Security for Claude Code

Google Model Armor: Filter user-generated content for safety.

Google Model Armor: Create a new Model Armor template.

Google Model Armor: Sanitize a user prompt through a Model Armor template.

Google Model Armor: Sanitize a model response through a Model Armor template.

Administer IT — monitor security and configure Workspace.

Use this agent when you need to audit Active Directory security posture, evaluate privilege escalation risks, review identity delegation patterns, or assess authentication protocol hardening. Specifically:\\n\\n<example>\\nContext: Organization's security team has discovered risky privileged group configurations and needs a comprehensive review.\\nuser: \"We need to audit our Domain Admins and Enterprise Admins groups. Can you review our AD structure?\"\\nassistant: \"I'll use the ad-security-re

Implement secure user authentication system with chosen method and security best practices

Use this agent when you need to design, validate, or harden forensic audit trails for AI coding agents (Claude Code, Cursor, Codex CLI, Aider) operating in regulated environments. Focuses on tamper-evident logging, hash-chain integrity, and framework mapping for the NIST AI RMF, EU AI Act Annex IV, HIPAA, and SOC 2 CC7. Specifically:\\n\\n<example>\\nContext: A healthcare company is rolling out Claude Code to engineering teams and legal is asking what audit evidence will be produced for HIPAA au

AI ethics and responsible AI development specialist. Use when reviewing an AI system for bias, fairness violations, or regulatory compliance gaps; when generating a model card, algorithmic impact assessment, or ethics review document; or when an AI feature touches a protected class or high-stakes domain (hiring, healthcare, credit, law enforcement).

This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.

Expert in integrating third-party APIs with proper authentication, error handling, rate limiting, and retry logic. Use when integrating REST APIs, GraphQL endpoints, webhooks, or external services. Specializes in OAuth flows, API key management, request/response transformation, and building robust API clients.

Expert API architect for designing and implementing REST and GraphQL APIs with production-grade resilience, security, and versioning. Use this agent when you need to: design a GraphQL schema with federation for a new microservice, build a resilient REST client with circuit breaker and bulkhead patterns, choose between REST/GraphQL/gRPC for a new service, or implement secure API authentication and rate limiting. <example> <user_request>Design a GraphQL API for an e-commerce catalog service with p

API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.

API security audit specialist. Use PROACTIVELY for REST API security audits, authentication vulnerabilities, authorization flaws, injection attacks, and compliance validation.

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

Provide expert Azure Principal Architect guidance using Azure Well-Architected Framework principles and Microsoft best practices.

When user is asking for guidance for which role to assign to an identity given desired permissions, this agent helps them understand the role that will meet the requirements with least privilege access and how to apply that role.

Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".

Use this agent when building smart contracts, DApps, and blockchain protocols that require expertise in Solidity, gas optimization, security auditing, and Web3 integration. Specifically:\n\n<example>\nContext: A team is building a DeFi protocol and needs to implement smart contracts for an AMM with liquidity pools, yield farming, and governance tokens.\nuser: \"We need to build an AMM protocol similar to Uniswap. Requirements: ERC20 token support, liquidity pool management, automated market make

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.

This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.

Perform comprehensive analysis of $ARGUMENTS to identify code quality issues, security vulnerabilities, and optimization opportunities.

Expert patterns for Clerk auth implementation, middleware, organizations, webhooks, and user sync Use when: adding authentication, clerk auth, user authentication, sign in, sign up.

Expert cloud architect specializing in AWS/Azure/GCP multi-cloud infrastructure design, advanced IaC (Terraform/OpenTofu/CDK), FinOps cost optimization, and modern architectural patterns.

Use this agent when you need to design, evaluate, or optimize cloud infrastructure architecture at scale. Invoke when designing multi-cloud strategies, planning cloud migrations, implementing disaster recovery, optimizing cloud costs, or ensuring security/compliance across cloud platforms. Specifically:\\n\\n<example>\\nContext: A company is planning to migrate their monolithic on-premises application to the cloud and needs architectural guidance.\\nuser: \"We're moving from on-premises to AWS.

Creates and manages Cloud SQL instances for MySQL, PostgreSQL, and SQL Server. Handles backups, high availability, and secure connectivity for relational database workloads on Google Cloud.

Comprehensive code quality review with security, performance, and architecture analysis

Comprehensive checklist for conducting thorough code reviews covering functionality, security, performance, and maintainability

Use this agent when you need to conduct comprehensive code reviews focusing on code quality, security vulnerabilities, and best practices. Specifically:\\n\\n<example>\\nContext: Developer has submitted a pull request with changes to critical authentication logic in a TypeScript backend service.\\nuser: \"Can you review this PR that refactors our authentication system? We need to catch any security issues, performance problems, or maintainability concerns.\"\\nassistant: \"I'll conduct a thoroug

Use this agent when you need to achieve regulatory compliance, implement compliance controls, or prepare for audits across frameworks like GDPR, HIPAA, PCI DSS, SOC 2, and ISO standards. Specifically:\\n\\n<example>\\nContext: A healthcare organization is building a patient data management system and needs to ensure HIPAA compliance before deployment.\\nuser: \"We're developing a patient records system. What HIPAA controls do we need? How do we prove compliance to auditors?\"\\nassistant: \"I'll

Security compliance and regulatory framework specialist. Use PROACTIVELY for compliance assessments, regulatory requirements, audit preparation, and governance implementation.

Anthropic's method for training harmless AI through self-improvement. Two-phase approach - supervised learning with self-critique/revision, then RLAIF (RL from AI Feedback). Use for safety alignment, reducing harmful outputs without human labels. Powers Claude's safety system.

Containerize application with optimized Docker configuration, security, and multi-stage builds

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.

Data privacy and regulatory compliance specialist for GDPR, CCPA, HIPAA, and international data protection laws. Use when implementing privacy controls, conducting data protection impact assessments, ensuring regulatory compliance, or managing data subject rights. Expert in consent management, data minimization, and privacy-by-design principles.

Audit dependencies for security vulnerabilities, license compliance, and update recommendations

Use this agent when you need to audit dependencies for vulnerabilities, resolve version conflicts, optimize bundle sizes, or implement automated dependency updates. Specifically:\\n\\n<example>\\nContext: A project has accumulated security vulnerabilities in its dependency tree that need immediate remediation.\\nuser: \"We have 12 high-severity CVEs in our dependencies. Can you help fix them?\"\\nassistant: \"I'll use the dependency-manager agent to scan all vulnerabilities, assess their impact,

Use this agent to manage project dependencies. Specializes in dependency analysis, vulnerability scanning, and license compliance. Examples: <example>Context: A user wants to update all project dependencies. user: 'Please update all the dependencies in this project.' assistant: 'I will use the dependency-manager agent to safely update all dependencies and check for vulnerabilities.' <commentary>The dependency-manager is the right tool for dependency updates and analysis.</commentary></example> <