/cybersecurity

name: cybersecurity
description: OSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with OSS.
license: MIT
metadata:
  keywords:
    - owasp
    - pentest
    - vulnerability
    - xss
    - ssrf
    - csrf
    - business-logic
    - host-header
    - open-redirect
    - forced-browsing
    - threat-modeling
    - stride
    - pasta
    - vast
    - mitre-att-and-ck
    - sigma
    - sast
    - code-audit
    - dalfox
    - owasp-zap
    - ffuf
    - nuclei
    - interactsh
    - mitmproxy
    - semgrep
    - detection-engineering
    - incident-response
    - ai-security
    - llm-red-team
    - prompt-injection

Cybersecurity

Overview

OSS-only unified cybersecurity skill: analyze, test, and harden software security using **exclusively open-source tooling**. Covers threat modeling, web-vulnerability testing (XSS, business logic, Host header, open redirect, forced browsing), SAST / code audit, AI/LLM-app security, and detection engineering (Sigma + MITRE ATT&CK).

Paid tools (Burp Suite, Nessus, Splunk, CrowdStrike, SonarQube, DOM Invader, Hackvertor) appear only as "if you already have it" notes — never as the primary path. For the full paid→OSS swap table, SEE: `references/oss-tool-map.md`.

This skill fills a gap in this repo: the 5 existing defensive plugins (`csrf-protection`, `xss-prevention`, `vulnerability-scanning`, `security-headers-configuration`, `defense-in-depth-validation`) tell you how to *fix* — this skill tells you how to *find, analyze, and threat-model*.

When to use

Use this skill whenever the user's task touches software security. Triggers include:

• Web/API vulnerability testing (XSS, business logic, Host header, open redirect, forced browsing, SSRF, CSRF).
• Code audit / SAST / secure-code review (any language).
• Threat modeling (STRIDE / PASTA / VAST), MITRE ATT&CK mapping, attack-surface analysis.
• Incident analysis and response reasoning (ransomware, breach, anomaly triage).
• Detection engineering: Sigma rules, MITRE ATT&CK coverage / gap analysis, ATT&CK Navigator layers.
• AI / LLM application security (prompt injection, OWASP LLM Top 10, agent safety, "vibe-coded" app audits).
• Compliance work (OWASP, CVE, GDPR / SOC2 / ISO27001).
• Replacing a paid security tool with an OSS alternative.
• Mapping a finding to a remediation pattern (cross-references the 5 defensive plugins).

**When NOT to use:**

• IT/infrastructure-only security operations (patching servers, firewall rules — see ORCHESTRATION exclusions).
• Malware analysis / reverse engineering of binaries (out of scope).
• Smart-contract / blockchain security beyond agent-safety review (Solana-specific skills excluded).
• Anything involving the user's permanently-excluded topics: malware, virus, supabase, openclaw, linux hardening, hardware spoofing, firewall config.

Execution model — router + dispatcher (NOT an executor)

**This skill is a ROUTER and DISPATCHER.** The main context stays a thin orchestrator (~this file). For every reference doc below, the orchestrator **dispatches a dedicated sub-agent** with the user's task and the matching reference doc as its briefing. The main context **never** inlines a reference doc's body.

Sub-agent dispatch contract

For each delegated task, the orchestrator:

1. **(If live-target)** Confirms the authorization gate has been acked for this target this session — see §"Authorization gate" below. 2. **Dispatches a sub-agent** with:

• **task:** the user's verbatim task plus any collected context (code, URLs, target scope, ack state).
• **briefing:** the contents of the matching `references/<doc>.md`.
• **model:** the **highest reasoning tier available** — preferred `gpt-5.6 sol` (pinned); fallback `claude-opus-4.x max` or `opus 5 max`. Pin the model + reasoning effort explicitly at dispatch (e.g. `model: "claude-opus-5-max"`, `reasoning_effort: "max"`). If neither tier is available, use the highest available tier and note the degradation in the dispatch log. Deep adversarial security reasoning needs the high tier — do not leave it to defaults.
• **tools:** the reference doc names which OSS tools the sub-agent may invoke.
• **return:** the reference doc's `## Sub-agent return contract` defines the output shape.

3. **Relays the sub-agent's output to the user verbatim** — do not summarize away severity, evidence, or remediation detail. 4. **(If live-target)** Does not auto-dispatch follow-up live-target tasks without re-confirming scope.

Fan-out for "audit everything" requests

When the user asks for broad coverage ("audit this codebase for security issues", "test this app for everything"), the orchestrator dispatches multiple sub-agents **in parallel** (single message, multiple dispatch tool calls) per `superpowers:dispatching-parallel-agents`:

• code-audit sub-agent (`references/aradotso-code-audit.md`)
• XSS sub-agent (`references/testing-xss.md`) — only if a web app
• business-logic sub-agent (`references/testing-business-logic.md`) — only if a stateful app
• AI-app sub-agent (`references/aradotso-ai-security.md`) — only if an LLM app
• (etc.)

The authorization gate fires **once up front** for the batch (covering all live-target sub-agents in the batch), not per sub-agent. The orchestrator merges all sub-agent outputs into a single report.

What stays in the main context (never delegated)

| Stays inline | Why | |---|---| | Routing decision (which reference matches this task) | Cheap; needs full task context. | | Authorization gate (`references/authorization-disclaimer.md`) | **Safety-critical.** The gate must fire *before* any sub-agent dispatch for live-target tasks. Delegating it would create a TOCTOU window where a sub-agent runs against a real host before ack is confirmed. | | Ack-state tracking (per-session, per-target-sco