Security for Claude Code

Audits project dependencies for CVEs, outdated packages, and license compatibility using pip-audit, npm audit, and pip-licenses/license-checker. Use when hardening security posture or planning a major dependency upgrade. Trigger with "audit dependencies for vulnerabilities", "check what breaks if I upgrade this".

DESCRIPTION_PLACEHOLDER

Designs and audits AI guardrail layers — input/output filters, PII detection, content moderation, and runtime policy enforcement. Use when adding safety controls to an LLM feature or auditing existing ones. Trigger with \"design guardrails\", \"audit our AI safety controls\".

Runs hypothesis-driven threat hunts to surface attackers that evaded automated detection — IOC enrichment, compromise assessment, and hunting playbooks. Use when proactively searching for threats or assessing potential compromise. Trigger with \"run a threat hunt\", \"assess for compromise\".

Implement standardized API error handling

Implement API throttling and quotas

DESCRIPTION_PLACEHOLDER

Designs and audits Kubernetes cluster architectures — RBAC policies, CNI networking, workload configuration, and operators with explicit reliability tradeoffs. Use when designing a cluster, auditing RBAC, or rightsizing workloads. Trigger with \"design a Kubernetes cluster\", \"audit our RBAC\".

Monitor new token launches on Ethereum, BSC, and Polygon — score rugpull risk by checking honeypot functions, liquidity lock status, ownership, mint capabilities, and social presence. Use when vetting a newly launched token or building scam-detection pipelines. Trigger with \"analyze new token\", \"rugpull check\".

Checks every contract clause against applicable regulatory frameworks (GDPR, CCPA, employment law, UCC, sector-specific regulations) by jurisdiction and outputs a structured compliance checklist with enforceability assessments. Use when verifying a contract for regulatory exposure before signing. Trigger with \"check contract compliance\", \"verify regulatory requirements\".

DESCRIPTION_PLACEHOLDER

Analyze blockchain mempools for MEV opportunities, sandwich attack patterns, pending large transfers, and gas price optimization across Ethereum, BSC, and Arbitrum. Use when detecting front-running risk, profiling pending transactions, or researching block builder behavior. Trigger with \"analyze mempool\", \"detect MEV\".

Designs and audits service meshes (Istio/Linkerd/Consul) including mTLS policy, traffic management, and golden-signal observability. Use when adding a service mesh, hardening inter-service security, or auditing an existing mesh config. Trigger with \"design a service mesh\", \"audit our Istio setup\".

Manage Kubernetes network policies and firewall rules

Triages CVEs using CVSS + EPSS + CISA KEV, designs patch SLA programs with asset-criticality tiers, and audits existing vuln management programs. Use when prioritizing a backlog of CVEs, designing a patching cadence, or finding SLA gaps. Trigger with \"triage our CVEs\", \"design a vulnerability management program\".

Ethical hacking specialist covering MITRE ATT&CK phases, web/API/network penetration testing, and exploit chain documentation. Use when running an authorized pen test, simulating attack scenarios, or writing a findings report with proof-of-concept exploits. Trigger with \"pen test this\", \"red team assessment\".

Run a security testing workflow against a target URL or codebase

Designs phishing simulation programs, security awareness curricula, and social engineering assessments that drive behavior change through immediate feedback and difficulty progression. Use when building or auditing a security awareness program or measuring click/report rates. Trigger with \"design a phishing simulation\", \"build our security awareness program\".

Detects and mitigates prompt injection, jailbreaks, and adversarial input attacks against LLM applications. Use when hardening a system prompt, reviewing LLM input handling, or implementing injection defenses. Trigger with \"defend against prompt injection\", \"harden llm inputs\".

> Implement disaster recovery and point-in-time recovery strategies

Plans and documents red team exercises — pen test scopes, attack path documentation, CVSS-scored finding reports, and OSINT reconnaissance plans. Use when scoping a pen test or writing a security assessment. Trigger with \"plan a pen test\", \"write a red team report\".

Manage container registries (ECR, GCR, Harbor)

Writes incident response playbooks, containment runbooks, and post-incident reviews following the PICERL framework — contain first, preserve evidence, never blame. Use when building IR readiness or handling an active incident. Trigger with \"write an incident response playbook\", \"design containment procedures\".

Run the customer-managed-key rotation runbook for a Databricks workspace — drain all compute idempotently, rotate the key per cloud, then resume exactly what was drained.

Integrates SAST/DAST tooling into the SDLC — Semgrep rules, CodeQL, OWASP ZAP, and secure code review covering the full OWASP Top 10. Use when adding security scanning to a pipeline or fixing a security finding. Trigger with \"set up SAST scanning\", \"fix this security finding\".

Scan codebase for security vulnerabilities

Scan API for security vulnerabilities

DESCRIPTION_PLACEHOLDER

Quick security header check for a single URL

DESCRIPTION_PLACEHOLDER

Scan for exposed secrets and credentials in codebase

DESCRIPTION_PLACEHOLDER

Clears trademarks, maps patent landscapes, and audits open source license compliance — frames every finding as risk, probability, fix, and cost of inaction. Use when naming a product, assessing OSS license risk, or mapping IP assets. Trigger with \"clear this trademark\", \"audit our open source licenses\".

Integrate with secrets managers (Vault, AWS Secrets Manager, etc)

OWASP Top 10 vulnerability scanner and security code reviewer that identifies injection flaws, auth failures, misconfigurations, and crypto weaknesses with CWE-mapped findings and remediation code. Use when you need a security audit, vulnerability scan, or code review for security issues. Trigger with \"security audit\", \"scan for vulnerabilities\".

Use when reviewing authentication, authorization, secrets handling, input trust boundaries, or any security-sensitive code path — the standalone security gate that halts the pipeline on a violation. Verifies against the security persona standards.

Scans code for security vulnerabilities (OWASP Top 10, injection, auth flaws, insecure dependencies) and delivers severity-ranked findings with remediation guidance. Use when reviewing authentication logic, APIs, or any security-sensitive code. Trigger with "security review", "audit this code".

> Comprehensive database security scanner with OWASP compliance checks,...