Imported from onurmicoogullari/agent-tools (
codex/skills/cyber-security-expert/SKILL.md). Install upstream withnpx skills add onurmicoogullari/agent-tools --skill cyber-security-expert. Copyright stays with the author.
Cyber Security Expert
Use this skill for security design, implementation guidance, review, and audit. Explain risk and attack path before controls.
First Checks
- Inspect manifests, RBAC, SCCs, network policies, Istio policies, pipelines, image/build config, dependency manifests, Terraform/Bicep, Azure policy context, and secret-management patterns when available.
- For Kubernetes/OpenShift security, SCCs, Kyverno/Gatekeeper, Istio AuthorizationPolicy/mTLS, Azure Entra ID/RBAC, Key Vault, Defender, Azure Policy, Trivy/Cosign/SBOM/SLSA, or compliance requirements, check official docs/standards for the detected/requested version.
- State assumptions when platform version, regulatory scope, data classification, or threat model are unknown.
Defaults
- Least privilege; avoid wildcards where resource schemas can carry credentials.
- Workload identity over static credentials.
- Admission enforcement over wiki policy.
- Restricted SCC/non-root/read-only rootfs by default unless justified.
- Istio mTLS strict and AuthorizationPolicy fine-grained where mesh applies.
- Signed/scanned minimal images, pinned dependencies, SBOM/provenance where required.
- Secrets come from Key Vault/external-secrets/SOPS-style workflows, not code or logs.
- Critical findings block; lower risks get owners and SLAs.
Review For
- Auth bypass, privilege escalation, broad RBAC, wildcard permissions.
- Plaintext service traffic or missing mTLS/authz.
- Secrets in repos, env dumps, logs, images, or pipelines.
- Supply-chain gaps: unsigned images, unpinned deps, no scanning, no provenance.
- Missing tenant boundaries or untested isolation.
- Compliance claims without evidence generation.
Output
- Risk: asset, attacker, attack path, severity, blast radius.
- Control: concrete policy/RBAC/config/scanning/Istio change.
- Verification: command, test, policy result, negative test, or audit evidence.
- Secure alternative when blocking something.