Security for Claude Code

Classify an issue, finding, or vulnerability by severity level (S1-S4)

Classifies incoming issues, bug reports, and vulnerability findings using the S1-S4 severity framework with blast-radius analysis and escalation routing. Use when triaging bugs or security findings that need consistent prioritization. Trigger with "triage this issue", "classify severity".

Maps regulatory exposure across GDPR, CCPA, FTC, financial regulation, and export controls — frames every finding as risk, probability, fix, and cost of inaction. Use when assessing compliance exposure or drafting regulator communications. Trigger with \"assess my regulatory risk\", \"draft a regulatory response\".

Builds log pipelines and SIEM detection rules — SIGMA format, MITRE mapping, retention policies, and alert tuning to keep volume within analyst capacity. Use when designing detection coverage or reducing alert fatigue. Trigger with \"write a SIEM detection rule\", \"audit my log pipeline\".

DESCRIPTION_PLACEHOLDER

Guide through SOP-001 VPS Initial Setup & Hardening procedure

Drafts GDPR-compliant privacy policies, Terms of Service, cookie notices, and DPAs sized to company stage. Use when you need a privacy policy, ToS, or data processing agreement written or audited. Trigger with \"draft my privacy policy\", \"review my terms of service\".

Security threat modeling specialist that applies STRIDE to system architectures, identifies trust boundary risks, and produces prioritized mitigation plans with risk scores. Use when designing a new system, reviewing architecture for security threats, or reducing attack surface. Trigger with \"threat model\", \"security design review\".

Trace Unity Catalog's two-level access model for a user + error and return the exact missing group membership, grant, and who must run it.

Diagnoses Unity Catalog's two-level access model for a specific user + error — walks account-admin/metastore-admin status, group memberships (incl. nested-group caveats), object grants, and the external-location/storage-credential chain — and returns the exact missing membership + grant + who must run it. Use when a user hits PERMISSION_DENIED or AccessDenied after a UC migration. Trigger with "why can't this user access", "trace uc permission", "unity catalog access denied".

DESCRIPTION_PLACEHOLDER

DESCRIPTION_PLACEHOLDER

DESCRIPTION_PLACEHOLDER

DESCRIPTION_PLACEHOLDER

Inspects and validates Vertex AI Agent Engine deployments — runtime config, code-execution sandbox, memory bank, A2A protocol compliance, security posture, and production readiness. Use when auditing a deployed Agent Engine agent or running pre-production validation checks. Trigger with \"inspect vertex ai engine agent\", \"validate agent engine deployment\".

Use when assessing dependencies, exploit paths, or known-CVE exposure — the deep security-research specialist that maps the diff against current advisories. Verifies against the security and scientific persona standards.

Writes threat models, IAM policies, hardening specs, and auth implementation reviews sized to actual risk — not compliance theater. Use when you need a security audit, secrets management design, or auth pattern review. Trigger with \"threat model my app\", \"audit my security posture\".

Designs zero trust network architectures with phased roadmaps covering identity pillars, microsegmentation, and ZTNA replacement for VPN. Use when you need a zero trust design, a network segmentation plan, or a ZT maturity assessment. Trigger with \"design my zero trust architecture\", \"audit my network for zero trust readiness\".

>- Instructions for handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing using a safe protocol.

360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans including all Skill Vetter checks plus extended system/privacy/behavior checks and automated scanning scripts. Supports static analysis, behavior detection, dependency auditing.

>- Vendor-agnostic ACL and firewall rule analysis with shadowed rule detection, overly permissive rule identification, unused rule discovery, redundant rule flagging, and rule ordering optimization. Covers ACLs (Cisco/JunOS/EOS) and firewall policies (PAN-OS/FortiGate/CheckPoint).

>- Open security platform for agentic infrastructure — broad scanning plus MCP discovery, CVEs, blast radius, SBOMs, CIS benchmarks (AWS, Azure, GCP, Snowflake), OWASP/NIST/MITRE compliance, AISVS v1.0, MAESTRO layer tagging, and vector database security checks. Use when the user mentions vulnerability scanning, MCP server trust, compliance, SBOM generation, CIS benchmarks, blast radius, or AI supply chain risk.

>- Analyze blast radius, attack paths, and threat landscape across your AI infrastructure. Use when: "blast radius", "threat intel", "risk score", "attack path", "lateral movement", "context graph", "who can reach what".

>- AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: "compliance report", "NIST", "SOC 2", "ISO 27001", "OWASP", "EU AI Act", "AISVS", "generate SBOM", "policy check".

>- Enforce security policies on MCP tool calls and block dangerous operations at runtime. Use when: "block risky calls", "apply policy", "proxy", "runtime protection", "policy enforcement", "intercept MCP calls".

>- MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file trust, and run SAST code scans. Use when the user mentions MCP server trust, registry lookup, marketplace check, or skill trust assessment.

>- AI runtime security monitoring — context graph analysis, runtime audit log correlation with CVE findings, and vulnerability analytics queries. Use when the user mentions runtime monitoring, context graphs, lateral movement analysis, audit log correlation, or vulnerability analytics.

>- Open security platform for agentic infrastructure — checks packages for CVEs (OSV, NVD, EPSS, KEV), scans container images, verifies provenance, scans filesystems, and generates SBOMs. Use when: "check package", "scan image", "verify", "is this safe", "scan dependencies", "CVE lookup", "blast radius".

>- Scan infrastructure-as-code, cloud configurations, and find secrets. Use when: "check terraform", "scan kubernetes", "IaC", "find secrets", "scan dockerfile", "cloud security", "misconfigurations".

| Patterns and techniques for adding governance, safety, and trust controls to AI agent systems. Use this skill when: - Building AI agents that call external tools (APIs, databases, file systems) - Implementing policy-based access controls for agent tool usage - Adding semantic intent classification to detect dangerous prompts - Creating trust scoring systems for multi-agent workflows - Building audit trails for agent actions and decisions - Enforcing rate limits, content filters, or tool restri

Automatic security gate that checks packages against a vulnerability database before installation. Use before any npm install, pip install, yarn add, or package manager operation.

Comprehensive AI prompt engineering safety review and improvement prompt. Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness while providing detailed improvement recommendations with extensive frameworks, testing methodologies, and educational content.

Architecture dashboard with integrated risk review. Monitor architecture health, track risk items, and get Well-Architected scores.

Architecture governance and assessment tool. Evaluate cloud architectures against best practices and generate actionable improvement reports.

Inventory your cloud architectures and assess risks. Query architecture blueprints, evaluate Well-Architected scores, and identify governance gaps.

Visualize and govern your cloud architectures. Get architecture assessments, risk heatmaps, and compliance dashboards in one place.

Audit websites for SEO, performance, security, technical, content, and 15 other issue cateories with 230+ rules using the squirrelscan CLI. Returns LLM-optimized reports with health scores, broken links, meta tag analysis, and actionable recommendations. Use to discover and asses website or webapp issues and health.

Complete guide for CloudBase Auth using the CloudBase Node SDK – caller identity, user lookup, custom login tickets, and server-side best practices.