security▌

Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.

Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

JWT authentication and authorization for Spring Boot 3.5.x with token generation, refresh strategies, and role/permission-based access control. \n \n Covers token generation with JJWT, Bearer/cookie authentication, and stateless session management using Spring Security 6.x \n Supports database-backed and OAuth2 provider integration (Google, GitHub) with modern SecurityFilterChain configuration \n Includes refresh token rotation, token blacklisting, and key rotation strategies for production secu

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

Implement comprehensive security hardening with defense-in-depth strategy through coordinated multi-agent orchestration:

在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。

Comprehensive security rules for writing secure code across 15+ languages. Covers OWASP Top 10, infrastructure security, and coding best practices with 28 rule categories.

Security review for TypeScript/Node.js applications. Evaluates code against OWASP Top 10, framework-specific patterns, and production-readiness criteria. Findings are classified by severity (Critical, High, Medium, Low) with remediation examples. Delegates to the typescript-security-expert agent for deep analysis.

Generate ECS-compliant security events, multi-step attack scenarios, and synthetic alert documents that populate Elastic Security dashboards, the Alerts tab, and Attack Discovery.

Security Requirement Extraction \n Transform threat analysis into actionable security requirements. \n Use this skill when \n \n Converting threat models to requirements \n Writing security user stories \n Creating security test cases \n Building security acceptance criteria \n Compliance requirement mapping \n Security architecture documentation \n \n Do not use this skill when \n \n The task is unrelated to security requirement extraction \n You need a different domain or tool outside this sco