4. Security & Compliance

Ensures trading decisions comply with constitutional risk management limits and manages portfolio risk exposure.

Validates agent skills against best practices and specification requirements to ensure compliance and quality before publishing or during audits.

Validates AI trading decisions against constitutional articles to ensure compliance with human-defined rules, acting as a secondary security check.

Guidelines for conducting security-focused code reviews to identify and mitigate vulnerabilities in software.

Automates security scanning to detect vulnerabilities including XSS, CSRF, hardcoded secrets, and OWASP Top 10 issues.

Generates and hosts compliant privacy policies for Android applications using GitHub Pages.

Reviews Semgrep security scan results to identify true positive vulnerabilities and filter out false positives with high confidence.

Enforces security guardrails by blocking secrets/credentials access and requiring confirmations for network and infrastructure operations in Claude Code.

Enforces safety checks and content filters to prevent harmful outputs from AI agents while maintaining compliance standards.

Analyzes security findings from semgrep, trufflehog, or manual reviews to determine exploitability and real-world impact of vulnerabilities.

Reviews artifact scan results to identify high-confidence security vulnerabilities, secrets, misconfigurations, and PII exposure in archives and backups.

Reviews and triages Trufflehog secret detection results, filtering false positives and prioritizing verified credential exposures with source code context.

Reviews KICS IaC scan results to identify and verify security misconfigurations using safe, read-only operations.

Performs static analysis, security scans, and dependency checks on .NET code to detect vulnerabilities and ensure code quality.

Conducts infrastructure security audits including secrets scanning, network policies review, IAM/RBAC audits, and compliance validation for cloud environments.

Generates custom Semgrep rules to detect specific security vulnerabilities, enabling tailored code analysis for organizations and novel attack vectors.

Validates user prompts and requests by checking assumptions, referencing documentation, and providing revised recommendations to ensure accuracy and safety.

Validates SOPS-encrypted secrets in files to prevent unencrypted secrets from being committed to version control, enhancing security compliance.

Scans codebase for hardcoded secrets, real .env values, and .gitignore misconfigurations to prevent accidental secret exposure before GitHub push.

Manages festival security through crowd control, threat assessment, emergency response, and staff coordination.

Conducts deep security audits of Solidity smart contracts with DeFi-specific vulnerability analysis and risk assessment.

Provides expert security architecture services including threat modeling, authentication, encryption, and regulatory compliance implementation.

Reviews security risks and mitigation strategies for remote WebF content, including untrusted bundles, URL allowlists, and clickjacking vulnerabilities.

Ensures WebF app compliance with App Store and Play Store policies, covering remote updates, interpreter usage, and rollout/rollback constraints.