Security & Testing Agent Skills

Automates phishing incident response by calling the Splunk SOAR (Phantom)

Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish

Build out a full CTI program around the six-phase threat intelligence

Implements an integrated incident ticketing system connecting SIEM alerts

Deploy and configure Velociraptor for scalable endpoint forensic artifact

Design a vulnerability remediation SLA program covering asset tiering,

Build an automated SLA breach alerting system for vulnerability remediation,

Implements the Schnorr identification protocol and a simplified Zero-Knowledge Password Proof (ZKPP) over the discrete logarithm problem…

Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles…

Configure NextDNS as an encrypted (DoH/DoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via…

Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB/SSPM deployment, conditional access policies, OAuth app…

Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous…

Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between…

Configures Google BeyondCorp Enterprise Identity-Aware Proxy (IAP) as the access enforcement point for web applications, defining Access…

Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller/worker…

Create and maintain GitHub Agentic Workflows (gh-aw) for Prowler.

When to activate: breach notification, data breach, incident response, GDPR 72 hours, CCPA notification, HIPAA breach, regulator…

Guide for connecting Infisical to an identity provider for human login and user provisioning.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production.

Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false…