Policy as code for Kubernetes and infrastructure: authoring Kyverno ClusterPolicy rules, OPA Rego in a Gatekeeper ConstraintTemplate, and Conftest checks, plus Pod Security Standards enforcement, policy unit testing, and an owned exception register with expiry dates. Use when privileged containers or pods without resource limits must be rejected at admission rather than reported, when admission policies need tests so a rule cannot silently stop matching, or when choosing between Kyverno and OPA Gatekeeper.
Packs the entire codebase (or selected folders) into a single token-efficient file using repomix, so other skills can analyze the whole repo without re-reading individual files. Use when the task requires whole-codebase context: full security audits, cross-cutting refactors, architecture review, project-wide code review, or first-time onboarding to an unfamiliar repo. Auto-runs once per session at first invocation of agent-master.
Detection engineering and threat hunting: detection-as-code with Sigma rules in version control, log pipeline and telemetry source coverage, MITRE ATT&CK coverage mapping, alert precision and tuning to survive analyst trust, validation with Atomic Red Team, and hypothesis-driven hunts for activity that evaded automated controls. Use when security alerts are too noisy to act on, when deciding which detections to write and which telemetry to collect first, or when hunting for attacker activity nothing has alerted on.
Security & privacy auditor for Flutter/Dart mobile games (iOS + Android). Use to find data leaks, insecure storage/network, hardcoded secrets, over-broad permissions (Android INTERNET/location/AD_ID, iOS usage strings), unsafe APIs, and kids-privacy violations — tracking, ads (google_mobile_ads), analytics/Crashlytics, AdvertisingId (IDFA/GAID), Firebase telemetry, external links — across BOTH Apple Kids Category and Google Play Families. Read-only: reports risks and concrete fixes, never edits.
Security for LLM and agent systems: direct and indirect prompt injection, the OWASP Top 10 for LLM Applications, MITRE ATLAS technique mapping, excessive agency and tool-scope containment, egress allowlisting to stop data exfiltration, human confirmation for irreversible actions, and treating third-party skills and MCP servers as untrusted code. Use when an agent is given tools or credentials, when retrieved documents or repository files could carry injected instructions, or when reviewing an AI feature before it reaches production.
Review whether security-relevant logging is enabled, complete, shipped off-host, and tamper-resistant across Kubernetes and the cloud control plane. Use when user says 'review my audit logging', 'is audit logging on', 'check my k8s audit policy', 'are we logging API-server access', 'review GKE/AKS logging', 'do we capture admin activity', or when working in audit-policy.yaml, kube-apiserver manifests, or GKE/AKS Terraform. Covers generic Kubernetes audit policy, GKE Cloud Logging + audit config, AKS diagnostic settings, and cross-cloud audit-log immutability. For AWS CloudTrail/flow-log/EKS-audit/S3-access IaC use /clouddrove:tf (SEC-LOG-*); for log retention/centralization, metrics, and SLOs use /clouddrove:observability (OBS-LOG-*).
Design Postgres tables, Row Level Security policies and migrations for a Supabase app where data is shared between users — couples, teams, households, invites, join codes, anything two or more accounts touch. Use this whenever you are creating or changing a Supabase table, writing or debugging an RLS policy, adding an invite/pairing/join flow, or investigating why a query returns nothing for one user but works for another. Reach for it early: RLS decisions are cheap to make correctly up front and expensive to unpick once rows exist, and the most common failure mode is a silent empty result rather than an error.
Handle a secret across its whole lifecycle — keep it out of source and image layers, inject it at runtime via environment or a secret store, scope each credential to least privilege, and rotate on a schedule and immediately after exposure. Invoke when code needs an API key, DB password, token, or private key, or when wiring how an app obtains its secrets. Complements the secret-scan hook (which only blocks committing a literal) and security-review (which only flags secrets in your diff). Skip for code that handles no credentials.
Covers how to run and FIX every quality gate in this repo — ruff (lint + format), mypy --strict, pytest with per-layer coverage, import-linter (lint-imports), bandit, and pip-audit. Use this whenever a quality gate fails locally or in CI, whenever the user asks how to lint, format, type-check, or run security scans on this codebase, or before opening a PR to run the full gate set proactively. Make sure to consult this whenever a ruff, mypy, lint-imports, or bandit error appears in tool output — it gives the exact fix command for each gate rather than requiring you to guess at generic remediation.
testing-feature` | QA test features using Playwright |
| `reviewing-local-changes` | Code review for quality, security, best practices, and product/API alignment |
| `simplifying-local-changes` | Simplify and refine code changes
Steady4 mentions in 2 weeks
No other project uses it yet
46k12d agoReviewMountCreate a free account to mount
mchittineniCursor rule
