All authors
Claude Skills by HermeticOrmus
github.com/HermeticOrmus108 skills4 installs145 views
- Api Auth PatternsSecure implementation patterns for API authentication and authorization: OAuth 2.0 flows, JWT best practices, API key handling with constant-time comparison, mTLS, session management, authorization middleware, token refresh, and rate limiting. Use when building or reviewing API auth code.Votes: 0GitHub stars: 4
- Detection EngineeringDetection engineering reference: the detection lifecycle and quality metrics, Sigma rule syntax and modifiers, YARA rule writing, a detection-as-code CI pipeline, and essential Windows detections. Use when writing, testing, or maintaining detection rules.Votes: 0GitHub stars: 4
- Threat Hunting MethodologyHypothesis-driven threat hunting framework with hunt categories, required data sources, worked hunts for DNS tunneling, lateral movement, and persistence, and a hunt documentation template. Use when planning, running, or documenting a threat hunt.Votes: 0GitHub stars: 4
- Recon MethodologyReconnaissance methodology for authorized bug bounty programs: passive recon (certificate transparency, search engine and code dorking, historical URLs), in-scope active recon (subdomain enumeration, live host probing, content and JavaScript analysis), and attack surface mapping. Use when scoping recon inside a program's published rules.Votes: 0GitHub stars: 4
- Vuln Report WritingGuide to vulnerability reports that get accepted and triaged: title writing, CVSS v3.1 scoring, reproduction steps, impact writing, the report lifecycle, chaining, evidence, and minimal PoC scripts. Use when drafting or reviewing a bug bounty or disclosure report.Votes: 0GitHub stars: 4
- Aws Iam PatternsAWS IAM reference: policy evaluation logic, policy types, least-privilege Lambda roles, permission boundaries, SCP guardrails, cross-account access with external ID, and IAM anti-patterns such as unconstrained PassRole. Use when writing or reviewing IAM policies.Votes: 0GitHub stars: 4
- Aws S3 SecurityS3 security reference: access control layers, encryption models, a secure bucket baseline in Terraform, TLS-only bucket policies, access points, and anti-patterns such as public buckets and ACL reliance. Use when configuring or auditing S3 buckets.Votes: 0GitHub stars: 4
- Azure Identity PatternsEntra ID security patterns: Conditional Access baseline policies, managed identities, Privileged Identity Management, certificate-based service principals, and anti-patterns such as permanent Global Administrator assignments and client secrets. Use when designing or reviewing Azure identity.Votes: 0GitHub stars: 4
- Gcp Iam PatternsGCP IAM reference: the permission model, role types, deny policies, least-privilege service accounts, Workload Identity Federation for CI, custom roles, domain-restricted sharing, and GKE Workload Identity. Use when writing or reviewing GCP IAM bindings.Votes: 0GitHub stars: 4
- Gdpr RequirementsGDPR reference for technology teams: key definitions, Article 5 principles, lawful bases, data subject rights, data protection by design, processor duties, breach notification, DPIAs, a SaaS compliance checklist, and a data deletion pattern. Use when building or reviewing systems that process EU personal data.Votes: 0GitHub stars: 4
- Soc2 ControlsSOC 2 Type II reference: the Trust Service Criteria, Common Criteria controls, evidence requirements, a readiness pattern, and common auditor requests. Use when preparing for a SOC 2 audit or designing controls to satisfy it.Votes: 0GitHub stars: 4
- Container Runtime SecurityContainer runtime isolation reference: namespaces, Linux capabilities, seccomp, AppArmor, user namespace remapping, hardened docker run and Compose examples, and anti-patterns such as --privileged, Docker socket mounts, and --pid=host. Use when configuring how containers run.Votes: 0GitHub stars: 4
- Dockerfile HardeningSecure Dockerfile patterns: base image hierarchy, multi-stage builds for Node.js and Go on distroless or scratch, BuildKit secret mounts, and non-root execution. Use when writing or reviewing a Dockerfile.Votes: 0GitHub stars: 4
- Crypto AlgorithmsAlgorithm selection guide: a decision tree for cryptographic choices, key size guidelines, modes of operation, and worked examples for authenticated encryption with libsodium, Argon2id password hashing, and Ed25519 signatures. Use when picking an algorithm, mode, or key size.Votes: 0GitHub stars: 4
- Key ManagementKey management reference: key lifecycle and types, storage security hierarchy, rotation strategy, envelope encryption, crypto-shredding, KMS access control, and anti-patterns such as keys in source code. Use when designing how keys are stored, rotated, or destroyed.Votes: 0GitHub stars: 4
- Ci Security PatternsReference pipelines for security scanning in GitHub Actions, GitLab CI, and Jenkins, plus pre-commit hooks, with stage ordering and design decisions. Use when adding or reviewing security stages in CI.Votes: 0GitHub stars: 4
- Security GatesSecurity gate reference: gate types, severity matrices, risk-based gating with CVSS, EPSS, and KEV, differential gating for new code, application-tiered gates, and an override process. Use when deciding when a finding should break the build.Votes: 0GitHub stars: 4
- Forensic MethodologyForensic methodology following NIST SP 800-86 and ISO 27037: the forensic process, order of volatility (RFC 3227), evidence integrity, KAPE triage collection, and disk imaging with dc3dd and ewfacquire. Use when collecting or preserving evidence during an investigation.Votes: 0GitHub stars: 4
- Memory ForensicsMemory forensics reference: acquisition tools (WinPMem, DumpIt, FTK Imager, LiME, AVML), Volatility 3 architecture, and triage patterns for processes, hidden processes, and injected code. Use when acquiring or analyzing a memory image during incident response.Votes: 0GitHub stars: 4
- Access Control ModelsRBAC, ABAC, and ReBAC (Zanzibar-style) reference with a decision framework, implementation patterns, a segregation-of-duties matrix, and anti-patterns such as role explosion and hard-coded authorization. Use when choosing or implementing an authorization model or fixing IDOR-style ambient authority.Votes: 0GitHub stars: 4
- Mfa ImplementationMFA reference covering factor types, NIST AAL levels, WebAuthn/FIDO2 registration, TOTP implementation, enforcement middleware with step-up auth, and bypass risks such as SMS SIM swap and prompt bombing. Use when adding or hardening multi-factor authentication.Votes: 0GitHub stars: 4
- Ir PlaybooksStep-by-step incident response playbooks (indicators, validation, containment, eradication and recovery, post-incident) for malware infection, account compromise, data breach, ransomware, DDoS, and insider threat. Use when responding to one of these incidents or writing its runbook.Votes: 0GitHub stars: 4
- K8s Rbac PatternsKubernetes RBAC reference: the Role and ClusterRole binding model, evaluation logic, escalation paths, least-privilege patterns for developers, CI/CD, monitoring, and break-glass access, plus common misconfigurations. Use when writing RBAC manifests or reviewing who can do what in a cluster.Votes: 0GitHub stars: 4
- K8s Security PoliciesPod Security Standards and Pod Security Admission, NetworkPolicy fundamentals with default-deny and service-to-service patterns, restricted-profile pod security contexts, and Kyverno examples. Use when hardening workloads or writing NetworkPolicy and admission rules.Votes: 0GitHub stars: 4
- Ioc PatternsIndicator of compromise taxonomy ranked by the Pyramid of Pain, extraction and defanging patterns, quality assessment, and structured formats such as STIX 2.1 for sharing. Use when extracting, prioritizing, or formatting IOCs from an investigation.Votes: 0GitHub stars: 4
- Malware Analysis MethodologyDefensive malware analysis workflow from safe handling in an isolated lab through triage, static analysis, dynamic analysis, and reporting with ATT&CK mapping and YARA, Snort/Suricata, or Sigma signatures. Use when planning or running an analysis of a suspected sample for incident response.Votes: 0GitHub stars: 4
- Mobile Crypto PatternsMobile cryptography patterns for Android Keystore and iOS Secure Enclave, Keychain, and CryptoKit: key storage, data-at-rest encryption, password key derivation, TLS and certificate pinning, and secure randomness. Use when implementing or reviewing crypto in a mobile app.Votes: 0GitHub stars: 4
- Owasp MasvsOWASP MASVS v2.0 reference covering every control group (storage, crypto, auth, network, platform, code, resilience) and how each maps to MASTG test cases. Use when scoping, testing, or reporting against the mobile verification standard.Votes: 0GitHub stars: 4
- Firewall PatternsFirewall design reference with iptables and nftables rulesets, cloud security group patterns, stateful versus stateless processing, and common rule mistakes. Use when writing or reviewing host or cloud firewall rules.Votes: 0GitHub stars: 4
- Network SegmentationNetwork segmentation strategies: trust zones, VLAN and DMZ design, micro-segmentation, and lateral movement prevention. Use when designing segmentation or assessing how far a compromise could spread inside a network.Votes: 0GitHub stars: 4
- Pentest MethodologyReference for PTES phases, the OWASP Testing Guide, and testing patterns by technology and vulnerability class, starting from pre-engagement authorization and rules of engagement. Use when planning or running an authorized penetration test and structuring its report.Votes: 0GitHub stars: 4
- Data Protection PatternsTechnical patterns for anonymization, pseudonymization, field-level encryption, data minimization, consent management, and data subject request automation, with the difference between anonymous and pseudonymous data. Use when implementing privacy controls in code or data pipelines.Votes: 0GitHub stars: 4
- Privacy By DesignThe seven Privacy by Design principles with software engineering practices for each, such as privacy requirements in specs, privacy-protective defaults, and separating identity from behavioral data. Use when designing features that handle personal data.Votes: 0GitHub stars: 4
- Adversary EmulationMethodology for threat-intelligence-based adversary emulation within written rules of engagement: lifecycle, TIBER-EU and MITRE emulation plans, safety controls, phased scenarios, and atomic testing with benign indicators. Use when designing an authorized emulation or purple team exercise.Votes: 0GitHub stars: 4
- Mitre Attack FrameworkMITRE ATT&CK Enterprise reference: tactics, key techniques with procedures, data sources, detection guidance, and mitigations. Use when mapping behavior to technique IDs, building detections, or planning authorized emulation.Votes: 0GitHub stars: 4
- Secret DetectionSecret detection reference: pattern, entropy, and verification approaches, formats of common credentials, gitleaks and trufflehog configuration, and false positive management. Use when setting up secret scanning or tuning its rules.Votes: 0GitHub stars: 4
- Vault PatternsSecret storage platform reference for HashiCorp Vault, AWS Secrets Manager, and GCP Secret Manager: architecture, platform comparison, the bootstrap problem, and access patterns. Use when choosing or configuring a vault or wiring applications to it.Votes: 0GitHub stars: 4
- Injection PreventionInjection prevention patterns for SQL, XSS, command injection, path traversal, LDAP, and template injection across major languages, including edge cases such as ORDER BY, IN clauses, and second-order injection. Use when writing or fixing code that builds queries, commands, paths, or HTML from input.Votes: 0GitHub stars: 4
- Secure Auth PatternsAuthentication and session implementation patterns: password hashing, session cookie settings, JWT validation and its pitfalls, and access control checks, with language-specific examples. Use when building or reviewing login, sessions, tokens, or authorization code.Votes: 0GitHub stars: 4
- Automated ResponseAutomated remediation and containment patterns (endpoint isolation, IOC blocking with allowlists and expiry, alert correlation, threat intelligence feed updates) and a framework for deciding when an action can run automatically and when it needs human approval. Use when designing response playbooks or containment automation.Votes: 0GitHub stars: 4
- Soar PatternsSOAR playbook design patterns, orchestration architecture components, a platform comparison, and integration strategies, including alert enrichment, phishing response, and automated severity scoring playbooks. Use when designing or reviewing security orchestration workflows.Votes: 0GitHub stars: 4
- Security Policy TemplatesReference templates and structure for common security policies (acceptable use, incident reporting, information classification), the policy, standard, procedure, and guideline hierarchy, regulatory mapping, review cycles, progressive enforcement, and exception management. Use when writing, customizing, or auditing security policies.Votes: 0GitHub stars: 4
- Social Engineering TaxonomyClassification of social engineering attack types, the psychological principles they exploit, recognition cues, and verification habits such as callbacks and multi-channel checks. Use when building awareness training content or teaching staff to recognize manipulation attempts.Votes: 0GitHub stars: 4
- Cis BenchmarksReference CIS Benchmark controls with audit and remediation commands for Linux (Ubuntu and Debian), Docker, Kubernetes, and AWS Foundations, plus hardening automation and a prioritization framework. Use when hardening a system or checking a configuration against CIS controls.Votes: 0GitHub stars: 4
- Log Correlation PatternsPatterns for correlating events across log sources to detect multi-stage attacks, lateral movement, credential abuse, and data exfiltration, including alert-on-alert, threshold anomaly, and kill chain correlation. Use when designing correlation rules or investigating activity that spans several systems.Votes: 0GitHub stars: 4
- Siem Query LanguagesReference for Splunk SPL, Elastic KQL/EQL, and Microsoft Sentinel KQL with security query examples, a cross-platform conversion cheat sheet, Sigma for write-once rules, and query performance tips. Use when writing or translating SIEM queries.Votes: 0GitHub stars: 4
- Defense StrategiesTechnical and human controls for preventing, detecting, and responding to social engineering across email, phone, SMS, and physical channels, including SPF, DKIM, DMARC, payment verification callbacks, dual authorization, and response procedures. Use when designing layered defenses or responding to a phishing or BEC incident.Votes: 0GitHub stars: 4
- Social Engineering AttacksTaxonomy of social engineering attack types with their psychological mechanisms, technical indicators, case studies, and detection patterns for phishing, BEC, and multi-channel attacks. Use when analyzing a suspected attack or explaining how one works so defenses can be designed.Votes: 0GitHub stars: 4
- Dependency Risk AssessmentMethodology for scoring dependency risk across vulnerability history, maintainer health, dependency depth, license compatibility, and provenance, with a triage matrix, a new-dependency evaluation checklist, automated monitoring, and a pinning strategy. Use when deciding whether to adopt, update, or replace a package.Votes: 0GitHub stars: 4
- Sbom GenerationReference for generating SPDX and CycloneDX SBOMs: NTIA minimum elements, Package URLs, Syft usage, CI generation in GitHub Actions, VEX enrichment, and diffing SBOMs between versions. Use when producing or automating SBOMs for compliance or release artifacts.Votes: 0GitHub stars: 4