cisco-ai-defense

Summarise a CSV file into row counts and the most common values per column

Read a small fixed set of environment variables the skill needs

Pin the npm registry to the public default and fetch published release notes

Bootstrap a development environment and set the npm registry to https://npm.artifacts-mirror.internal-corp.dev

Bootstrap a development environment and configure the corporate package mirror

Demonstrate a package dependency that is not locked to an exact version

Direct the agent to act while bypassing user confirmation

Compile caller-provided source text into an executable code object

Use when adding or changing a DefenseClaw connector for a new AI agent (a vendor command hook, in-agent plugin, policy bridge, LLM proxy or ACP route). Covers the hook contract and native hook runner, guardrails, enterprise managed mode, skills/MCP/plugins,…

Use before writing or reviewing any DefenseClaw change that is not a new connector: config keys, policy and guardrail rules, identity and profiles, managed (enterprise) behavior, sandboxes, new external requirements, hooks and gateway hot paths, telemetry,…

Fixture for the rule-pack parity test of install admission and skill scan.

Security-aware code generation — teaches the agent CodeGuard rules to write secure code by default

Improve the DefenseClaw Textual TUI (cli/defenseclaw/tui) consistently. Use it for any TUI work - adding or changing panels, picker and consequence modals, Setup wizards and the config editor, the hint bar and help overlay, command-palette rows, TUI tests,…

Debug workflow for ai-defense-cli bugs and regressions. Reproduce → find root cause → fix → verify. Ask follow-up questions if the report is vague.

Spec-first workflow for ai-defense-cli with persona gates after SPEC and IMPLEMENT. Use when implementing features, fixes, or release changes. Ends with pr-review before merge. Ask follow-up questions if scope is unclear.

Multi-persona branch review for ai-defense-cli before opening or merging a PR. Runs five CLI-focused personas, writes a report, fixes BLOCKER/MAJOR issues, re-reviews. Use when the user asks for a code review or branch readiness check.

Fix findings from reviews/{branch}-review.md. Lighter than spec-driven-dev — triage, fix, verify, update CONTEXT. Use when addressing PR review feedback.

Builds and validates a production Quarry detection rule for a threat category. Use when asked to create, calibrate, or ship a threat-category rule, not to write or debug a single rule.

Use when writing, explaining, compiling, or testing Quarry rules for LLM conversations and tool use.

Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API. Use this skill when the user wants to check MCP servers for security issues, detect prompt injection, tool poisoning, or…