data Availability statements, data repository plans, dataset citations, and FAIR metadata checklists for manuscripts.

Draft, audit, or revise point-by-point reviewer response letters for Nature-family manuscript revisions.

Automatically plan, draft, and compliance-check a complete evidence-grounded rebuttal from a confirmed baseline.

Run Git and GitHub CLI commands on the host when sandboxing blocks Keychain auth, network access, or .git writes.

Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026)…

CUMCM 国赛、MCM/ICM 美赛与电工杯数学建模竞赛的端到端协作工作流。Use when a user explicitly works on one of these modeling contests or asks to run/review a modeling-competition paper…

External-audit role for arcgentic rounds.

Audit the instructions an agent already carries — CLAUDE.md, AGENTS.md, skills, tool descriptions — for contradictions, over-constraint, and duplication, then…

Fix a reported bug with a regression test that demonstrably fails on the original behavior and passes after the fix.