Claude Skills by costrict-plugins-repo

Deploys XM Cyber's continuous exposure management platform to build

'Implements external attack surface management (EASM) using Shodan, Censys,

'Implements AWS Config managed and custom rules for continuous compliance

Configures AWS IAM permission boundaries that cap the maximum permissions

Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.

'Build AWS Nitro Enclave confidential computing environments using nitro-cli

'Deploy AWS Security Hub, backed by AWS Config, to aggregate findings

'Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS

Configure Microsoft Entra Privileged Identity Management (PIM) to convert

'Enable Microsoft Defender for Cloud (CSPM + CWPP) across VMs, containers,

'Implement Google''s BeyondCorp zero trust access model using Cloud

Implement RPKI-based BGP route origin validation by creating Route Origin

'Deploys remote browser isolation (RBI) as a core component of a Zero

'Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure

Assess, gap-analyze, and progressively implement the CISA Zero Trust

'Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft

'Continuously monitor multi-cloud environments (AWS, Azure, GCP) for

'Implementing AWS CloudTrail log analysis for security monitoring, threat

Implement multi-cloud CSPM to detect cloud-native misconfigurations

'Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF,

'Implements cloud workload protection using boto3 and google-cloud APIs

'Implements code signing for build artifacts (binaries, packages, containers)

Configures Microsoft Entra ID (Azure AD) Conditional Access policies for

'Implements secure conduit architecture for OT remote access under the

Reduces container attack surface by building application images on Google distroless base images that ship only the application runtime - no shell, package manager, or OS utilities - using multi-stage build patterns plus debugging and scanning techniques adapted to distroless. Use when hardening container images, cutting attack surface in a container architecture, or answering an assessment finding about bloated base images. Keywords: distroless, multi-stage build, no shell, nonroot tag, debu...

Uses Calico's own policy CRDs beyond the upstream Kubernetes API - GlobalNetworkPolicy, HostEndpoint, NetworkSet, policy tiers, and DNS-based egress rules - applied and audited with calicoctl. Use when a policy must span namespaces or protect the host itself, when egress has to be expressed by domain name, or when ordering policies into tiers. Keywords: calicoctl, GlobalNetworkPolicy, HostEndpoint, NetworkSet, tier, DNS egress, order. Do not use for portable upstream NetworkPolicy - use imple...

Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach,

'Implements DLP policies using Microsoft Purview PowerShell cmdlets and

Configure Cloudflare DDoS protection with managed rulesets, rate limiting,

Deploys and monitors Canary Tokens via the Thinkst Canary REST API for

'Implements Delinea Secret Server for privileged access management,

'Implements device posture assessment as a zero trust access control

'Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for

The Diamond Model of Intrusion Analysis provides a structured framework

Implements digital signatures using the Ed25519 algorithm (Curve25519), covering key-pair generation, signing, signature verification, and security tradeoffs versus RSA and ECDSA. Use when adding message or artifact signing and authentication-integrity checks to a system, or when advising on Ed25519 key properties and validation criteria.

'Implements full disk encryption using Microsoft BitLocker on Windows

Configures SPF, DKIM, and DMARC DNS TXT records to authenticate outbound email, prevent domain spoofing, and enforce a rejection/quarantine policy on unauthenticated mail, including auditing a domain's current DNS state. Use when hardening a domain's email security posture or defending against phishing and spoofing attacks.

Deploys and configures Dragos Platform sensors and detection analytics for OT/ICS network monitoring, using industrial protocol parsers and threat-intel packs to detect groups like VOLTZITE, CHERNOVITE, and KAMACITE. Use when standing up OT-specific network detection and response or an OT SOC, or integrating OT monitoring into an enterprise SIEM; not for IT-only or Claroty/Nozomi environments.

'Implements eBPF-based security monitoring using Cilium Tetragon for

Email sandboxing detonates suspicious attachments and URLs in isolated

Implements a simplified Signal Protocol-style end-to-end encryption scheme for messaging, covering key exchange, forward secrecy, and the core cryptographic components so no server or intermediary can decrypt messages. Use when designing or building E2EE messaging, or evaluating forward-secrecy and key-management tradeoffs for a messaging system.

Deploys and configures Wazuh SIEM/XDR for endpoint detection, covering agent authentication and management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, rule testing with wazuh-logtest, and automated active-response actions. Use when setting up endpoint detection and response, writing or testing custom Wazuh rules, or querying and triaging Wazuh alerts.

'Implements endpoint Data Loss Prevention (DLP) controls to detect and

Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume.

Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than CVSS severity alone.

Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems.

Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines, covering harness construction, AFL++/AddressSanitizer/CmpLog instrumentation builds, and persistent-mode fuzzing to discover memory-corruption and input-handling vulnerabilities in C/C++ code. Use when adding automated fuzz testing to a build pipeline or hunting for memory-safety bugs in native/compiled applications.

Implements GCP Binary Authorization end to end, including creating KMS-backed attestors, Container Analysis notes, deploy-time policies, and signing image attestations, so that only trusted, verified images deploy to GKE and Cloud Run. Use when enforcing container supply-chain integrity or deploy-time attestation checks on GCP.

Implements GCP Organization Policy constraints via gcloud and Terraform, such as restricting external IPs, resource locations, default service accounts, and service account keys, plus dry-run testing of policy impact before enforcement. Use when enforcing security guardrails across an org's resource hierarchy, or hardening GCP config at the org, folder, or project level.

Implements and audits GCP VPC firewall rules using gcloud, covering auditing overly permissive rules, creating restrictive ingress/egress rules, hierarchical firewall policies, and monitoring rule effectiveness with VPC Flow Logs. Use when deploying GCP workloads needing network access controls, auditing firewall configs, or responding to Security Command Center findings; not for Cloud Armor or DNS-based filtering.