gabbe-security

Plugin gabbe-security from marketplace gabbe in andreibesleaga/GABBE. Commands read from the repo's manifest — yesterday.

Skills (21)

• access-control

  Design RBAC/ABAC models, Principle of Least Privilege, Identity Management. Use when: access control.

• agent-sandboxing

  Intrinsic least-privilege isolation for agents touching a local OS, shell, or filesystem — the enforcement layer behind prompt-injection-defense and ai-safety-guardrails. Use when: agent sandbox, sandbox policy, least privilege isolation, filesystem allowlist, egress deny-by-default, syscall restric

• ai-ethics-compliance

  Assessing Bias, Fairness, Transparency, and Legal (EU AI Act, GDPR). Use when: ai ethics compliance.

• ai-red-teaming

  Proactively attack your own AI and agent system to find failures before adversaries, scoring attack-success-rate and gating CI on it. Use when: ai red teaming, red team plan, attack success rate, ASR scorecard, jailbreak testing, crescendo attack, automated adversarial testing, OWASP LLM red team.

• ai-safety-guardrails

  Security-by-design for AI (Prompt Injection defense, Hallucination checks, PII filters). Use when: ai safety guardrails.

• api-security

  Design and enforce REST/GraphQL API Security paradigms. Use when: secure api, audit api security, implement jwt auth.

• backup-recovery

  Define RPO/RTO, implement PITR/Snapshots, and test restores. Use when: backup recovery.

• compliance-review

  Regulatory compliance check for SOC2, PCI-DSS, GDPR, HIPAA — checklists, audit trails, access controls. Use when: compliance, SOC2, PCI-DSS, GDPR, audit trail, regulatory, certification, compliance review.

• cryptography-standards

  Enforce correct cryptographic algorithms, hashing, and TLS standards. Use when: encrypt data, hash passwords, set tls policy.

• dependency-security

  Managing Supply Chain Security, SBOM generation, and vulnerability patching (SCA). Use when: dependency security.

• hazard-analysis

  Conducting FMEA (Failure Mode & Effects Analysis) and identifying hazards. Use when: hazard analysis.

• legal-review

  Check for license compliance, PII, and IP risks. Use when: Check licenses, Review for legal compliance, Is this library safe to use?, GDPR compliance check.

• log-analysis

  Parsing structured logs, finding patterns in noise, and ELK/Splunk querying. Use when: log analysis.

• network-security

  Firewall rules, VPC design, TLS config, and subnet isolation. Use when: network security.

• privacy-audit

  PII detection, data flow mapping, GDPR/CCPA/HIPAA compliance verification. Use when: privacy, PII, GDPR, CCPA, HIPAA, personal data, data flow, consent, data protection.

• privacy-data-protection

  Elicit and enforce GDPR, CCPA, and general privacy by design rules. Use when: design privacy system, audit gdpr conformity, protect pii.

• prompt-injection-defense

  Defend agentic systems against direct and indirect prompt injection using defense-in-depth. Use when: prompt injection, indirect injection, lethal trifecta, rule of two, jailbreak defense, tool output poisoning, untrusted content.

• reliability-engineering

  Designing failover patterns (Hot Standby, TMR), redundancy, and MTBF/availability calculations. Use when: reliability engineering.

• secrets-management

  Safe handling of API keys, Vault/AWS Secrets Manager patterns, rotation. Use when: secrets management.

• secure-architecture

  Architect systems with defense-in-depth and Zero Trust principles. Use when: design secure system, enforce zero trust, audit architecture security.

• traceability-audit

  Verifies that every PRD requirement has a linked Test Case and Code Implementation. Use when: traceability audit.

Similar plugins