Security · 22 configs

Security compliance and regulatory framework specialist. Use PROACTIVELY for compliance assessments, regulatory requirements, audit preparation, and governance implementation.

Use this agent when you need a security audit that is guaranteed to make no changes to the codebase. This agent has hooks in its frontmatter that block all Write, Edit, and Bash tool calls for the duration of the audit — enforcing read-only mode at the hook level, not just by convention. Invoke for compliance reviews, pre-merge audits, or any situation where auditability and non-interference are required.\n\n<example>\nContext: A compliance officer needs a security review of payment processing code without any risk of accidental modification.\nuser: \"Audit src/payments/ for PCI-DSS compliance issues. Don't touch anything.\"\nassistant: \"I'll run the read-only-auditor on src/payments/. My frontmatter hooks block Write, Edit, and Bash for the duration of this session, so no files can be modified regardless of what I find. I'll check for: unencrypted PAN storage, logging of card data, insecure TLS configurations, and missing input validation on payment fields.\"\n<commentary>\nUse read-only-auditor when the non-modification guarantee needs to be enforced at the system level, not just trusted by convention.\n</commentary>\n</example>

Automatically set up StackHawk security testing for your repository with generated configuration and GitHub Actions workflow

An AI security specialist focused on software supply chain threats: dependency

The Dynatrace Expert Agent integrates observability and security capabilities directly into GitHub workflows, enabling development teams to investigate incidents, validate deployments, triage errors, detect performance regressions, validate releases, and manage security vulnerabilities by autonomously analysing traces, logs, and Dynatrace findings. This enables targeted and precise remediation of identified issues directly within the repository.

Ask WG Code Sentinel to review your code for security issues.

Unified Comet Opik agent for instrumenting LLM apps, managing prompts/projects, auditing prompts, and investigating traces/metrics via the latest Opik MCP server.

API security audit specialist. Use PROACTIVELY for REST API security audits, authentication vulnerabilities, authorization flaws, injection attacks, and compliance validation.

SRE-focused Kubernetes specialist prioritizing reliability, safe rollouts/rollbacks, security defaults, and operational verification for production-grade deployments

Improve code quality, apply security best practices, and enhance design whilst maintaining green tests and GitHub issue compliance.

Use this agent when you need to design, validate, or harden forensic audit trails for AI coding agents (Claude Code, Cursor, Codex CLI, Aider) operating in regulated environments. Focuses on tamper-evident logging, hash-chain integrity, and framework mapping for the NIST AI RMF, EU AI Act Annex IV, HIPAA, and SOC 2 CC7. Specifically:\\n\\n<example>\\nContext: A healthcare company is rolling out Claude Code to engineering teams and legal is asking what audit evidence will be produced for HIPAA audits.\\nuser: \"We're approving Claude Code for 200 engineers but compliance wants proof of every prompt, tool call, and file diff touching PHI. What do we capture and how do we prove it wasn't edited?\"\\nassistant: \"I'll design an AI-agent audit architecture: hook-level capture of PreToolUse, PostToolUse, UserPromptSubmit, and Stop events into append-only JSONL with SHA-256 hash chaining and OS-level immutability (chattr +a / chflags uappnd). I'll map each event type to HIPAA §164.312(b) audit controls, define a verification procedure for auditors, and spec the SIEM pipeline so events land in Splunk or Elastic with tamper alerts.\"\\n<commentary>\\nInvoke ai-agent-audit-specialist when the question is specifically about auditing AI CODING AGENTS — not generic application logs. This agent understands Claude Code's hook model, the difference between prompt-capture and tool-call-capture, and what a regulator actually asks for.\\n</commentary>\\n</example>\\n\\n<example>\\nContext: A fintech team is preparing evidence for SOC 2 Type II and needs to show continuous monitoring of AI agent activity.\\nuser: \"SOC 2 auditor wants CC7.2 evidence that our AI coding agents are monitored. We have nothing right now.\"\\nassistant: \"I'll stand up the control: enable the agent's hook system to emit structured events, hash-chain each line so tampering is detectable, set retention to match the audit period, and wire alerting for hash-chain breaks and immutability-flag removal. I'll produce the auditor-facing control narrative mapped to CC7.2 and CC7.3, plus a re-verification script the auditor can run themselves.\"\\n<commentary>\\nUse this agent to translate abstract SOC 2 / ISO 27001 control language into concrete agent-hook configuration and verifiable evidence packages.\\n</commentary>\\n</example>\\n\\n<example>\\nContext: An EU-based defense contractor is preparing for EU AI Act Annex IV technical documentation requirements.\\nuser: \"EU AI Act applies to us from August. Annex IV wants a logging architecture description for any AI system touching classified workflows. What goes in that document?\"\\nassistant: \"I'll draft the Annex IV §2(c) logging description: event taxonomy (prompts, tool invocations, file reads, file writes, approvals, rejections), retention schedule, storage medium and tamper-evidence mechanism, access control model, and verification procedure. I'll also cross-reference Articles 12 (record-keeping) and 15 (accuracy, robustness) so the same logging substrate serves both.\"\\n<commentary>\\nInvoke when regulatory text mentions AI systems or automated decision-making AND the engineering question is specifically about what to log and how to prove it.\\n</commentary>\\n</example>

Our expert AI assistant for debugging code (O11y), optimizing vector search (RAG), and remediating security threats using live Elastic data.

Implement secure user authentication system with chosen method and security best practices

Security-focused code review specialist with OWASP Top 10, Zero Trust, LLM security, and enterprise security standards

GitHub Actions specialist focused on secure CI/CD workflows, action pinning, OIDC authentication, permissions least privilege, and supply-chain security

Use this agent when you need to red-team a Large Language Model deployment — jailbreak probes, prompt injection harness design, output-safety evaluation, and robustness evidence for EU AI Act Article 15 or NIST AI RMF MEASURE-2.7. Covers cloud-hosted models and on-prem / air-gapped local models (Ollama, vLLM, llama.cpp). Specifically:\\n\\n<example>\\nContext: A healthcare vendor embeds an LLM in a clinical triage tool and the compliance team wants a red-team report before rollout.\\nuser: \"We're deploying a Llama-3 70B behind a clinical assistant. Legal wants evidence it won't hand out harmful medical advice or leak PHI from retrieval context. How do we test it and document it?\"\\nassistant: \"I'll design an air-gapped red-team harness: a probe suite covering jailbreak families (DAN, role-play escalation, encoding attacks, prompt-leaking, indirect injection via retrieved docs), a scoring rubric aligned to the deployment's harm taxonomy, and a repeatable runner targeting your Ollama endpoint. Output is a robustness evidence pack: pass/fail table, example transcripts, coverage metric, and a control narrative mapped to NIST AI RMF MEASURE-2.7 and EU AI Act Article 15.\"\\n<commentary>\\nInvoke llm-redteam-specialist when the question is about evaluating an LLM's resistance to adversarial input — not generic web pentesting. This agent understands jailbreak taxonomies and the difference between a model-level test and a system-level test.\\n</commentary>\\n</example>\\n\\n<example>\\nContext: A defense contractor is running only local models (no external API calls allowed) and needs offline evaluation tooling.\\nuser: \"Air-gapped network. No HuggingFace, no OpenAI API. We still need quarterly robustness evidence for Llama-3 and Mistral instances. Build the test rig.\"\\nassistant: \"I'll spec an offline harness: probe corpus committed to the local repo, runner that targets localhost Ollama / vLLM endpoints, deterministic scoring (no model-as-judge calls outside the enclave), and a signed evidence bundle per run. Retention and signing align to the site's audit requirements. I'll pair this with a schedule for re-runs after every model or system-prompt change.\"\\n<commentary>\\nUse when the environment forbids cloud-hosted grader models and probe corpora must be self-contained.\\n</commentary>\\n</example>\\n\\n<example>\\nContext: A SaaS company received a prospect security questionnaire asking for evidence of prompt-injection testing.\\nuser: \"Enterprise prospect wants evidence we test for prompt injection. What do I send them?\"\\nassistant: \"I'll produce a prompt-injection test report: scope (which endpoints and retrieval paths were tested), probe inventory with OWASP LLM Top 10 references, results table, severity rubric, and remediation status per finding. I'll also flag the gap between direct-injection and indirect-injection coverage so the evidence is honest.\"\\n<commentary>\\nInvoke for LLM-specific adversarial evidence — distinct from penetration-tester which covers web/network.\\n</commentary>\\n</example>

Terraform infrastructure specialist with automated HCP Terraform workflows. Leverages Terraform MCP server for registry integration, workspace management, and run orchestration. Generates compliant code using latest provider/module versions, manages private registries, automates variable sets, and orchestrates infrastructure deployments with proper validation and security practices.

Scan codebase for exposed secrets, credentials, and sensitive information

Audit dependencies for security vulnerabilities, license compliance, and update recommendations

Perform comprehensive security assessment and vulnerability analysis

The dedicated Application Security agent for automated security remediation. Verifies package and version compliance, and suggests vulnerability fixes using JFrog security intelligence.

Perform penetration testing and vulnerability assessment on application