mjcramerz/security-controls
Use this plugin for application, host, and supply-chain security control workflows.
Apply application security hardening controls such as input validation, authn/authz checks, safe subprocess patterns, security headers, and abuse-rate defenses. Use when the user asks to harden code paths, close security gaps, or implement secure defaults.
Use this skill for install, configure, and rotate Bitwarden Secrets Manager CLI (bws) for local Debian systems with keyring-backed secret storage. Use when the user asks for local BWS lifecycle operations outside CI/CD.
Configure AIDE file-integrity monitoring rules, baselines, and scheduled verification runs. Use when the user asks for host file integrity monitoring or tamper-detection setup.
Configure auditd rules and log capture policies with safe performance tradeoffs and compliance alignment. Use when the user asks for Linux auditing policy design or audit event tuning.
Configure CrowdSec collections, parser sources, and bouncer integration with safe enforcement defaults. Use when the user asks for CrowdSec detection or remediation setup.
Harden software supply-chain controls through dependency pinning, lockfile discipline, SBOM generation, and CI enforcement. Use when the user asks about dependency risk, provenance, or package security posture.
Configure USBGuard device authorization policies and rule sets for USB attack surface reduction. Use when the user asks for USB allowlist/denylist policy setup.
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.
Use this skill for repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.