Menú
Defensive security — reads red-team findings and systematically patches every vulnerability. Hardens code, adds input validation, fixes permissions, and verifies each fix. Works from the latest red-team report.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Skill para despachar tareas a agentes NIM/Groq/GitHub desde esta sesión CC. Habilita el Hermes Work Loop — CC orquesta, agentes B/B+ ejecutan.
Upload DOCX files from intl-reports to Google Drive Carpeta 3 using rclone. Zero reasoning — action only.
Launch an efficiency audit on modified Python files using Aider + Gemini 2.0 Flash. Analyzes bugs, efficiency, readability, and security. Saves report to database/audit_reports/.
Genera y entrega informes de internacionalización (Diagnóstico + Plan) para pymes españolas. Batch pipeline via Orchestrator v4 (core.cli) desde tmux externo. NUNCA empresa-a-empresa con Agent Haiku manual.
Adversarial security testing — attempts to break the codebase using real hacker techniques. Tests OWASP Top 10, prompt injection, MCP poisoning, dependency attacks, auth bypass, and vibe-coding-specific patterns. Generates exploit report. NEVER auto-invoked — user must explicitly request.
Run iterative red-team/blue-team cycles until the codebase is hardened. Each cycle runs /red-team, then /blue-team, then /red-team again to verify fixes hold. Stops when red-team finds 0 CRITICAL and 0 HIGH findings.
| name | blue-team |
| description | Defensive security — reads red-team findings and systematically patches every vulnerability. Hardens code, adds input validation, fixes permissions, and verifies each fix. Works from the latest red-team report. |
| command | /blue-team |
| allowed-tools | ["Bash","Read","Write","Edit","Grep","Glob"] |
| user-invocable | true |
| disable-model-invocation | true |
| experimental | true |
Read the latest red-team report and systematically fix every finding.
/blue-team # Fix all findings from latest report
/blue-team $ARGUMENTS # Fix specific finding (e.g. RT-001)
ls -t tasks/audit/red-team-*.md | head -1
Read and parse all findings.
Order: CRITICAL → HIGH → MEDIUM → LOW
Within same severity: kill chain findings first (they have multiplied impact).
| Finding type | Fix pattern |
|---|---|
| SQL injection | Replace f-strings with parameterized queries (?) |
| Command injection | Use shlex.quote() on user input, whitelist commands |
| Path traversal | Use pathlib.resolve() + check prefix matches allowed dir |
| XSS | Escape HTML output with html.escape() or template engine |
| Auth bypass | Add auth decorator/middleware to unprotected routes |
| Hardcoded secrets | Move to .env, use os.environ.get() |
| Debug exposure | Remove print(error), use logging with appropriate level |
| File permissions | chmod 600 on .env, .db, .pem, .key files |
| Missing validation | Add type checks, range checks, sanitization |
| Dependency vuln | pip install --upgrade {package} |
| Vibe-coding pattern | Rewrite the specific pattern with secure alternative |
After applying a fix:
python3 -m pytest tests/ -q
Generate: tasks/audit/blue-team-{date}.md
# Blue Team Report — {date}
Source: {red-team report filename}
## Fixes Applied
| ID | Finding | Severity | Fix | Verified | Tests |
|----|---------|----------|-----|----------|-------|
| RT-001 | SQL injection in db.py | CRITICAL | Parameterized queries | ✅ | ✅ |
| RT-002 | .env readable | HIGH | chmod 600 | ✅ | N/A |
## Kill Chains Broken
### Kill Chain 1: {name}
- Step broken at: {step N}
- Fix applied: {description}
- Chain now terminates at: {safe state}
## Remaining Risks
{Any findings that could not be fully fixed, with justification}
## Security Score
Before: {red-team score}/100
After: {blue-team score}/100
Improvement: +{delta} points
python3 -m pytest tests/ -q