Security

Multi-regulation privacy compliance navigator.

Draft GDPR-compliant privacy notices for EU/EEA jurisdictions.

Launch OpenAI Codex CLI as a subagent (ChatGPT subscription auth, no API key).

Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum)…

Create a Linear OAuth application and configure Cyrus to use it — supports agent-browser automation or guided manual setup.

Audit the installed AI skill environment for duplicate installations, broad triggers and possible instruction conflicts.

Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a…

Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one…

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat…

Prepares, reviews, commits, and publishes RabiRoute changes with a mandatory per-commit patch-version bump, bilingual version log, Rabi context, privacy…

CI/CD gotchas — default creds, instant-RCE paths, secret leaks in logs.

Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft.

Android APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis.

iOS IPA static analysis — hardcoded secrets, ATS bypass, Keychain, jailbreak detection, reverse engineering with class-dump/ipsw.

SSH version CVEs and post-auth tricks — regreSSHion, user enum, agent hijack.

Broken access control - IDOR, privilege escalation, JWT abuse, mass assignment, forced browsing - for web apps and APIs.

Generated code must be aligned with security headers (e.g.

Manage Boat (boat.dev, formerly Box by Ascii) cloud sandboxes via API, CLI, and SSH.

Reporting phase — generate structured pentest report from findings.

Maintenance of the nu-validator coverage benchmark: defend the invariants (nu-only = 0, xref audit green), follow up a nu-validator upstream update (submodule…

Triage one nu-only fixture from tests/external/snapshots/diff/nu-only.json by reading the spec, then drive its verdict to match-error, match-clean, or nu-over…

Sync benchmark cross-reference blocks onto GitHub Issue bodies via `yarn bench:xref`, manage `tests/external/bench/issue-xref.config.ts` mappings, and run the…

Use when doing ANY task involving Supabase.

Configure Claude Code authentication for Cyrus — API key, OAuth token, or third-party provider.