security▌

Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience.

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Use when the user asks to threat model a codebase or path, enumerate threats or abuse paths, or perform AppSec threat modeling. Do NOT use for general architecture summaries, code review, security best practices (use security-best-practices), or non-security design work.

'Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Use when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do NOT use for general maintainer lists, non-security ownership questions, or threat modeling (use security-threat-model).'

Perform language and framework specific security best-practice reviews and suggest improvements. Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help. Supports Python, JavaScript/TypeScript, and Go. Do NOT use for general code review, debugging, threat modeling (use security-threat-model), or non-security tasks.

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations.

Conducts multi-axis code review to assess code quality across correctness, readability, architecture, security, and performance before merging changes.

Safe read-only PostgreSQL audit workflow using https://postgresaudit.com/ for least-privilege setup, report interpretation, and remediation planning.

Security-audit skill that combines application security, infrastructure review, CI/CD checks, supply-chain scanning, LLM security, OWASP framing, and STRIDE analysis.

You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection points, unsafe DOM manipulation, and improper sanitization.

Category: test \n CloudFW Minimal Viable Test \n Prerequisites \n \n AK/SK and region are configured. \n GoalsSkill: skills/security/firewall/alicloud-security-cloudfw/ 。 \n \n Test Steps \n \n 先跑元数据 API 列表脚本。 \n 选择一个只读列表/详情 API 执行。 \n 记录请求摘要和响应摘要。 \n \n Expected Results \n \n 可拿到资源列表或明确无权限提示。 \n