security-assessment

Plugin security-assessment from marketplace bfinster in bdfinst/agentic-dev-team. Commands read from the repo's manifest — today.

Skills (3)

• compliance-mapping

  Pattern-table mapping from unified findings to regulatory citations (PCI-DSS, GDPR, HIPAA, SOC2). LLM edge annotator invoked only for llm_review_trigger=true rows.

• false-positive-reduction

  Hybrid FP-reduction — joern when present, LLM fallback when absent. Six-stage rubric (Stage 0 + Stages 1-5) applied to every finding; emits the disposition register.

• security-assessment-pipeline

  Declarative phase graph for /security-assessment. Phases run in fixed order with dependency enforcement; per-phase artifacts land in memory/ and feed the next phase.

Slash commands (5)

• /security-assessment:cross-repo-analysis

  Run cross-repo security analysis across two or more target paths. Composes service-comm-parser + shared-cred-hash-match + cross-repo-synthesizer to produce a named-attack-chain report.

• /security-assessment:export-pdf

  Convert a Markdown report to PDF via pandoc (preferred) or weasyprint (fallback). Skips gracefully if neither is installed.

• /security-assessment:redteam-model

  Adversarial ML red-team harness against a self-owned model endpoint. 7 probes + report. Rate-limited, budget-bounded, audit-logged.

• /security-assessment:security-assessment

  Full security assessment pipeline — recon, SARIF-first tool detection, judgment review, FP-reduction, narrative + compliance, service-comm diagram, exec report. Single-repo or multi-repo.

• /security-assessment:upgrade

  Check for and apply security-assessment plugin updates using the official Claude Code plugin update mechanism.

Subagents (13)

• authorization-logic-review

  Top-down authorization review. Maps the access-control model (RBAC/ABAC/ACL/tenancy), then verifies enforcement at every layer. Phase 1b peer agent.

• business-logic-domain-review

  Business-logic review for ML/fraud services. Detects the 9 patterns in knowledge/domain-logic-patterns.md (fail-open, score manipulation, emulation bypass, etc.). Phase 1b peer agent.

• compliance-edge-annotator

  Edge annotator for compliance findings whose pattern row has llm_review_trigger=true. Refines pattern-table citations; never invents new ones.

• cross-repo-synthesizer

  Synthesizes attack-chain narratives from multi-repo RECON + shared-cred matches + service-comm diagram. Produces named attack chains citing findings by ID. Does not detect.

• deep-code-reasoning

  Context-aware vulnerability detection beyond static patterns. RECON-scoped freeform reasoning about IDOR, confused deputy, TOCTOU, privilege escalation, workflow bypass. Phase 1b peer agent.

• exec-report-generator

  Synthesizes the publication-ready executive report from upstream artifacts. Emits a 7-section per-repo report (plus cross-repo summary for multi-repo runs).

• fp-reduction

  Applies the six-stage FP-reduction rubric to a unified-finding stream, producing a disposition register. Consumes findings + RECON (+ CPG when joern is available).

• recon-driven-scan

  Bridges RECON narrative risk claims to file/line evidence. Emits findings only when the source actually exhibits the described pattern. Phase 1b peer agent.

• redteam-evasion-analyzer

  Interprets probe 05 (evasion) alongside probe 03 (sensitivity) and probe 04 (boundaries). Rates adversarial realism, explains evasion mechanism, recommends defenses.

• redteam-extraction-analyzer

  Interprets probe 07 (model extraction) alongside probe 03 (sensitivity). Translates R² into extraction fidelity, extracts decision-rule structure, names IP-theft implications.

• redteam-recon-analyzer

  Interprets probe 01 (API recon). Severity-rates info leaks, identifies the framework, recommends a feature-discovery strategy for probe 02.

• redteam-report-generator

  Refines the red-team adversarial-report.md into an executive document. Assigns RED/AMBER/GREEN rating; produces remediation with effort estimates.

• tool-finding-narrative-annotator

  Weaves findings into four narrative domains (PII flow, ML edge cases, messaging auth, crypto). Prose for the exec report. Synthesizes; does not detect.