a2a-security-review
Review agent-to-agent (A2A) / multi-agent-system trust: peer identity and authentication, message integrity,…
Assess an AI model, feature, or dataset for bias and fairness across groups — representational and allocative harms, disparate performance, and skewed refusals — using appropriate fairness metrics, and recommend mitigations. Use when evaluating whether an AI system treats people
Claude Code
$ npx -y skills add jassics/awesome-claude-security --skill bias-fairness-assessment --agent claude-code
Codex
$ npx skills add jassics/awesome-claude-security --skill bias-fairness-assessment -a codex -y
Cursor
$ npx skills add jassics/awesome-claude-security --skill bias-fairness-assessment -a cursor -y
Gemini CLI
$ npx skills add jassics/awesome-claude-security --skill bias-fairness-assessment -a gemini-cli -y
GitHub Copilot
$ npx skills add jassics/awesome-claude-security --skill bias-fairness-assessment -a github-copilot -y
OpenCode
$ npx skills add jassics/awesome-claude-security --skill bias-fairness-assessment -a opencode -y
Windsurf
$ npx skills add jassics/awesome-claude-security --skill bias-fairness-assessment -a windsurf -y
name: bias-fairness-assessment description: >- Assess an AI model, feature, or dataset for bias and fairness across groups — representational and allocative harms, disparate performance, and skewed refusals — using appropriate fairness metrics, and recommend mitigations. Use when evaluating whether an AI system treats people equitably.
A fairness assessment that identifies where the system performs or behaves disparately across groups, quantifies it with suitable metrics, and proposes mitigations — distinguishing the *type* of harm.
lending, housing, moderation, healthcare). Fairness of *outcomes* matters most.
erasure, demeaning content, quality-of-service gaps). Fairness of *treatment*.
1. **Identify groups and context** — protected/sensitive attributes relevant to the use case and jurisdiction; note intersectional groups. Define what "fair" means *here* (it's context-dependent and metrics can conflict). 2. **Choose metrics** to match the harm:
parity, calibration — pick by which error is most harmful; they trade off.
stereotype rate, quality (accuracy/helpfulness) parity across groups. 3. **Measure** on a representative, consented dataset (watch for unrepresentative or skewed data — that's itself a finding). Report gaps with confidence. 4. **Diagnose sources** — data imbalance, label bias, proxy features, objective mismatch, feedback loops. 5. **Recommend mitigations** — data/representation fixes, reweighting/constraints, threshold adjustment, post-processing, human review, scope limits — and note residual disparity and metric trade-offs.
A fairness report: harm type · groups · metric · measured disparity · likely source · mitigation · residual/trade-off. Use `security-reporting`; visualize gaps with `security-diagramming:infographic`.
There is no single "fair" — metrics conflict and the right choice depends on which error harms people most in this context. State the chosen definition and why. Beware proxies: removing a protected attribute doesn't remove bias carried by correlated features.
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.
Review agent-to-agent (A2A) / multi-agent-system trust: peer identity and authentication, message integrity,…
Test the agent execution harness/runtime itself — LangChain/LangGraph, AutoGen, CrewAI, custom ReAct-style loops, or…
Assess an autonomous / tool-using AI agent for security end-to-end: tool privileges, autonomy and approval boundaries, excessive…
Test what an AI agent will actually do without human confirmation, including under injected-goal / prompt-injection scenarios, to…
Review the security of MCP (Model Context Protocol) servers/clients an agent uses: server trust tier, tool/resource description…
Inventory the tools/functions an AI agent can call and audit their privileges, side effects, and approval requirements to find…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…