security-engineering

Plugin security-engineering from marketplace aiwg in jmagly/aiwg. Commands read from the repo's manifest — today.

Skills (28)

• auth-factor-design

  Decision aid for authentication factor architecture — have/know/are mapping, coercion resistance, FIDO2 PIN/UV policy, and PRF hot-path anti-patterns.

• banned-api-audit

  Scan source code for banned APIs/forbidden functions per project banlist; report violations with paths, line numbers, and recommended replacements

• binary-blob-audit

  Scan tracked repository files for committed binary blobs and report reviewability/provenance exceptions

• bun-release-age-gate

  Configure Bun's install.minimumReleaseAge gate (7-day default, 10-day high-sensitivity) for JavaScript projects on Bun. Includes Corepack-equivalent version detection and lockfile-caveat warning.

• cargo-supply-chain-audit

  Audit Rust/Cargo crates for supply-chain exposure: crates.io metadata + checksum verification against Cargo.lock, .crate tarball hash and .cargo_vcs_info.json provenance, previous-vs-patched .crate source diff, Cargo.toml dependency + build-script review, cargo audit / cargo deny / cargo vet trust p

• chain-of-trust-design

  Decision aid for bootstrap and verification chains — forces the 'what authenticates the authenticator' question; patterns for signed bootstrap, measured boot, recovery.

• ci-workflow-audit

  Audit CI workflow files for supply-chain risk — unpinned actions, unpinned container images, pull_request-triggered jobs with secret access, curl-pipe-shell installers, and bare :latest tags. Produces a structured markdown report with file:line refs.

• committer-2fa-audit

  Audit source-control organization settings for strong 2FA/MFA requirements across all committers

• confusable-unicode-audit

  Detect bidi controls, zero-width characters, mixed-script identifiers, and homoglyph risks in source and release metadata

• crypto-primitive-selection

  Decision aid for choosing AEAD, KDF, MAC, and signature primitives — flags anti-patterns (CBC-without-MAC, ad-hoc KDF, key reuse, PBKDF2-on-high-entropy).

• degraded-mode-design

  Decision-aid skill for fail-closed vs fail-open behavior. Forces a degraded-mode matrix and rejects "type Y to override" prompts in favor of multi-step ceremonies

• deprecation-policy

  Compare API/ABI surfaces between refs, flag incompatible changes, and generate deprecation/changelog notes for library projects

• dfir-readiness

  Use when a project needs DFIR readiness from the security-engineering side: prepare incident evidence handling, chain-of-custody expectations, IOC readiness, and handoff to forensics-complete without collecting evidence.

• fuzzing-in-ci

  Detect candidate fuzz targets and emit CI recipes for libFuzzer/AFL/cargo-fuzz/atheris/fast-check harnesses, plus OSS-Fuzz integration patterns

• host-hardening

  Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.

• npm-release-age-gate

  Configure and review npm min-release-age controls for JavaScript projects, including 7-day default gates, 10-day high-sensitivity profiles, npm version requirements, and safe override handling.

• npm-supply-chain-audit

  Audit npm projects for Shai-Hulud-class supply-chain exposure: lifecycle scripts, Git dependency prepare hooks, release-age gaps, publish-token exposure, trusted publishing, signed releases, and verifier docs.

• physical-threat-modeling

  Threat library for physical-access threats STRIDE and OWASP Top 10 miss — evil-maid, DMA, hostile peripheral, travel-host, coercion, cold-boot, side-channel.

• pnpm-release-age-gate

  Configure pnpm's minimumReleaseAge gate (7-day default, 10-day high-sensitivity) plus blockExoticSubdeps for workspace-scope dep-source enforcement. Includes Corepack detection and lockfile-caveat warning.

• sanitizer-in-ci

  Detect language/toolchain and emit CI job recipes that build with runtime sanitizers (ASan/UBSan/MSan/TSan, race detectors, faulthandler)

• secret-handling-runtime

  Decision aid for runtime secret hygiene — fd passing, scratch surface, error-path safety, identifier hygiene, and avoiding the SECRETS_ENV aggregation anti-pattern.

• security-disclosure-track

  Track private vulnerability reports from triage through fix, CVE coordination, embargo, publication, and post-disclosure closure

• security-engineering-quickref

  AUTO-INVOKE when user mentions cryptography, AEAD, KDF, chain of trust, signing key, auth factor, MFA, secret hygiene, supply chain trust, physical threat, DFIR readiness, or incident evidence handoff. Security-engineering quick reference — decision domains for crypto primitives, chain-of-trust, aut

• security-report

  Guide a reporter through filing a private vulnerability report and route it to the project's configured private channel — never to a public issue tracker

• strict-toolchain-audit

  Check build and CI configuration for warning-as-error, strict typechecking, and language-specific compiler/linter floors

• supply-chain-hardening-quickstart

  Orchestrate a pragmatic npm supply-chain hardening pass: dependency-source audit, release-age gate, lifecycle-script review, trusted publishing, signed releases, SBOM, and user verification docs.

• supply-chain-trust

  Decision aid for supply-chain trust beyond CVE/SBOM — pinning depth, reproducible builds, snapshot pins, firmware locking, and vendor+hash-lock for critical-path deps.

• yarn-release-age-gate

  Configure Yarn's npmMinimalAgeGate (7-day default, 10-day high-sensitivity) for JavaScript projects on Yarn 4.x or later. Includes Corepack detection and lockfile-caveat warning.

Subagents (2)

• Applied Cryptographer

  Narrow-scope reviewer for cryptographic primitive choices, key separation, KDF correctness, and CLI crypto invocation flags. Cites RFCs/NIST/CFRG sources in every finding.

• Secure Bootstrap Reviewer

  Narrow-scope reviewer for chain-of-trust integrity. Traces the boot/bootstrap chain from first byte executed to first secret derived, identifies trust anchors, flags circular trust, and validates signing key custody.

Similar plugins