/security-hardening

name: security-hardening
description: AIDefence security layer with prompt injection blocking, input validation, sandboxed execution, output sanitization, and STRIDE threat modeling.
allowed-tools: Read, Write, Edit, Bash, Grep, Glob, WebFetch, WebSearch, Agent, AskUserQuestion
graph:
  domains: [domain:software-engineering]
  skillAreas: [skill-area:agentic-loops, skill-area:orchestration-loop]
  workflows: [workflow:feature-development]
  topics: [topic:developer-experience]
  roles: [role:tech-lead, role:backend-engineer]

• When processing untrusted inputs
• Security audits of agent-generated code
• Compliance verification (OWASP Top 10, CIS)

AIDefence Layers

1. **Prompt Injection Detection** - Pattern + heuristic blocking 2. **Input Validation** - Path traversal, type coercion, parameter sanitization 3. **Static Analysis (SAST)** - Vulnerability scanning, CWE matching 4. **Sandboxed Execution** - Network isolation, filesystem restrictions, resource limits 5. **Output Sanitization** - Secrets, PII, injection vector redaction

Security Levels

| Level | Layers | Use Case | |-------|--------|----------| | standard | SAST + validation + sanitization | Routine audits | | elevated | + threat modeling + compliance | Pre-release audits | | maximum | + sandbox + full STRIDE + remediation | Critical systems |

Agents Used

• `agents/security-auditor/` - Vulnerability detection
• `agents/reviewer/` - Code quality verification

Tool Use

Invoke via babysitter process: `methodologies/ruflo/ruflo-security-audit`