Explore skills

Data Protection Impact Assessment (DPIA / GEB) workflow against AVG Art 35 — trigger check (AP criteria and WP 248), systematic description, necessity, risk analysis from the data subject's perspective, measures and residual risk, prior consultation with the Autoriteit Persoonsgegevens.

Vendor security questionnaire workflow — vendor tiering, standardized questionnaires (CAIQ, SIG-Lite/Core, VSA), custom authoring, evidence reuse against existing attestations (SOC 2, ISO 27001), and ongoing vendor-risk monitoring.

Digital-forensics assistant for IR context — memory analysis via Volatility 3, disk-imaging hygiene (write-blocker, hash validation), timeline reconstruction via plaso/log2timeline, file-system artifacts per OS. Audit-grade evidence; courtroom-grade chain of custody requires additional specialized forensics work.

Structured red-team pass over your own output — surface assumptions, gaps, failure modes and security red flags before shipping.

Web vulnerability triage — JWT flaws (alg confusion, none alg, kid injection), deserialization (Java/Python/PHP/Ruby/Node), prototype pollution, OAuth misconfigs (redirect_uri, PKCE, scope), CSRF, DOM XSS, SSRF. Classification, impact assessment at pattern level, and handoff to remediation.

Step-by-step orchestrator for migrating a PrestaShop Legacy admin page to Symfony/CQRS. Covers the full lifecycle from audit to GA. Trigger: "migrate the Xxx admin page", "create CQRS for Xxx", "add a Symfony form for Xxx", "migrate AdminXxxController".

EU Digital Operational Resilience Act (2022/2554) compliance — scope (financial entities + critical ICT TPPs), five pillars (ICT risk management, incident reporting, resilience testing incl. TLPT, third-party risk, information sharing), and Dutch oversight via DNB/AFM.

Prevent OWASP Top 10 vulnerabilities in web applications. Activate whenever the user writes API endpoints, form handlers, database queries, authentication logic, file uploads, HTML rendering, or any code that handles user input or external data. Also activate when the user asks about security, hardening, or vulnerability prevention.

Run a comprehensive production readiness audit. Use when a user wants to check if their project is ready for deployment. Covers security, visual QA, code quality, testing, error handling, configuration/build, performance, and accessibility.

When the user wants a security audit, vulnerability assessment, or security hardening of their codebase. Use when the user says "security review," "security audit," "check for vulnerabilities," "is this secure," "pen test," "OWASP," "find security issues," "harden this," "check for leaks," "secrets scan," or before deploying any user-facing application. Performs a systematic security audit coverin

API security review against OWASP API Top 10 2023. Covers auth (OAuth2/JWT/API-keys), object-level authorization (BOLA/IDOR), schema validation, rate-limiting, CORS, SSRF, and GraphQL-specific concerns (introspection, query depth, batching).

OWASP-based security checklist any agent can reference when reviewing or writing code