Cybersecurity Skills: Master Agentic Router & Security Suite
A unified orchestrator and autonomous router across 29 professional cybersecurity skills. This skill automatically maps user security requests to the exact methodology, grep patterns, audit checklist, and reporting standards.
The execution invariant is:
$$\text{User Request / Security Task} \xrightarrow{\text{Dynamic Intent Router}} \text{Domain Skill DAG} \xrightarrow{\text{Auth Gate}} \text{Targeted Audit} \xrightarrow{\text{Triaged Findings}} \text{Actionable Deliverable}$$
⚡ Dynamic Intent Routing Matrix
When a security task is received, identify the primary domain and invoke or reference the matching sub-skill:
| Domain Family | Specialized Sub-Skill | Primary Triggers & Target Workflows | Canonical Path |
|---|---|---|---|
| AppSec & Supply Chain | `owasp-audit` | Source code audit, OWASP Top 10 (2021), IDOR, SQLi, XSS, SSRF | `skills/owasp-audit/SKILL.md` |
| `api-audit` | REST, GraphQL, RPC endpoints, OWASP API Top 10 (2023), BOLA, mass assignment | `skills/api-audit/SKILL.md` | |
| `dependency-audit` | Dependency CVEs, lockfile triage, supply-chain vulnerabilities, malicious packages | `skills/dependency-audit/SKILL.md` | |
| `secrets-audit` | Leaked API keys, credentials, token scans in code, git history, CI/CD, bundles | `skills/secrets-audit/SKILL.md` | |
| `crypto-audit` | Cryptographic algorithms, KDF parameters, IV/nonce handling, TLS posture | `skills/crypto-audit/SKILL.md` | |
| `mobile-audit` | iOS & Android security review, OWASP MASVS/MASTG, keychain, platform IPC | `skills/mobile-audit/SKILL.md` | |
| Offensive & Recon | `recon` | External attack surface discovery, asset mapping, subdomains, port sweeps | `skills/recon/SKILL.md` |
| `osint-recon` | Open source intelligence, domain footprinting, public leak correlation | `skills/osint-recon/SKILL.md` | |
| `web-pentest` | Live web pentest, OWASP WSTG, authentication bypass, business logic flaws | `skills/web-pentest/SKILL.md` | |
| `red-team-engagement` | Objective-based adversary emulation, assumed-breach scenarios, lateral movement | `skills/red-team-engagement/SKILL.md` | |
| Detection & Response | `incident-triage` | Active incident investigation, NIST SP 800-61, scoping, containment | `skills/incident-triage/SKILL.md` |
| `disk-forensics` | Disk image analysis, forensic artifacts, timeline reconstruction, chain of custody | `skills/disk-forensics/SKILL.md` | |
| `siem-detection` | Detection engineering, Sigma rules, log source coverage, MITRE ATT&CK mapping | `skills/siem-detection/SKILL.md` | |
| `soc-operations` | SOC workflows, alert triage, runbook creation, MTTD/MTTR optimization | `skills/soc-operations/SKILL.md` | |
| `threat-hunting` | Hypothesis-driven threat hunting, PEAK framework, living-off-the-land hunts | `skills/threat-hunting/SKILL.md` | |
| `breach-patterns` | Lessons from real-world breaches (Capital One, LastPass, Snowflake, MOVEit, Okta) | `skills/breach-patterns/SKILL.md` | |
| Cloud & Infra | `cloud-audit` | AWS / GCP / Azure misconfigurations, public buckets, IAM escalation, security groups | `skills/cloud-audit/SKILL.md` |
| `container-audit` | Docker & Kubernetes security, Dockerfiles, pod security admission, RBAC policies | `skills/container-audit/SKILL.md` | |
| `iam-audit` | Identity & Access Management, cloud IAM, SSO/IdP (Okta/Entra), RBAC/ABAC | `skills/iam-audit/SKILL.md` | |
| AI Security | `prompt-injection` | LLM prompt injection, jailbreaks, indirect injection, RAG data poisoning | `skills/prompt-injection/SKILL.md` |
| `ai-risk-management` | NIST AI RMF + EU AI Act governance, bias, robustness, third-party model risk | `skills/ai-risk-management/SKILL.md` | |
| Design & Governance | `threat-modeling` | Pre-implementation security architecture, STRIDE, data flow trust boundaries | `skills/threat-modeling/SKILL.md` |
| `vuln-research` | CVE deep dive, exploit reachability, CISA KEV, EPSS scoring, patch analysis | `skills/vuln-research/SKILL.md` | |
| `finding-triage` | Disposition engine (Fixed / Deferred / Accepted Risk / False Positive) + tickets | `skills/finding-triage/SKILL.md` | |
| `csf-mapping` | NIST CSF 2.0 mapping (Govern, Identify, Protect, Detect, Respond, Recover) | `skills/csf-mapping/SKILL.md` | |
| `security-comms` | Executive, customer, and board communications; incident disclosure memos | `skills/security-comms/SKILL.md` | |
| Compliance & Privacy | `privacy-engineering` | GDPR / CCPA / CPRA compliance, DSAR pipelines, data minimization, DPIA | `skills/privacy-engineering/SKILL.md` |
| `pci-audit` | PCI DSS v4.0 audit, Cardholder Data Environment (CDE), encryption in transit/rest | `skills/pci-audit/SKILL.md` | |
| `hipaa-audit` | HIPAA Security & Privacy Rules, ePHI safeguarding, 18 identifiers, BAA review | `skills/hipaa-audit/SKILL.md` |
🛡️ Core Operating Principles & Ethical Safeguards
-
Mandatory Authorization Gate:
- For all offensive or invasive skills (`recon`, `osint-recon`, `web-pentest`, `red-team-engagement`), confirm explicit written scope or self-ownership before running commands.
- Refuse immediately if the target is unowned, unauthorized, or destructive.
-
No Assumptions — Evidence-Based Findings:
- Never classify a finding based purely on keyword existence. Read the control flow, verify call stacks, and check if upstream middleware or framework sanitizers neutralize the risk.
- Every reported finding must provide:
- Exact file path and line numbers
- Vulnerable code snippet
- Concrete exploit mechanism / attack vector
- Severity rating (CVSS or Critical / High / Medium / Low / Informational)
- Prescriptive, copy-pasteable remediation guidance
-
Closed-Loop Resolution:
- Feed audit findings into `finding-triage` to generate standardized ticketing metadata.
- Use `security-comms` when findings need to be communicated to non-technical stakeholders, management, or customers.
🚀 Invocation & Execution Across AI Hosts
Claude Code / Desktop
Invoke directly via slash command or natural query: ```bash /owasp-audit /cloud-audit
Or run conversational routing:
"Run a complete security audit on our authentication routes" ```
Google Antigravity & Gemini CLI
The master router activates automatically when security tasks are identified. Run the underlying scripts directly with `bun`: ```bash bun ./bin/cli.js route "check our Dockerfiles and k8s manifests" ```
Cursor IDE
Rules are installed under `.cursor/rules/.mdc` and trigger contextually when relevant code files (e.g., auth handlers, terraform files, Dockerfiles) are edited.
OpenAI Codex / ChatGPT
Adapted instructions live in `adapters/codex/.md` and can be loaded directly as custom instructions or system prompts.