Cyber360

Plugin cyber360 from marketplace cyber360 in rohasnagpal/cyber360. Commands read from the repo's manifest — 26 days ago.

Skills (42)

• ai-agent-security-reviewer

  Reviews AI, LLM, RAG and autonomous-agent systems against AISVS 1.0, OWASP LLM and Agentic risks, NIST AI RMF and NIST SP 800-218A. Use for model integrations, prompts, training data, embeddings, MCP, tools, memory or autonomous actions.

• application-security-reviewer

  Reviews web, backend and general application code against OWASP ASVS 5.0.0, OWASP Top 10 2025 and applicable CWE weaknesses. Use for application security, secure-code review, authentication, authorisation, injection, session, cryptography, logging or error-handling audits.

• cicd-security-reviewer

  Reviews CI/CD workflows, build runners, tokens, third-party actions, caches, artifacts, environments and release controls. Use for GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines and similar automation.

• cloud-container-security-reviewer

  Reviews Docker, Kubernetes, Helm, Terraform, cloud IAM, serverless and deployment configuration for exposure, privilege, secret and isolation failures. Use for cloud, container, Kubernetes or infrastructure-as-code audits.

• cyber-law-regulatory-advisor

  Analyses cyber incident, notification, preservation and regulatory duties for a specified jurisdiction using current primary legal sources. Use when legal consequences or deadlines are in scope.

• cyber-threat-intelligence-analyst

  Answers scoped threat-intelligence questions using provenance, corroboration and calibrated confidence. Use for indicators, campaigns, adversary behaviour or threat relevance.

• cybersecurity-team

  Coordinates Cyber360 Build, Hack, Investigate, Secure and Audit work using 30 specialist roles. Use for a broad request that is not limited to one specialist domain.

• data-security-database-architect

  Designs or reviews data architecture, database selection, schemas, isolation, retention, backup and recovery against actual product requirements.

• digital-forensics-evidence-reviewer

  Preserves and examines digital evidence with hashes, provenance, reproducible methods and chain of custody. Use for forensic images, logs, devices or evidentiary integrity questions.

• governance-risk-compliance-reviewer

  Maps security requirements to controls, owners, evidence, gaps, remediation and risk decisions. Use for framework assessments, control matrices, audit readiness or risk registers.

• hi-cyber-360

  Starts Cyber360 after installation. Use when the user says "Hi Cyber 360".

• identity-access-security-reviewer

  Reviews IAM, SSO, OAuth/OIDC, SAML, service accounts, workload identity, privileged access and identity lifecycle controls. Use when identity is a material trust boundary.

• incident-response-investigator

  Investigates suspected cybersecurity incidents, builds sourced timelines, tests competing hypotheses and plans containment and recovery. Use for incident response or compromise investigations.

• malware-analysis-reviewer

  Performs safe static analysis and, with express authority, isolated dynamic analysis of suspicious files. Use for suspected malware, malicious scripts or compromise artifacts.

• mobile-security-reviewer

  Reviews Android, iOS, Flutter and React Native applications using OWASP MASVS 2.1.0, MASWE, MASTG and Mobile Top 10 2024. Use for mobile source, manifests, permissions, local storage, deep links, WebViews or platform security.

• offensive-security-penetration-tester

  Plans or performs authorised penetration testing of running applications, APIs and infrastructure. Use for live security testing; do not activate live tests from a source-review request alone.

• open-source-license-compliance-reviewer

  Audits open-source and third-party licence use, attribution, notices, copyleft/source obligations and compatibility with the project's outbound licence and distribution model. Use for licence scans, dependency licensing, SBOM licence review, due diligence or release compliance.

• owasp-agentic-reviewer

  Reviews an agentic AI codebase (agents that plan and act with tools, memory, MCP servers, delegation or other agents) against the OWASP Top 10 for Agentic Applications 2026, all ten risks ASI01 Agent Goal Hijack to ASI10 Rogue Agents in 86 checks taken from OWASP's prevention and mitigation guidelin

• owasp-aisvs-reviewer

  Reviews an AI, LLM, RAG, agent or MCP codebase against the OWASP Artificial Intelligence Security Verification Standard (AISVS) 1.0 at Level 1, 2 or 3, scoring every in-scope requirement met, gap, unknown or not_applicable with file-and-line evidence and a one-line fix for each gap. Use for "review

• owasp-api-security-reviewer

  Reviews an API codebase against the OWASP API Security Top 10 2023 using 66 plain-language checks (API1 Broken Object Level Authorization to API10 Unsafe Consumption of APIs), scoring every item met, gap, unknown or not_applicable with file-and-line evidence and a one-line fix for each gap. Use for

• owasp-asvs-reviewer

  Reviews a web application or API codebase against the OWASP Application Security Verification Standard (ASVS) 5.0.0 at Level 1, 2 or 3, scoring every in-scope requirement met, gap, unknown or not_applicable with file-and-line evidence and a one-line fix for each gap. Use for "review this app against

• owasp-code-review

  Runs a full OWASP security review of a codebase by choosing which OWASP checklists apply (OWASP Top 10 2025, OWASP API Security Top 10 2023, OWASP Top 10 for LLM Applications 2026, OWASP Top 10 for Agentic Applications 2026, OWASP MASVS v2.1.0 for mobile apps and, on request, OWASP ASVS 5.0.0 and OW

• owasp-llm-reviewer

  Reviews code that calls a large language model against the OWASP Top 10 for LLM Applications 2026, all ten risks (LLM01 Prompt Injection to LLM10 Improper Output Handling) in 96 checks taken from OWASP's prevention and mitigation strategies, scoring every item met, gap, unknown or not_applicable wit

• owasp-masvs-reviewer

  Reviews an Android, iOS, Flutter or React Native app codebase against the OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0, scoring all 24 controls met, gap, unknown or not_applicable with file-and-line evidence and a one-line fix for each gap. Use for "review this mobile app a

• owasp-top10-reviewer

  Reviews a codebase against the OWASP Top 10 2025 using 99 plain-language checks (A01 Broken Access Control to A10 Mishandling of Exceptional Conditions), scoring every item met, gap, unknown or not_applicable with file-and-line evidence and a one-line fix for each gap. Use for "review this code agai

• pci-dss-readiness

  Prepares a system for PCI DSS v4.0.1 assessment by defining scope, controls, evidence, owners and gaps without claiming compliance or certification.

• privacy-data-protection-reviewer

  Maps personal-data processing and reviews minimisation, access, retention, sharing, transfers and security-related privacy duties. Use when personal data or privacy obligations are in scope.

• scalability-resilience-reviewer

  Designs or reviews scalability, capacity, availability, recovery and abuse resistance for a new or existing system.

• secure-design-documenter

  Creates or updates separate project design documents and ADRs after the user authorises file changes. Use when design decisions must be recorded without combining subjects.

• secure-product-discovery

  Defines product outcomes, users, assets, constraints, misuse cases and open decisions before architecture or implementation. Use when starting a project or clarifying an existing one.

• secure-system-designer

  Orchestrates product discovery, architecture, data, scalability, threat modelling and separate design documentation before coding or when reconstructing an existing system.

• security-architecture-designer

  Designs a secure target architecture or reconstructs an existing architecture with explicit trust boundaries, alternatives and security invariants.

• security-diff-reviewer

  Reviews a branch, pull request, commit or working-tree diff for newly introduced or newly reachable security risk and missing tests. Use for security PR review, change review or release gating.

• security-operations-detection-engineer

  Reviews telemetry and creates detection logic, alert triage procedures and response playbooks. Use for SOC coverage, logging gaps, SIEM rules or detection engineering.

• security-remediator

  Implements expressly authorised security fixes, hardening and regression tests for validated findings. Use only when the user asks to fix, remediate, patch or harden identified security problems.

• security-verifier

  Independently validates a security finding or remediation, tests bypasses and sibling paths, re-scores affected controls and reports residual risk. Use after a proposed finding, patch or claimed fix.

• slsa-reviewer

  Reviews a repository's build, release and source-control setup against SLSA v1.2 (Supply-chain Levels for Software Artifacts) Build track L1-L3 and Source track L1-L4, scoring every in-scope requirement met, gap, unknown or not_applicable with file-and-line evidence and a one-line fix for each gap.

• smart-contract-security-reviewer

  Reviews Solidity, Vyper, Move, Rust smart-contract programs, DeFi protocols, bridges, tokens and upgradeable systems using OWASP SCSVS, SCWE, SCSTG, Smart Contract Top 10 2026 and EEA EthTrust v3. Use for smart-contract, blockchain, Web3 or protocol security audits.

• soc2-readiness

  Prepares a system and organisation for SOC 2 readiness by mapping applicable criteria to controls, evidence, owners and operating periods without issuing an auditor opinion.

• supply-chain-security-reviewer

  Reviews software dependencies, registries, lockfiles, SBOMs, provenance, signatures and artifact integrity using NIST SSDF 1.1, SLSA 1.2 and CycloneDX 1.7. Use for dependency, package, build or software supply-chain audits.

• threat-modeler

  Creates an evidence-based security threat model, data-flow view, trust boundaries, abuse cases and chained attack paths for a repository, feature or architecture. Use for threat modelling, design review or attack-path analysis.

• vulnerability-exposure-manager

  Reviews components against current and historical vulnerability information and prioritises confirmed exposure. Use for CVE, SBOM, dependency or recurring vulnerability-management work.

Subagents (30)

• agentic-security-agent

  Reviews autonomous agents, MCP integrations, tools, memory, identities, delegation and human approval boundaries.

• ai-security-agent

  Reviews LLM, RAG, model, training-data and inference systems against AISVS, OWASP LLM risks and NIST AI guidance.

• api-security-agent

  Reviews REST, GraphQL, RPC, webhook and service APIs for object, property, function and business-flow security.

• application-security-agent

  Reviews web, backend and general application code against ASVS, OWASP Top 10, CWE and secure coding requirements.

• chief-cyber360-officer

  Leads Cyber360 across build, hack, investigate, secure and audit work, selects specialists, challenges evidence and delivers one coherent result.

• cicd-security-agent

  Reviews CI/CD workflows, runners, tokens, third-party actions, build permissions and release controls.

• cloud-container-security-agent

  Reviews containers, Kubernetes, Helm, Terraform, cloud IAM, serverless and deployment configuration.

• cyber-law-regulatory-agent

  Identifies jurisdiction-specific cyber incident, breach notification, evidence preservation and regulatory obligations from verified primary legal sources.

• cyber-threat-intelligence-agent

  Analyses threat actors, campaigns, infrastructure and indicators with explicit provenance, confidence and collection boundaries.

• data-security-database-architecture-agent

  Designs or reviews data classification, models, stores, database choices, access paths, retention, backup and recovery.

• digital-forensics-evidence-agent

  Preserves, examines and documents digital evidence using reproducible forensic methods and chain-of-custody controls.

• governance-risk-compliance-agent

  Maps security obligations to controls, evidence, owners, gaps, remediation plans and risk decisions without claiming certification.

• identity-access-security-agent

  Reviews customer, workforce and machine identity architecture, authentication, federation, privileges and identity lifecycle controls.

• incident-response-cyber-investigation-agent

  Investigates cybersecurity incidents, builds evidence-based timelines, tests competing hypotheses and plans containment, eradication and recovery.

• malware-analysis-agent

  Performs safe static analysis and expressly authorised isolated dynamic analysis of suspicious files and code.

• mobile-security-agent

  Reviews Android, iOS, Flutter and React Native code using MASVS, MASWE, MASTG and Mobile Top 10 guidance.

• offensive-security-penetration-testing-agent

  Plans and performs expressly authorised penetration tests of applications, APIs and infrastructure under defined rules of engagement.

• open-source-license-compliance-agent

  Reviews third-party software and content licences, attribution, notices, source-offer and copyleft obligations, and compatibility with the project's outbound licence and distribution model.

• privacy-data-protection-agent

  Maps personal-data processing and reviews data minimisation, access, retention, sharing, transfers and security-related privacy obligations.

• scalability-resilience-abuse-resistance-agent

  Designs or reviews capacity, performance, availability, failure recovery and resistance to deliberate resource abuse.

• secure-design-documentation-agent

  Maintains separate, traceable project design documents and ADRs without merging unresolved subjects or overwriting existing decisions.

• secure-product-discovery-agent

  Establishes what a new or existing product must do, who uses it, what it protects and which decisions remain open before architecture is chosen.

• security-architecture-design-agent

  Designs or reconstructs system boundaries, modules, trust zones, integrations, technology choices and security invariants.

• security-operations-detection-engineering-agent

  Reviews security telemetry and develops evidence-based detections, alert triage logic and incident response playbooks.

• security-remediation-agent

  Implements expressly authorised, minimal security fixes and regression tests while preserving intended behaviour.

• security-verification-agent

  Independently validates reported findings, proposed fixes, tests, standards mappings and residual risk.

• smart-contract-web3-security-agent

  Reviews smart contracts, DeFi protocols, bridges, upgradeability and Web3 operational dependencies using OWASP SCS and EthTrust guidance.

• software-supply-chain-agent

  Reviews dependencies, lockfiles, registries, SBOMs, build provenance, signatures and artifact integrity.

• threat-modeling-agent

  Builds evidence-based threat models, trust boundaries, abuse cases and chained attack paths for a repository or feature.

• vulnerability-exposure-management-agent

  Correlates component inventories with current and historical vulnerabilities, reachability, exposure, exploitation and remediation evidence.

Similar plugins