Run an authorized security review of a web app you own or are cleared to test, especially local and dev builds. Dev mode finds the running dev server, writes the scope itself and screens the build end to end with no setup questions. Works in phases that confirm authorization and scope, map the attack surface, then test for common vulnerability classes (injection, broken auth and access control, SSRF and server-side, XSS and client-side, session handling, business logic, misconfiguration, exposed secrets, secrets and tokens visible in the browser, client-controlled values like role and price, tables without RLS and public storage buckets, API and LLM issues) against the OWASP WSTG and ASVS, verify each finding with evidence to kill false positives, then write a report with severity and remediation. Can also do a static secure-code review without running anything.
Security Analysis & Protection Expert
Expert in security analysis, reverse engineering, intrusion detection, and system hardening. Specializes in using tools like Ghidra, forensics utilities, and security monitoring to ensure system safety
Use for a full security audit — T3 verify gate (money, auth, user data, migrations), pre-launch check, or when the user asks to audit the codebase for vulnerabilities. For quick diff-scoped checks, prefer a host-provided security reviewer when available, otherwise apply this skill to the diff.
Scan a brownfield PHP codebase for OWASP Top 10 issues, secrets committed to the repo, CSRF and auth gaps, and injection patterns, and emit evidence-backed AUD-SEC findings ranked by ROI with remediation cross-linked to security skills. Use when the user needs a ranked OWASP-mapped findings report for a PHP project — injection, CSRF, auth gaps, insecure config — prioritised by ROI so the riskiest cheap fixes come first; the user wants to find secrets committed to the repo — API keys, passwords, private keys, tokens in `.env`, config, or history — and record them as findings; the user asks to security-audit or pentest-review an existing PHP codebase for OWASP Top 10 issues, injection, CSRF, broken auth, or misconfiguration, wanting ranked findings. Keywords: audit, security, findings, roi, report, owasp, secrets, csrf, injection, auth, input, brownfield.
Audit and fix security vulnerabilities across web apps, APIs, databases, auth systems, and infrastructure. Use when asked to review security, fix vulnerabilities, implement auth, or harden a system.
Evidence-grounded threat modeling, vulnerability review, and secure implementation. Use for explicit security audits or primary risks involving authorization, untrusted input, external requests, parsers/uploads, secrets, sensitive data, isolation, or release integrity. Not for routine implementation or non-security red-teaming. Add `security-identity-access` for identity and tenant authorization.
Security patterns and frameworks. Use when reviewing code for vulnerabilities, designing authentication/authorization, writing IAM policies, handling secrets, or discussing threat models.
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md or AGENTS.md?
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
What is a skill?
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Can I search my own team's files too?
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
MarvelCollinSkill
