cloudyrion-security

Plugin cloudyrion-security from marketplace cloudyrion-marketplace in cloudyrion/cloudyrion-security-marketplace. Commands read from the repo's manifest — 1 month ago.

Skills (13)

• api-security

  Review APIs for security vulnerabilities against the OWASP API Security Top 10 (2023). Accepts OpenAPI/Swagger specs, API code, or both. Analyzes authentication, authorization, data exposure, rate limiting, input validation, and business logic flaws. Generates a formal API Security Report with per-e

• architecture-review

  Review system architecture documents (HLD, LLD, design specs, diagrams) against security best practices, Secure by Design principles, and regulatory requirements. Identifies architectural anti-patterns, missing security controls, and design-level risks. Produces a formal Security Architecture Review

• attack-scenarios

  Design structured penetration test attack playbooks from architecture documents, code, threat models, or system descriptions. Produces an Attack Scenario Playbook with attack trees, step-by-step exploitation plans with tool commands, MITRE ATT&CK mapping, OWASP WSTG coverage, risk ratings, detection

• code-review

  Perform a full security code review with SAST scanning, taint analysis, CWE mapping, OWASP Top 10 coverage, and generation of a formal Security Code Review Report. Use this skill whenever the user asks to review code for security vulnerabilities, audit a codebase or file for security issues, prepare

• compliance-mapper

  Map security controls, findings, or risk registers across regulatory frameworks to produce a compliance cross-reference matrix. Supports NIS2, DORA, EU CRA, ISO 27001:2022, SOC 2, GDPR, BSI IT-Grundschutz, NIST CSF 2.0, and OWASP ASVS. Identifies compliance gaps where framework requirements have no

• iac-scanner

  Scan Infrastructure as Code files for security misconfigurations and compliance violations. Supports Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, Ansible, and ARM templates. Runs automated scanning (Checkov, trivy, tfsec), performs manual review for logic-level misconfi

• pentest-planner

  Turn the outputs of the security suite (architecture review, code review, API security, IaC scan, threat model, attack scenarios, risk register, SBOM) into an executable Penetration Test Plan. Builds an attacker model and a consolidated attacker-path diagram, then derives a prioritized test-case cat

• quick-scan

  Lightweight, developer-focused security scan that runs in under a minute. Checks for OWASP Top 10 patterns, hardcoded secrets, and known dependency vulnerabilities. Outputs a short actionable summary — not a full report. Use this skill when the user asks for a quick security check, wants to scan bef

• risk-register

  Create professional, audit-ready security risk register Excel files for any security domain — network, application, cloud, identity, data protection, OT/ICS, AI/ML, or custom topics. Use this skill whenever the user asks to create, review, quality-check, complete, or extend a security risk register,

• sbom

  Generate a Software Bill of Materials (SBOM) in CycloneDX or SPDX format, enrich it with vulnerability data, and produce a human-readable summary report. Use this skill whenever the user asks to create an SBOM, generate a software inventory, list dependencies for compliance, produce a CycloneDX or S

• suite

  Run the full security skills pipeline on a repository or system. Orchestrates all security skills in dependency order: detects which skills are relevant based on repo contents, runs them sequentially, passes outputs between skills, and produces a combined Security Suite Dashboard. Use this skill whe

• threat-model

  Generate a structured threat model from architecture documents, code, or system descriptions using STRIDE, PASTA, or MAESTRO methodology. Produces a formal Threat Model Report with data flow diagrams (Mermaid), threat catalog, MITRE ATT&CK / ATLAS mapping, risk ratings, and mitigation recommendation

• vibe-patch

  Read the most recent security-code-review report and generate minimal remediation patches for each finding using the Vibe Security Patching methodology. Commits one patch per finding with conventional commit messages, writes a formal Security Vibe Patch Report, and opens a PR. Use this skill wheneve

Hooks (3)

• PreToolUse

  command -v jq >/dev/null || { echo 'cloudyrion-security hooks need jq' >&2; exit 0; }; CMD=$(jq -r '.tool_input.command // empty'); [ -n "$CMD" ] || exit 0; printf '%s' "$CMD" | grep -Eq 'gh +pr +crea

• PostToolUse

  command -v jq >/dev/null || { echo 'cloudyrion-security hooks need jq' >&2; exit 0; }; FILE=$(jq -r '.tool_input.file_path // .tool_input.notebook_path // empty'); [ -n "$FILE" ] && [ -f "$FILE" ] ||

• PostToolUse

  command -v jq >/dev/null || { echo 'cloudyrion-security hooks need jq' >&2; exit 0; }; FILE=$(jq -r '.tool_input.file_path // .tool_input.notebook_path // empty'); [ -n "$FILE" ] || exit 0; case "$(ba

Similar plugins