Security & Testing Agent Skills for Devin Desktop

Resolve deny-by-default role capabilities at every shipped executor/provider boundary, require host enforcement attestations for dangerous…

Card/key/cdkey generation and verification workflow.

Career data governance inventories private workspace data and plans disclosure, export, retention, legal hold, scoped deletion, and…

Intercept destructive commands before execution — rm -rf, DROP TABLE, force-push, git reset --hard, and similar irreversible operations.

Secure CAST AI API keys, RBAC configuration, and Kvisor security agent.

When to activate: CCPA, CPRA, California privacy, consumer rights, opt-out, data deletion, privacy notice, California residents, do not sell

Check your work with a verification subagent that reviews diffs, runs builds and tests, and evaluates correctness.

This skill enables Claude to automatically check for HIPAA (Health Insurance Portability and Accountability Act) compliance issues in…

Audit a target's HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the…

This skill allows Claude to check infrastructure compliance against industry standards such as SOC2, HIPAA, and PCI-DSS.

This skill enables Claude to check session security implementations within a codebase.

Close Insufficient Logging & Visibility (CICD-SEC-10) with comprehensive, tamper-resistant CI/CD audit logging and alerting.

Harden CI/CD identity & access management against CICD-SEC-2.

Demonstrate Insufficient Pipeline-Based Access Controls (CICD-SEC-5) during an authorized assessment — abusing the fact that a running…

Harden Pipeline-Based Access Controls against CICD-SEC-5.

Demonstrate CI/CD secret exfiltration (CICD-SEC-6, Insufficient Credential Hygiene) during an authorized assessment — recovering pipeline…

Demonstrate Ungoverned Usage of Third-Party Services (CICD-SEC-8) during an authorized assessment — abusing the broad, unaudited access…

Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual)

Set up Python test environment in Claude Code for web where flox is unavailable.

Implement GDPR/CCPA-compliant data handling for Clay enrichment pipelines.

Configure Clay workspace roles, team access control, and credit budget