Security for Claude Code

Analyzes Dockerfiles and produces optimized multi-stage builds, .dockerignore files, and docker-compose configs that shrink image size by 80-90% and enforce security best practices. Use when optimizing container builds or starting a new Dockerfile. Trigger with \"optimize my dockerfile\", \"reduce docker image size\".

Audits FairDB VPS instances at three depth levels against SOP-001 (security), SOP-002 (PostgreSQL config), and SOP-003 (backup integrity), producing a scored compliance report with remediation steps. Use when validating a server's configuration or preparing for a compliance review. Trigger with "audit this FairDB server", "run a compliance check".

Generates and validates production-grade Firestore security rules for user auth, role-based access, A2A service accounts, and data validation patterns, with emulator-ready unit tests. Use when securing Firestore collections or enabling agent-to-agent communication. Trigger with "generate Firestore security rules", "secure my collections".

Reviews APIs for REST compliance, naming consistency, OpenAPI coverage, and security posture. Use when adding endpoints, auditing an existing API, or standardizing a messy surface. Trigger with \"audit the API\", \"review endpoint design\".

Validates code across syntax, logic, security, performance, and accessibility dimensions using multi-model synthesis, then produces a prioritized report with corrected snippets. Use after code generation or before production hand-off. Trigger with "check this code for errors", "validate the generated code".

Audits project dependencies for CVEs, outdated packages, and license compatibility using pip-audit, npm audit, and pip-licenses/license-checker. Use when hardening security posture or planning a major dependency upgrade. Trigger with "audit dependencies for vulnerabilities", "check what breaks if I upgrade this".

Designs and audits AI guardrail layers — input/output filters, PII detection, content moderation, and runtime policy enforcement. Use when adding safety controls to an LLM feature or auditing existing ones. Trigger with \"design guardrails\", \"audit our AI safety controls\".

Runs hypothesis-driven threat hunts to surface attackers that evaded automated detection — IOC enrichment, compromise assessment, and hunting playbooks. Use when proactively searching for threats or assessing potential compromise. Trigger with \"run a threat hunt\", \"assess for compromise\".

Designs and audits Kubernetes cluster architectures — RBAC policies, CNI networking, workload configuration, and operators with explicit reliability tradeoffs. Use when designing a cluster, auditing RBAC, or rightsizing workloads. Trigger with \"design a Kubernetes cluster\", \"audit our RBAC\".

Monitor new token launches on Ethereum, BSC, and Polygon — score rugpull risk by checking honeypot functions, liquidity lock status, ownership, mint capabilities, and social presence. Use when vetting a newly launched token or building scam-detection pipelines. Trigger with \"analyze new token\", \"rugpull check\".

Checks every contract clause against applicable regulatory frameworks (GDPR, CCPA, employment law, UCC, sector-specific regulations) by jurisdiction and outputs a structured compliance checklist with enforceability assessments. Use when verifying a contract for regulatory exposure before signing. Trigger with \"check contract compliance\", \"verify regulatory requirements\".

Analyze blockchain mempools for MEV opportunities, sandwich attack patterns, pending large transfers, and gas price optimization across Ethereum, BSC, and Arbitrum. Use when detecting front-running risk, profiling pending transactions, or researching block builder behavior. Trigger with \"analyze mempool\", \"detect MEV\".

Designs and audits service meshes (Istio/Linkerd/Consul) including mTLS policy, traffic management, and golden-signal observability. Use when adding a service mesh, hardening inter-service security, or auditing an existing mesh config. Trigger with \"design a service mesh\", \"audit our Istio setup\".

Triages CVEs using CVSS + EPSS + CISA KEV, designs patch SLA programs with asset-criticality tiers, and audits existing vuln management programs. Use when prioritizing a backlog of CVEs, designing a patching cadence, or finding SLA gaps. Trigger with \"triage our CVEs\", \"design a vulnerability management program\".

Ethical hacking specialist covering MITRE ATT&CK phases, web/API/network penetration testing, and exploit chain documentation. Use when running an authorized pen test, simulating attack scenarios, or writing a findings report with proof-of-concept exploits. Trigger with \"pen test this\", \"red team assessment\".

Designs phishing simulation programs, security awareness curricula, and social engineering assessments that drive behavior change through immediate feedback and difficulty progression. Use when building or auditing a security awareness program or measuring click/report rates. Trigger with \"design a phishing simulation\", \"build our security awareness program\".

Detects and mitigates prompt injection, jailbreaks, and adversarial input attacks against LLM applications. Use when hardening a system prompt, reviewing LLM input handling, or implementing injection defenses. Trigger with \"defend against prompt injection\", \"harden llm inputs\".

Plans and documents red team exercises — pen test scopes, attack path documentation, CVSS-scored finding reports, and OSINT reconnaissance plans. Use when scoping a pen test or writing a security assessment. Trigger with \"plan a pen test\", \"write a red team report\".

Writes incident response playbooks, containment runbooks, and post-incident reviews following the PICERL framework — contain first, preserve evidence, never blame. Use when building IR readiness or handling an active incident. Trigger with \"write an incident response playbook\", \"design containment procedures\".

Integrates SAST/DAST tooling into the SDLC — Semgrep rules, CodeQL, OWASP ZAP, and secure code review covering the full OWASP Top 10. Use when adding security scanning to a pipeline or fixing a security finding. Trigger with \"set up SAST scanning\", \"fix this security finding\".

Clears trademarks, maps patent landscapes, and audits open source license compliance — frames every finding as risk, probability, fix, and cost of inaction. Use when naming a product, assessing OSS license risk, or mapping IP assets. Trigger with \"clear this trademark\", \"audit our open source licenses\".

OWASP Top 10 vulnerability scanner and security code reviewer that identifies injection flaws, auth failures, misconfigurations, and crypto weaknesses with CWE-mapped findings and remediation code. Use when you need a security audit, vulnerability scan, or code review for security issues. Trigger with \"security audit\", \"scan for vulnerabilities\".

Use when reviewing authentication, authorization, secrets handling, input trust boundaries, or any security-sensitive code path — the standalone security gate that halts the pipeline on a violation. Verifies against the security persona standards.

Scans code for security vulnerabilities (OWASP Top 10, injection, auth flaws, insecure dependencies) and delivers severity-ranked findings with remediation guidance. Use when reviewing authentication logic, APIs, or any security-sensitive code. Trigger with "security review", "audit this code".

Performs OWASP Top 10 security assessments and generates security test cases covering SQL injection, XSS, IDOR, auth bypass, CSRF, and misconfiguration — producing severity-rated findings with proof-of-concept payloads and fix guidance. Use when preparing a penetration testing checklist or validating security controls before release. Trigger with \"security test scan\", \"OWASP vulnerability assessment\".

Scans source code for hardcoded secrets, SQL/command injection vectors, weak cryptography, and insecure defaults — using gitleaks, bandit, and pattern-based grep when tools are unavailable, with severity-rated findings and remediation guidance. Use when preparing for a security review or after a new dependency is added. Trigger with \"security scan\", \"find hardcoded secrets\".

Classifies incoming issues, bug reports, and vulnerability findings using the S1-S4 severity framework with blast-radius analysis and escalation routing. Use when triaging bugs or security findings that need consistent prioritization. Trigger with "triage this issue", "classify severity".

Maps regulatory exposure across GDPR, CCPA, FTC, financial regulation, and export controls — frames every finding as risk, probability, fix, and cost of inaction. Use when assessing compliance exposure or drafting regulator communications. Trigger with \"assess my regulatory risk\", \"draft a regulatory response\".

Builds log pipelines and SIEM detection rules — SIGMA format, MITRE mapping, retention policies, and alert tuning to keep volume within analyst capacity. Use when designing detection coverage or reducing alert fatigue. Trigger with \"write a SIEM detection rule\", \"audit my log pipeline\".

Drafts GDPR-compliant privacy policies, Terms of Service, cookie notices, and DPAs sized to company stage. Use when you need a privacy policy, ToS, or data processing agreement written or audited. Trigger with \"draft my privacy policy\", \"review my terms of service\".

Security threat modeling specialist that applies STRIDE to system architectures, identifies trust boundary risks, and produces prioritized mitigation plans with risk scores. Use when designing a new system, reviewing architecture for security threats, or reducing attack surface. Trigger with \"threat model\", \"security design review\".

Diagnoses Unity Catalog's two-level access model for a specific user + error — walks account-admin/metastore-admin status, group memberships (incl. nested-group caveats), object grants, and the external-location/storage-credential chain — and returns the exact missing membership + grant + who must run it. Use when a user hits PERMISSION_DENIED or AccessDenied after a UC migration. Trigger with "why can't this user access", "trace uc permission", "unity catalog access denied".

Inspects and validates Vertex AI Agent Engine deployments — runtime config, code-execution sandbox, memory bank, A2A protocol compliance, security posture, and production readiness. Use when auditing a deployed Agent Engine agent or running pre-production validation checks. Trigger with \"inspect vertex ai engine agent\", \"validate agent engine deployment\".

Use when assessing dependencies, exploit paths, or known-CVE exposure — the deep security-research specialist that maps the diff against current advisories. Verifies against the security and scientific persona standards.

Writes threat models, IAM policies, hardening specs, and auth implementation reviews sized to actual risk — not compliance theater. Use when you need a security audit, secrets management design, or auth pattern review. Trigger with \"threat model my app\", \"audit my security posture\".

Designs zero trust network architectures with phased roadmaps covering identity pillars, microsegmentation, and ZTNA replacement for VPN. Use when you need a zero trust design, a network segmentation plan, or a ZT maturity assessment. Trigger with \"design my zero trust architecture\", \"audit my network for zero trust readiness\".

Clerk authentication setup specialist. MUST BE USED when configuring Clerk, setting up webhooks, or troubleshooting auth issues. Use PROACTIVELY for new auth implementations.

Claude Desktop/Cowork — plugin-based secure checkout flow.