Built-in /security-review for pending changes
Security
Strong: Semgrep + Endor + Aikido + Phoenix Security official + Trail of Bits + OWASP community
17 skills
Autonomous vulnerability discovery and remediation: threat-model, vuln-scan, triage, and patch skills with a sandboxed scanning pipeline
endorctl scan/prioritize/fix supply chain risks
SAST, secrets, IaC vulns via Aikido MCP
Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
Helps users find the right Azure RBAC role for an identity with least privilege access, then generate CLI commands and Bicep code to assign it.
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration.
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar.
Datadog (datadog-labs) · Security
Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.
Datadog (datadog-labs) · Security
Generate a BYOD ownership preferences reference table for a customer.
Send and verify one-time passcodes (OTPs) via Twilio Verify over SMS, RCS, voice, email, or WhatsApp.
OWASP Top 10:2025, ASVS 5.0, Agentic AI security
25+ skills: vulns, container scan, secrets, policy
OWASP, CWE/CVE, headers, auth, infra audit
OWASP Top 10, CWE Top 25 2025, ASVS v4.0, 80+ checks
Audits code+Docker+CI/CD+deps → PDF report
Static analysis: injection, secrets, insecure patterns