Security & Testing Agent Skills for Windsurf (legacy)

[COMMUNITY] Generate a NHS DCB0160 deployer Clinical Safety Case Report and deployment Hazard Log for an NHS organisation deploying or…

[COMMUNITY] Generate an NHS Digital Technology Assessment Criteria (DTAC v3) assessment for a digital health product being procured or…

[COMMUNITY] Design a US federal Identity, Credential, and Access Management architecture per OMB M-19-17 and NIST SP 800-63-3, determining…

[COMMUNITY] Tailor the NIST SP 800-53 Rev 5 control catalog against the Low / Moderate / High baseline for a US federal information…

[COMMUNITY] Produce an EO 14028 secure-software self-attestation (per OMB M-22-18 / M-23-16) and an accompanying Software Bill of…

[COMMUNITY] Assess a US federal civilian system against the CISA Zero Trust Maturity Model v2.0 — scoring 5 pillars (Identity, Devices…

Translates natural language mathematical questions into optimal prompts for Harmonic's Aristotle formal theorem prover, submits them via…

Reviews a finished code change, document, issue output, execution graph, or integrated project result through predefined risk-selected…

Use when about to claim something works, is fixed, or ready to hand off — and when a task changed one or more repos and needs intentional…

Use when code handles authentication, authorization, secrets, untrusted input, uploads, redirects, external requests, or sensitive data.

This skill assists with SOC2 audit preparation by automating tasks related to evidence gathering and documentation.

Detect and triage OWASP AST01 Malicious Skills — hidden payloads (credential stealers, backdoors, social-engineering prose) shipped inside…

Detect and triage OWASP AST02 Supply Chain Compromise — registry flooding, dependency confusion in a skill's nested…

Detect and triage OWASP AST04 Insecure Metadata — brand-impersonating skill names, permission-understating manifests, risk_tier spoofing…

Detect and triage OWASP AST06 Weak Isolation — skills executing in the host agent's security context (full filesystem, shell, and network)…

Detect and triage OWASP AST08 Poor Scanning — natural-language-only malicious intent, shell-parsing evasion (quote removal, IFS…

Detect and triage OWASP AST09 No Governance — no skill inventory, no approval workflow, orphaned skills after offboarding, regulated-data…

Detect and triage OWASP AST10 Cross-Platform Reuse — security metadata (risk_tier, permissions, signatures) silently dropped when a skill…

Suspicious Communications and Anomalous System Behavior

AWS security finding analysis: analyze findings, map to Atmos components/stacks, generate structured remediation with exact Terraform…

Audit a Go project's dependencies for known vulnerabilities, unmaintained modules, and unused requirements.