Menu
Usar cuando se necesita auditar la seguridad de un proyecto con pipeline Red Team / Blue Team.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
Detecta el Bus Factor por modulo en un repositorio git usando el algoritmo CST(change-size-ratio). Genera JSON con BF, owners, riesgo, y avisa cuando un solo dev conoce un modulo critico.
Genera CONTEXT_DOME.md para modulos con Bus Factor bajo. Captura conocimiento tacito: proposito, decisiones no obvias, dependencias, runbook minimo, knowledge owners y plan de distribucion.
Usar cuando se quiere ejecutar tareas de bajo riesgo de forma autónoma durante la noche.
Mapear la superficie de ataque de un dominio: subdominios, OSINT, typosquatting.
| name | adversarial-security |
| description | Usar cuando se necesita auditar la seguridad de un proyecto con pipeline Red Team / Blue Team. |
| summary | Pipeline Red Team + Blue Team + Auditor independiente. Scoring CVSS, mapeo STRIDE, gap analysis. Output: informe con score 0-100 y recomendaciones. |
| maturity | stable |
| context | fork |
| context_cost | medium |
| agent | security-attacker |
| category | governance |
| tags | ["security","adversarial","red-team","blue-team"] |
| priority | high |
| trigger | {"type":"keyword","keywords":["vulnerabilidad","pentest","sql injection","xss","inyeccion","security audit","red team","blue team"]} |
If you were dispatched as a subagent to execute a specific delegated task, skip this skill's full orchestration workflow. Execute only the assigned task, report result (DONE / DONE_WITH_CONCERNS / BLOCKED), and return. This guard prevents runaway skill activation in nested agent contexts.
Doble opt-in (SPEC-186): → si no: ❌ ABORT
bash scripts/savia-double-optin-check.sh \
--skill adversarial-security --confirm-autonomous
Requiere AMBOS: ADVERSARIAL_SECURITY_ENABLED=true Y flag explicito.
CVSS simplificado para proyectos internos:
| Factor | Peso | Valores |
|---|---|---|
| Attack Vector | 0.3 | Network (1.0), Adjacent (0.7), Local (0.5), Physical (0.2) |
| Complexity | 0.2 | Low (1.0), High (0.5) |
| Privileges | 0.2 | None (1.0), Low (0.6), High (0.3) |
| Impact | 0.3 | High (1.0), Medium (0.6), Low (0.3) |
score = sum(factor × peso) × 10 → escala 0-10
| Categoría | Pregunta clave | Controles típicos |
|---|---|---|
| Spoofing | ¿Puedo suplantar a otro? | Auth, MFA, tokens |
| Tampering | ¿Puedo modificar datos? | Integridad, signing, HMAC |
| Repudiation | ¿Puedo negar una acción? | Audit logs, timestamps |
| Info Disclosure | ¿Puedo acceder a datos? | Encryption, access control |
| DoS | ¿Puedo tumbar el servicio? | Rate limiting, WAF |
| Elevation | ¿Puedo escalar privilegios? | RBAC, least privilege |
# npm: audit de dependencias
npm audit --json 2>/dev/null | jq '.vulnerabilities | length'
# pip: safety check
pip-audit --format=json 2>/dev/null
# dotnet: audit
dotnet list package --vulnerable --format json 2>/dev/null
score = 100 - (critical×25 + high×10 + medium×3 + low×1) Cada fix verificado recupera los puntos. Floor: 0.