bymax-qa

Plugin bymax-qa from marketplace bymax-agent-kit in bymaxone/bymax-agent-kit. Commands read from the repo's manifest — 2 days ago.

Skills (24)

• continuous-llm-red-teaming-with-promptfoo

  Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress. Use for continuous adversarial testing in CI/CD, a merge-blocking securit

• generating-and-analyzing-sboms

  Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embe

• hardening-docker-containers-for-production

  Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security, Hadolint, and Dockle. Use whe

• implementing-api-key-security-controls

  Implements secure API key generation with sufficient entropy, server-side

• implementing-api-rate-limiting-and-throttling

  Implements API rate limiting and throttling with token bucket, sliding

• implementing-api-schema-validation-security

  Implements API schema validation using OpenAPI Specification and JSON

• implementing-container-image-minimal-base-with-distroless

  Reduces container attack surface by building application images on Google distroless base images that ship only the application runtime - no shell, package manager, or OS utilities - using multi-stage build patterns plus debugging and scanning techniques adapted to distroless. Use when hardening con

• implementing-epss-score-for-vulnerability-prioritization

  Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than

• implementing-gdpr-data-subject-access-request

  Automates GDPR Data Subject Access Request (DSAR) workflows including

• implementing-infrastructure-as-code-security-scanning

  Implements automated security scanning for Infrastructure as Code using

• implementing-llm-guardrails-for-security

  Implements input/output validation guardrails for LLM applications using

• implementing-secret-scanning-with-gitleaks

  This skill covers implementing Gitleaks for detecting and preventing

• implementing-semgrep-for-custom-sast-rules

  Write custom Semgrep SAST rules in YAML to detect application-specific

• implementing-sigstore-for-software-signing

  Implements Sigstore-based software signing and verification using Cosign

• integrating-sast-into-github-actions-pipeline

  Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and merge-blocking quality gates for high-severity findings. Use when adding automated code vulnerability detection t

• scanning-docker-images-with-trivy

  Scans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF, CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image scan into CI/CD, or checking an image duri

• scanning-iac-and-images-with-trivy

  Scans container images, Infrastructure-as-Code (Terraform, CloudFormation,

• securing-agentic-ai-tool-invocation

  Implements defense-in-depth controls at an AI agent's tool-invocation

• securing-github-actions-workflows

  Hardens GitHub Actions workflows against supply chain attacks, credential

• verifying-build-provenance-with-slsa-sigstore

  Verifies artifact signatures and SLSA provenance using Sigstore's

• audit

  Whole-system QA and security audit of a project, run as the Security QA engineer of a peer agent team. Point it at a target: a Jira ticket key (it verifies Jira access first, reads the acceptance criteria, and reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR

• personas

  Persona-based usability QA of an app, run as if real people used it for weeks. It interviews you first (how many personas, iPhone Simulator or Android emulator or browser, how to reach a web app, markets, days to simulate), each question with suggested answers and a recommended one. Then it research

• security-audit

  Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/compr

• security-playbooks

  Defensive security playbooks for the project in front of you, loaded one at a time on demand: harden GitHub Actions, add secret scanning or SAST (Semgrep, CodeQL), scan IaC and container images (Trivy, Checkov), generate SBOMs and verify signatures or SLSA provenance, harden Dockerfiles, add API rat

Subagents (3)

• qa-hunter

  Read-only vulnerability finder for a security/QA audit, parameterized by domain (authentication, authorization/tenant isolation, input/injection, and others). Given a domain brief, the recon map and a diff or code scope, it traces attacker-controlled input to sinks and produces CANDIDATES — file:lin

• qa-recon

  Read-only reconnaissance agent for a security/QA audit. Given a project root, it detects the stack (language, HTTP framework, ORM/DB, cache, auth, telemetry, frontend), inventories every mounted HTTP route with its guards and public/authenticated status, and lists the trust boundaries. Returns a str

• qa-verifier

  Adversarial verifier for a security/QA audit. Given one candidate from a hunter, it tries to DISPROVE it — re-reads the cited code, traces the call path for the claimed data flow, looks for the guard/escape/upstream check the hunter may have missed, and checks the candidate against the six verificat

Hooks (1)

• PreToolUse

  bash ${CLAUDE_PLUGIN_ROOT}/hooks/qa-guard.sh

Similar plugins