ricardocovo

Security scanning domain knowledge — OWASP Top 10, CWE mappings, IaC hardening, CI/CD pipeline security, supply chain controls, and SARIF output format

OWASP Agentic Security Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in AI agent systems - Brought to you by microsoft/hve-core.

OWASP CI/CD Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in continuous integration and continuous delivery environments - Brought to you by microsoft/hve-core.

OWASP Docker Top 6 vulnerability knowledge base for identifying, assessing, and remediating security risks in containerized Docker environments - Brought to you by microsoft/hve-core.

OWASP Infrastructure Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in internal IT infrastructure environments - Brought to you by microsoft/hve-core.

OWASP Top 10 for LLM Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in large language model systems - Brought to you by microsoft/hve-core.

OWASP MCP Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in Model Context Protocol environments - Brought to you by microsoft/hve-core.

Generate standardized per-repository documentation artifacts (Phase 1). Use when analyzing a single repository to produce identity cards, API contracts, data models, dependency manifests, event catalogs, configuration docs, deployment specs, architecture overviews, security profiles, domain context, operational profiles, pipeline specs, or runtime behavior profiles.

Analyze runtime observability data (distributed traces, structured logs, APM metrics) to generate runtime behavior documentation. Use when producing P1-13 runtime-behavior artifacts or P2-13 system runtime profiles. Covers OpenTelemetry, Jaeger, Zipkin, Application Insights, Datadog, New Relic trace analysis, structured log extraction, and APM metrics interpretation.

Design, implement, configure, debug, or review Google Authentication using OAuth 2.0 and OpenID Connect. Use for Google Sign-In, backend token validation, redirect URI setup, consent screen issues, refresh tokens, session mapping, and common auth failures such as invalid_client, redirect_uri_mismatch, invalid_grant, and audience mismatch.

Design, implement, configure, debug, or review read-only integrations with the YouTube API. Use for YouTube Data API v3, API keys, public channel and playlist reads, video metadata, search, pagination, partial responses, quota reduction, and common failures such as quotaExceeded, forbidden, invalidCredentials, and empty or inconsistent results.

Guides the Copilot CLI on how to use the WorkIQ CLI/MCP server to query Microsoft 365 Copilot data (emails, meetings, docs, Teams, people) for live context, summaries, and recommendations.