Security

Check the health of Persistent Context and prepare the weekly Persistent Context & Controls review: lint instruction files (missing description, broad…

Perform repository-grounded full product reviews that assess what is working, what needs improvement, which structural issues should be revisited, and which…

Run the project-ops skill bundle end to end: health, bug, security, API contract, docs, and issue reconciliation, then plan and apply verified fixes one at a…

Full-stack TypeScript monorepo specialist: Turborepo, Next.js, Hono, tRPC, Drizzle, Postgres.

Use Google Cloud CLI (gcloud) for project/account checks and Google API operations.

Grade installed agent skills by scoring real local coding-agent sessions (normalized with a bundled Letta trajectory pipeline) against efficiency and…

Send Telegram Bot notifications for development events, CI/CD pipeline status, and AGENTS.md progress updates.

Audit Azure network exposure and harden ACLs, or diagnose RBAC/PIM access, activation, and approval failures with PowerShell or bash.

Use Git history for explicitly requested security ownership, sensitive-code hotspots, or bus-factor analysis; excludes general maintainer lists.

Manage secrets (write, list keys, delete).

Review PRs and patches for actionable correctness, API/UX, performance, security, and maintainability findings.

Assess security posture, threat models, and compliance evidence for SOC2, ISO27001, GDPR, or HIPAA requirements.

Audit test suite correctness, meaningful coverage, reliability, framework compatibility, and maintenance cost; optionally write missing tests and repair…

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more…

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved…

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses…

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours…

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API…

Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise…

Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors…

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as…

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and…

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time…

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key…