sec-arcade

Plugin sec-arcade from marketplace sec-arcade in cameronww7/skill-sec-arcade. Commands read from the repo's manifest — 20 days ago.

Skills (11)

• cargo-hold-cleanup

  Remediate a container image finding (base image OS package CVE, build-installed binary CVE, distro/base image swap, or image config issue like running as root or privileged mode), from ownership resolution through an applied, diffed fix. Parses Snyk CLI JSON, Snyk Container SARIF, or pasted console

• cartridge-scanner

  Inventory a repo from an AppSec recon perspective before any deep scanning starts, language and lines-of-code breakdown (via scc), package manager and dependency inventory (first-party vs. third-party surface), private/internal registry detection, Infrastructure-as-Code files, and containers. Ends i

• cloud-player-perm-audit

  Reviews one AWS account's IAM roles for overprovisioning (granted permissions that are never actually used) using free, local, read-only AWS data (IAM last-accessed reports, CloudTrail Event history, the account authorization export) plus cloudsplaining (required) and optionally parliament/pmapper,

• dead-weight-detector

  Analyze how much each direct OSS dependency is actually used in first-party code, cross-reference that against live maintenance-health signals from the package's own registry (release recency, maintainer count, download volume, known unpatched vulnerabilities), and recommend keep vs. replace with fi

• dungeon-crawl-threat-map

  Analyze a repo or codebase and produce a full threat model, an ASCII architecture diagram, a plain-language walkthrough of what it does, a "worth a second look" checklist of notable authentication, cryptography, and access-control call-outs, and a STRIDE-driven breakdown of threats mapped to the OWA

• mini-map

  Condense an existing dungeon-crawl-threat-map artifact (THREAT_MODEL.md) into a hard-capped, ~50-line MINI_MAP.md that other skills can load as quick background context, application overview, business logic invariants, and security mechanisms (auth, SSO, session handling, secrets, crypto), without p

• patch-boss-rush

  A fast, fully self-contained remediation pass on a single pasted security finding (SAST, SCA, Secrets, IaC, or DAST), no app-context loading, no dependency-health lookups, no delegation to any other skill in this plugin. Does its own compact sanity check, plans a fix, applies it on approval, shows t

• patch-for-the-high-score

  The full remediation workflow for a pasted security finding (SAST, SCA, Secrets, IaC, or DAST), from investigation through to an applied, diffed, optionally-PR'd fix. Loads app context from mini-map, investigates using the same evidentiary standard as player-two-verdict, judges SCA patch-vs-upgrade

• player-two-verdict

  Independently investigate a pasted security scanner finding (SAST, SCA, Secrets, IaC, or DAST) to determine if it's a true or false positive, using actual repo access rather than trusting the tool's verdict. Trigger this whenever the user pastes a security finding, vulnerability report, CVE, CWE, sc

• tilt-check

  Independently re-investigate a finding that has already been marked a False Positive, by an AI triage agent, another analyst, or an automated tool, to check whether that verdict actually holds up. Treats the FP call and its justification as an unverified claim, not fact, and actively hunts for a rea

• trim-reaper

  Reduces third-party dependencies with a security-first lens: finds confirmed-unused packages, standard-library and small-utility replacements, overlapping-library consolidation, heavy transitive trees, and dev/prod scope mistakes, then applies each approved change one at a time with build/test verif

Similar plugins