Access Control

springboot-security is a practical Spring Boot security guide for authentication, authorization, validation, CSRF/CORS, secrets, headers, rate limiting, and dependency checks. Use the springboot-security skill for Security Audit work or to harden a Java service with fewer security misconfiguration risks.

The security-scan skill audits your Claude Code .claude/ configuration for secrets, risky MCP setup, injection-prone instructions, dangerous bypass flags, and weak agent or hook definitions using AgentShield. Use it for repeatable security checks before committing or onboarding.

safety-guard helps prevent destructive operations when agents work autonomously or on production systems. It adds careful mode, write freeze mode, and guard mode to block risky commands, confine edits to one directory, and reduce mistakes during deploys, migrations, and sensitive repo work.

llm-trading-agent-security is a practical guide for securing autonomous trading agents with wallet authority. It covers prompt injection, spend limits, pre-send simulation, circuit breakers, MEV-aware execution, and key isolation to reduce financial-loss risk in a Security Audit.

The laravel-security skill is a practical Laravel security checklist for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment. Use it for audits, feature reviews, and hardening work in Laravel apps.

healthcare-phi-compliance helps review healthcare apps for PHI/PII risk across data models, APIs, logs, and access paths. Use it to check data classification, access control, encryption, audit trails, and common leak vectors for HIPAA, DISHA, GDPR, and related security audit needs.

django-security is a practical guide for hardening Django apps with authentication, authorization, CSRF, XSS, SQL injection prevention, secure cookies, and production settings. It helps developers and reviewers run a focused Security Audit, quickly spot risky config, and apply concrete fixes before deployment.

git-guardrails-claude-code adds a PreToolUse hook to block dangerous git commands before Claude Code runs them. Install it to prevent destructive pushes, hard resets, forced cleans, and branch deletes, with scoped control for this project or all projects. Useful when you need git-guardrails-claude-code for Access Control boundaries in Claude Code.

k8s-security-policies helps teams draft Kubernetes NetworkPolicy, Pod Security Standards labels, and RBAC patterns using repo-backed templates and references for hardening and audit-ready rollout planning.

auth-implementation-patterns is a practical skill for designing and implementing authentication and authorization patterns, including sessions, JWT, OAuth2/OIDC, RBAC, and access control checks for APIs and apps.

linkerd-patterns helps teams apply Linkerd patterns for Kubernetes workloads, including mTLS, sidecar injection, traffic splits, retries, timeouts, service profiles, and multi-cluster planning for Deployment-based rollouts.

mtls-configuration is a practical guide to designing and using mutual TLS for service-to-service security, certificate trust, rotation, handshake debugging, and Access Control in zero-trust or multi-cluster environments.

The secrets-management skill helps teams secure CI/CD secrets with Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, and native platform options. Use it to plan runtime secret retrieval, rotation, and least-privilege Access Control for pipelines.

agent-governance is a documentation-first skill for designing AI agent guardrails, policy checks, trust rules, tool restrictions, and audit logging for tool-using and multi-agent systems.

The security-and-hardening skill helps harden application code before release. Use it for user input, auth, sessions, sensitive data, file uploads, webhooks, and external services, with concrete checks like input validation, parameterized queries, output encoding, secure cookies, HTTPS, and secrets handling.

exploiting-kerberoasting-with-impacket helps authorized testers plan Kerberoasting with Impacket GetUserSPNs.py, from SPN enumeration to TGS ticket extraction, offline cracking, and detection-aware reporting. Use this exploiting-kerberoasting-with-impacket guide for penetration testing workflows with clear install and usage context.

exploiting-idor-vulnerabilities helps authorized security audits test Insecure Direct Object Reference flaws across APIs, web apps, and multi-tenant systems with cross-session checks, object mapping, and read/write verification.

detecting-azure-service-principal-abuse helps detect, investigate, and document suspicious Microsoft Entra ID service principal activity in Azure. Use it for Security Audit, cloud incident response, and threat hunting to review credential changes, admin consent abuse, role assignments, ownership paths, and sign-in anomalies.

detecting-aws-iam-privilege-escalation helps audit AWS IAM for privilege escalation paths using boto3 and Cloudsplaining-style analysis. Use it to identify dangerous permission combinations, least-privilege violations, and security audit findings before they become incidents.

The configuring-hsm-for-key-storage skill explains HSM-backed key storage with PKCS#11, SoftHSM2, and production HSM options. Use this guide for install, usage, key attributes, token setup, signing, encryption, and Security Audit evidence.

The configuring-aws-verified-access-for-ztna skill helps you design and configure AWS Verified Access for VPN-less zero trust network access with identity and device posture checks in Cedar. Use this configuring-aws-verified-access-for-ztna guide for access control planning, trust providers, group policies, and endpoint setup.

The configuring-active-directory-tiered-model skill helps design and audit Microsoft ESAE-style Active Directory tier separation. Use this configuring-active-directory-tiered-model guide to review Tier 0/1/2 access, PAWs, admin boundaries, credential exposure, and security-audit findings with clearer implementation context.

azure-identity-py helps set up Azure authentication in Python with Microsoft Entra ID. Use it to choose DefaultAzureCredential, managed identity, or service principal auth, configure environment variables, and troubleshoot access control and credential chain issues. Install guidance, usage patterns, and practical setup notes are based on the repo skill file.

The security skill creates PlantUML security architecture diagrams with AWS stencils for identity, encryption, firewalling, compliance, and threat detection. Use it for IAM flows, zero-trust designs, encryption pipelines, Security Audit diagrams, and review-ready documentation. It is not meant for general cloud infrastructure or generic UML modeling.