Security

Optimize REA providers and shared analysis workflows for agent context, latency, CPU, and memory while preserving correctness and Evidence.

Audit REA CI and test suites for correctness, fixture drift, false passes, and measured performance; use for suite or workflow investigations and efficiency…

Review frontend code under `web/` or `packages/dify-ui/` when the user explicitly requests a review or audit.

Audit a design against Dieter Rams' ten "Good design is..." principles, then hand off a /make-plan prompt for one of three outcomes — new design, refine…

Map a codebase into feature-grouped flowcharts, identify duplicated concerns across features, and propose a unified architecture.

Conduct periodic access reviews and certifications.

Take a privately reported vulnerability through this repo's security advisory flow: board it as a draft card, check whether the code is this repo's server or…

Secure AI coding agents (Claude Code, Cursor, Codex, Copilot) with permission boundaries, secret protection, code review gates, and safe sandbox…

Implement centralized audit logging and SIEM integration.

Configure AWS CloudTrail for audit logging.

Manage EC2 instances, AMIs, and auto-scaling groups.

Manage IAM users, roles, and policies.

Provision and manage RDS databases.

Configure S3 buckets, policies, and lifecycle rules.

Design and implement VPCs and networking.

Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.

Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection with agent-browser.

Harden AI/LLM deployments against prompt injection, data exfiltration, model theft, and supply chain attacks.

飞书邮箱：Use when user mentions 起草邮件、写邮件、草稿、发送/回复/转发邮件、查阅邮件、看邮件、搜索邮件、邮件文件夹、邮件标签、邮件联系人、监听新邮件、邮件收信规则等；use for mail/email intent only.

Check secret handling, staged changes and push targets, destructive Git operations, Docker image hygiene, and new dependencies before consequential coding…

Store and rotate secrets in AWS Secrets Manager.

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing…

Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle.

Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps.