security-architect-aidefence

--- name: security-architect-aidefence type: security color: "#7B1FA2" extends: security-architect description: | Enhanced V3 Security Architecture specialist with AIMDS (AI Manipulation Defense System) integration. Combines ReasoningBank learning with real-time prompt injection detection, behavioral analysis, and 25-level meta-learning adaptive mitigation.

capabilities:

Core security capabilities (inherited from security-architect)

• threat_modeling
• vulnerability_assessment
• secure_architecture_design
• cve_tracking
• claims_based_authorization
• zero_trust_patterns

V3 Intelligence Capabilities (inherited)

• self_learning # ReasoningBank pattern storage
• context_enhancement # GNN-enhanced threat pattern search
• fast_processing # Flash Attention for large codebase scanning
• hnsw_threat_search # 150x-12,500x faster threat pattern matching
• smart_coordination # Attention-based security consensus

NEW: AIMDS Integration Capabilities

• aidefence_prompt_injection # 50+ prompt injection pattern detection
• aidefence_jailbreak_detection # AI jailbreak attempt detection
• aidefence_pii_detection # PII identification and masking
• aidefence_behavioral_analysis # Temporal anomaly detection (Lyapunov)
• aidefence_chaos_detection # Strange attractor detection
• aidefence_ltl_verification # Linear Temporal Logic policy verification
• aidefence_adaptive_mitigation # 7 mitigation strategies
• aidefence_meta_learning # 25-level strange-loop optimization

priority: critical

Skill dependencies

skills:

• aidefence # Required: AIMDS integration skill

Performance characteristics

performance: detection_latency: <10ms # AIMDS detection layer analysis_latency: <100ms # AIMDS behavioral analysis hnsw_speedup: 150x-12500x # Threat pattern search throughput: ">12000 req/s" # AIMDS API throughput

hooks: pre: | echo "🛡️ Security Architect (AIMDS Enhanced) analyzing: $TASK"

═══════════════════════════════════════════════════════════════

PHASE 1: AIMDS Real-Time Threat Scan

═══════════════════════════════════════════════════════════════

echo "🔍 Running AIMDS threat detection on task input..."

Scan task for prompt injection/manipulation attempts

AIMDS_RESULT=$(npx claude-flow@v3alpha security defend --input "$TASK" --mode thorough --json 2>/dev/null)

if [ -n "$AIMDS_RESULT" ]; then THREAT_COUNT=$(echo "$AIMDS_RESULT" | jq -r '.threats | length' 2>/dev/null || echo "0") CRITICAL_COUNT=$(echo "$AIMDS_RESULT" | jq -r '.threats | map(select(.severity == "critical")) | length' 2>/dev/null || echo "0")

if [ "$THREAT_COUNT" -gt 0 ]; then echo "⚠️ AIMDS detected $THREAT_COUNT potential threat(s):" echo "$AIMDS_RESULT" | jq -r '.threats[] | " - [\(.severity)] \(.type): \(.description)"' 2>/dev/null

if [ "$CRITICAL_COUNT" -gt 0 ]; then echo "🚨 CRITICAL: $CRITICAL_COUNT critical threat(s) detected!" echo " Proceeding with enhanced security protocols..." fi else echo "✅ AIMDS: No manipulation attempts detected" fi fi

═══════════════════════════════════════════════════════════════

PHASE 2: HNSW Threat Pattern Search

═══════════════════════════════════════════════════════════════

echo "📊 Searching for similar threat patterns via HNSW..."

THREAT_PATTERNS=$(npx claude-flow@v3alpha memory search-patterns "$TASK" --k=10 --min-reward=0.85 --namespace=security_threats 2>/dev/null) if [ -n "$THREAT_PATTERNS" ]; then PATTERN_COUNT=$(echo "$THREAT_PATTERNS" | jq -r 'length' 2>/dev/null || echo "0") echo "📊 Found $PATTERN_COUNT similar threat patterns (150x-12,500x faster via HNSW)" npx claude-flow@v3alpha memory get-pattern-stats "$TASK" --k=10 --namespace=security_threats 2>/dev/null fi

═══════════════════════════════════════════════════════════════

PHASE 3: Learn from Past Security Failures

═══════════════════════════════════════════════════════════════

SECURITY_FAILURES=$(npx claude-flow@v3alpha memory search-patterns "$TASK" --only-failures --k=5 --namespace=security 2>/dev/null) if [ -n "$SECURITY_FAILURES" ]; then echo "⚠️ Learning from past security vulnerabilities..." echo "$SECURITY_FAILURES" | jq -r '.[] | " - \(.task): \(.critique)"' 2>/dev/null | head -5 fi

═══════════════════════════════════════════════════════════════

PHASE 4: CVE Check for Relevant Vulnerabilities

═══════════════════════════════════════════════════════════════

if [[ "$TASK" == *"auth"* ]] || [[ "$TASK" == *"session"* ]] || [[ "$TASK" == *"inject"* ]] || \ [[ "$TASK" == *"password"* ]] || [[ "$TASK" == *"token"* ]] || [[ "$TASK" == *"crypt"* ]]; then echo "🔍 Checking CVE database for relevant vulnerabilities..." npx claude-flow@v3alpha security cve --check-relevant "$TASK" 2>/dev/null fi

═══════════════════════════════════════════════════════════════

PHASE 5: Initialize Trajectory Tracking

═══════════════════════════════════════════════════════════════

SESSION_ID="security-architect-aimds-$(date +%s)" echo "📝 Initializing security session: $SESSION_ID"

npx claude-flow@v3alpha hooks intelligence trajectory-start \ --session-id "$SESSION_ID" \ --agent-type "security-architect-aidefence" \ --task "$TASK" \ --metadata "{\"aimds_enabled\": true, \"threat_count\": $THREAT_COUNT}" \ 2>/dev/null

Store task start with AIMDS context

npx claude-flow@v3alpha memory store-pattern \ --session-id "$SESSION_ID" \ --task "$TASK" \ --status "started" \ --namespace "security" \ --metadata "{\"aimds_threats\": $THREAT_COUNT, \"critical_threats\": $CRITICAL_COUNT}" \ 2>/dev/null

Export session ID for post-hook

export SEC