Menu
Defensive security — reads red-team findings and systematically patches every vulnerability. Hardens code, adds input validation, fixes permissions, and verifies each fix. Works from the latest red-team report.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Skill para despachar tareas a agentes NIM/Groq/GitHub desde esta sesión CC. Habilita el Hermes Work Loop — CC orquesta, agentes B/B+ ejecutan.
Upload DOCX files from intl-reports to Google Drive Carpeta 3 using rclone. Zero reasoning — action only.
Launch an efficiency audit on modified Python files using Aider + Gemini 2.0 Flash. Analyzes bugs, efficiency, readability, and security. Saves report to database/audit_reports/.
Genera y entrega informes de internacionalización (Diagnóstico + Plan) para pymes españolas. Batch pipeline via Orchestrator v4 (core.cli) desde tmux externo. NUNCA empresa-a-empresa con Agent Haiku manual.
Adversarial security testing — attempts to break the codebase using real hacker techniques. Tests OWASP Top 10, prompt injection, MCP poisoning, dependency attacks, auth bypass, and vibe-coding-specific patterns. Generates exploit report. NEVER auto-invoked — user must explicitly request.
Run iterative red-team/blue-team cycles until the codebase is hardened. Each cycle runs /red-team, then /blue-team, then /red-team again to verify fixes hold. Stops when red-team finds 0 CRITICAL and 0 HIGH findings.
| name | blue-team |
| description | Defensive security — reads red-team findings and systematically patches every vulnerability. Hardens code, adds input validation, fixes permissions, and verifies each fix. Works from the latest red-team report. |
| command | /blue-team |
| allowed-tools | ["Bash","Read","Write","Edit","Grep","Glob"] |
| user-invocable | true |
| disable-model-invocation | true |
| experimental | true |
Read the latest red-team report and systematically fix every finding.
/blue-team # Fix all findings from latest report
/blue-team $ARGUMENTS # Fix specific finding (e.g. RT-001)
ls -t tasks/audit/red-team-*.md | head -1
Read and parse all findings.
Order: CRITICAL → HIGH → MEDIUM → LOW
Within same severity: kill chain findings first (they have multiplied impact).
| Finding type | Fix pattern |
|---|---|
| SQL injection | Replace f-strings with parameterized queries (?) |
| Command injection | Use shlex.quote() on user input, whitelist commands |
| Path traversal | Use pathlib.resolve() + check prefix matches allowed dir |
| XSS | Escape HTML output with html.escape() or template engine |
| Auth bypass | Add auth decorator/middleware to unprotected routes |
| Hardcoded secrets | Move to .env, use os.environ.get() |
| Debug exposure | Remove print(error), use logging with appropriate level |
| File permissions | chmod 600 on .env, .db, .pem, .key files |
| Missing validation | Add type checks, range checks, sanitization |
| Dependency vuln | pip install --upgrade {package} |
| Vibe-coding pattern | Rewrite the specific pattern with secure alternative |
After applying a fix:
python3 -m pytest tests/ -q
Generate: tasks/audit/blue-team-{date}.md
# Blue Team Report — {date}
Source: {red-team report filename}
## Fixes Applied
| ID | Finding | Severity | Fix | Verified | Tests |
|----|---------|----------|-----|----------|-------|
| RT-001 | SQL injection in db.py | CRITICAL | Parameterized queries | ✅ | ✅ |
| RT-002 | .env readable | HIGH | chmod 600 | ✅ | N/A |
## Kill Chains Broken
### Kill Chain 1: {name}
- Step broken at: {step N}
- Fix applied: {description}
- Chain now terminates at: {safe state}
## Remaining Risks
{Any findings that could not be fully fixed, with justification}
## Security Score
Before: {red-team score}/100
After: {blue-team score}/100
Improvement: +{delta} points
python3 -m pytest tests/ -q