| name | CyberSecurity Toolkit |
| description | Comprehensive cybersecurity arsenal integrating MITRE and NIST framework methodologies, NVIDIA SkillSpector vulnerability scanning, and deep SAST secret detection. |
CyberSecurity Toolkit Engineering Skill
You are equipped with the CyberSecurity Toolkit, a robust suite combining extensive agentic security behaviors, proactive vulnerability scanning, rate limit auditing, and uncompromising Static Application Security Testing.
1. Domain Capabilities and Frameworks
You are expected to utilize the skills library to perform security analysis, threat hunting, and infrastructure hardening. The library skills map deeply to the following frameworks. Refer to their official documentation for exact definitions and technique mappings:
2. SkillSpector Vulnerability Scanning
Before utilizing, installing, or executing any external agent skill or unverified script, you MUST scan it using SkillSpector to ensure safe boundaries.
- Delegation of Pattern Detection: The SkillSpector binary internally houses the logic for 68 vulnerability patterns. Do not attempt to guess or manually scan for these patterns.
- Usage: Execute the
skillspector scan command against the target directory and append the --format json parameter.
- Parsing the Output: You must read and parse the JSON output to determine the severity of the findings.
- Enforcement: Never install or execute skills exhibiting MEDIUM, HIGH, or CRITICAL severity findings from the SkillSpector output without explicit verification.
- Explicit Verification: If SkillSpector returns a MEDIUM, HIGH, or CRITICAL score, you must halt all autonomous execution and prompt the user via the terminal for a Y or N confirmation before proceeding.
3. Rate Limiting and Exploitation Defense Auditing
You must actively audit endpoints, login routes, and APIs for volumetric exploitation resilience.
- Execution: Do not write custom fuzzers. You must use the bundled
invoke-volumetric-audit script to perform these actions.
- Guardrails: You must strictly ensure simulated traffic does not cause unintentional denial of service to production infrastructure. When passing arguments to the script, never exceed a maximum of 10 concurrent requests or 5 login attempts.
4. Comprehensive Code Quality and Secret Detection Engine
You are equipped with a sophisticated Static Application Security Testing engine.
- Execution: Do not attempt to run raw regex queries. You must pass the target directory to the bundled
invoke-pii-hunter script to scan for the 160+ protected platforms, AD strings, and PII.
- Contextual Evaluation: If a secret is flagged, use the
get-secret-context script to retrieve the surrounding lines to determine if it is a false positive.
- Secret Redaction: You MUST redact or mask the actual values of any discovered secrets before passing data to the report compiler (for example
AKIA[REDACTED]). Display only the file path, line number, and secret type.
5. Operational Workflow
When engaged in a cybersecurity task:
- Identify the Operational Scope: Determine which of the following explicitly authorized scopes applies to the user's request: Code Security (SAST/DAST), Volumetric Resilience, Dependency Auditing, or Infrastructure Posture. Do not operate outside these defined scopes.
- Framework Alignment: Reference the appropriate MITRE or NIST framework documentation linked above.
- Workspace Initialization: Execute
init-audit-workspace to create a sandboxed /reports and /logs directory structure within the current working path. Restrict all scanning operations to this boundary.
- Scan Execution: Execute SkillSpector,
invoke-pii-hunter, and invoke-volumetric-audit as required by the scope. Output all findings with exact file paths and line numbers.
- Execution boundaries: Ensure script calls align with the host operating system constraints (using
.ps1 for Windows, .sh for Linux/macOS).
- Reporting: Pass your sanitized findings array (JSON) to the
compile-html-report script to generate the final artifact.
