secure-stack

Catch a pattern nothing else catches — author a custom, tested xgrep/Semgrep detection rule (including taint-mode dataflow), or port a rule to new languages

1 skill · 1 command

Fix xgrep security findings and prove each fix holds — one finding or a whole set (or the triage-confirmed true positives) — through the verify/apply harness

1 skill · 1 command

Secure AI services and AI tooling — scan OpenAI, Anthropic, vLLM, Databricks AI, and vector stores with cnspec, and govern approved AI agents/IDE-extensions/MCP servers, mapped to the OWASP LLM Top 10

1 skill · 1 command

Audit cloud account security posture — scan AWS, Azure, GCP, and Kubernetes against CIS foundations and Mondoo cloud policies with cnspec

1 skill · 1 command

Write it safely — avoid vulnerable patterns across 7 languages, aligned to OWASP Top 10:2025 and the OWASP Top 10 for LLM & GenAI 2025

1 skill · 1 command

Audit and harden operating systems and network devices — scan a Linux/macOS/Windows host, container image, or network device against CIS/vendor benchmarks with cnspec

1 skill · 1 command

Audit SaaS and identity-provider security posture — scan GitHub, GitLab, Okta, Google Workspace, Microsoft 365, Slack, Atlassian, and Snowflake with cnspec

1 skill · 1 command

Decide whether a security finding is real — classify xgrep scan results as true or false positives by tracing dataflow and call chains with the code graph

1 skill · 1 command

Understand an unfamiliar codebase before you change it — map structure, find definitions/callers, trace call chains, and assess a change's blast radius with xgrep's AST code graph

1 skill · 1 command

Verify and enforce security before code ships — scan code (SAST/SCA/secrets) with xgrep and IaC/config with cnspec, then triage and fix, mapped to OWASP Top 10:2025 and the OWASP Top 10 for LLM & GenAI 2025

1 skill

Runtime guard as the agent works — holds risky shell commands for your OK with xgrep, and feeds xgrep code findings and cnspec IaC policy violations back to the agent right after it writes a file