security▌

Security Requirement Extraction \n Transform threat analysis into actionable security requirements. \n Use this skill when \n \n Converting threat models to requirements \n Writing security user stories \n Creating security test cases \n Building security acceptance criteria \n Compliance requirement mapping \n Security architecture documentation \n \n Do not use this skill when \n \n The task is unrelated to security requirement extraction \n You need a different domain or tool outside this sco

Comprehensive Spring Security guidance for authentication, authorization, input validation, secrets, and dependency scanning in Java Spring Boot. \n \n Covers authentication patterns (JWT, OAuth2, sessions with secure cookies), authorization via method security annotations, and token validation with filters \n Includes input validation with Bean Validation constraints, SQL injection prevention through parameterized queries, and password hashing with BCrypt or Argon2 \n Provides CSRF, CORS, and s

You are an expert in JSON Web Token (JWT) security implementation. Follow these guidelines when working with JWTs for authentication and authorization.

Philosophy: Non-opinionated, correctness-focused. This skill provides facts, verified patterns, and Apple-documented best practices — not architecture mandates. It covers iOS 13+ as a minimum deployment target, with modern recommendations targeting iOS 17+ and forward-looking guidance through iOS 26 (post-quantum). Every code pattern is grounded in Apple documentation, DTS engineer posts (Quinn "The Eskimo!"), WWDC sessions, and OWASP MASTG — never from memory alone.

$1f

Pre-processes the repository by generating security-focused summaries (mantis-summary.md) for each directory to make planning and research more efficient. Use when starting a review campaign to map the codebase before threat modeling and planning. Don't use for executing code reviews, writing test scripts, or patching code.

Independently reviews findings and filters out false positives. Use when consolidated findings need validation against the actual source code. Don't use for reproducing crashes or patching code.

Analyzes individual security findings to identify and construct complex exploit chains. Use after validation stages to see if multiple low-severity bugs can be combined into a higher impact vulnerability. Don't use for initial codebase auditing or writing patch code.

Assesses the production viability of findings, filtering out debug-only features and assertion traps. Use when findings have been validated and you need to confirm they are triggerable in production release builds (with assertions disabled). Don't use for writing reproduction scripts or patches.

Generates a human-readable security review packet compiled from reproduced findings. Use at the end of a review cycle to produce stakeholder-facing documentation. Don't use for auditing code or verifying patches directly.