Tools tagged with "Security Review"

Guides authoring and reviewing Aspire.Hosting integration APIs. Classifies integration archetypes, then applies self-contained best practices for naming, resour

CLAIM-LEVEL grounding verification. Adapts the RAGAS faithfulness-eval pattern (proven in RAG literature) to docs/code instead of generated- answers/retrieved-c

Identify all files a specific author contributed to on a branch vs its upstream, tracing code through renames. Use when asked who edited what, what code an auth

CLAIM-LEVEL grounding verification. Adapts the RAGAS faithfulness-eval pattern (proven in RAG literature) to docs/code instead of generated- answers/retrieved-c

[Skill] Review an Azure Linux component definition for hygiene and best practices. Use when reviewing comp.toml files, checking overlay quality, validating file

OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks.

Fix all vulnerabilities on the current branch using npm audit. Local branch only — no ADO/GitHub queries.

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, s

Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle.

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pe

Review SynapseML Python and Scala code changes. Use before finalizing PR reviews or implementation changes to check security, compatibility, style, generated co

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pe

OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks.

OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks.

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pe

Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding.

OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks.

Use when an operator or a scheduled task requests a periodic cloud-cost / spend audit of the Zava Learning resource group — identify the top cost drivers, week-

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, s

Detect and remediate code-generation literal injection risks in Kiota writer code (wire names, serialization names, URL templates, base URLs, defaults, and path

Understand Microsoft technologies by querying official documentation. Use whenever the user asks how something works, wants tutorials, needs configuration optio

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, s

Activate when the user asks about APM (Agent Package Manager): installing, configuring, authoring, or troubleshooting AI-agent packages, dependencies, compilati

Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output.

OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks.

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pe

When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ON

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, s

Run a Godot/GDExtension finish pass over the current diff: enforce headless GDScript validation, public API docclasses coverage, docs/spec/sample/test synchroni

OWASP Docker Top 6 knowledge base for identifying, assessing, and remediating Docker container security risks.

Triggers deep architectural review across 15 Aspire-specific dimensions. Activated by requests for deep review, architectural review, pattern review, or PRs tou

Transformation rules and verification steps for upgrading Java 8/11 + Spring Boot 2.x applications to Java 21 + Spring Boot 3.x. WHEN: upgrade Java version, mig

OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks.

Activate for changes to project positioning, release communication, community-facing artifacts, or breaking-change decisions in microsoft/apm. Triggers on READM

Activate for changes to project positioning, release communication, community-facing artifacts, or breaking-change decisions in microsoft/apm. Triggers on READM