50 skills published by UnitOneAI across 1 repository. Together they weigh 389 805 tokens — that is what loading all of them at once would cost you in context.
50 skills 389 805 tokens total
> Conducts access review and entitlement audit against CIS Controls v8 (Controls 5, 6) and NIST SP 800-53 AC family. Auto-invoked when reviewing entitlement certifications, orphaned accounts, role explosion, segregation of duties violations, or quarterly access recertification campaigns. Produces findings with severity, framework mapping, and remediation roadmap.
> Reviews agentic AI systems against the OWASP Top 10 security risks for autonomous AI agents. Auto-invoked when reviewing multi-agent architectures, AI agent deployments, or systems where LLMs have tool access and act autonomously. Covers permission models, tool security, memory integrity, trust boundaries, and human oversight. Produces a structured assessment with risk ratings and architectural recommendations.
> Reviews AI agent architectures for security risks including permission model design, least-privilege enforcement, human-in-the-loop gate placement, blast radius containment, audit trail completeness, rollback capability, and multi-agent trust boundaries. Auto-invoked when reviewing agentic AI systems where LLMs invoke tools, take autonomous actions, or operate in multi-agent configurations. Produces a structured architecture security assessment mapped to OWASP Agentic AI threats and NIST AI RMF 1.0.
> Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on user data, or deploy AI in regulated industries. Produces a structured assessment
> Guides structured triage of security alerts using a four-phase methodology (collect, correlate, classify, escalate) mapped to MITRE ATT&CK v16 and aligned with NIST SP 800-61 Rev 2 incident handling guidelines. Auto-invoked when the user discusses alert investigation, asks "is this a true positive?", or shares alert data requiring disposition. Produces a triage decision with priority assignment, disposition category, and escalation recommendation.
> Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication, rate limiting, and SSRF. Produces findings mapped to API1-API10 with remediation guidance.
> Application Security Engineer role bundle for security design, testing, and code review of applications. Orchestrates new application reviews, PR security reviews, API security assessments, and AI feature security reviews. Auto-invoked when the user needs help with application threat modeling, secure code review, API security testing, or evaluating the security of LLM-powered application features.
> Performs an AWS security posture review against the CIS Amazon Web Services Foundations Benchmark v3.0.0. Auto-invoked when reviewing AWS infrastructure, IAM policies, S3 configurations, CloudTrail settings, VPC security groups, or RDS encryption. Walks through all five benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
> Performs an Azure security posture review against the CIS Microsoft Azure Foundations Benchmark v2.1.0. Auto-invoked when reviewing Azure infrastructure, Entra ID configurations, NSG rules, Defender for Cloud settings, or Key Vault access policies. Walks through all nine benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
> Cloud Security Engineer role bundle for cloud security posture management, IaC review, container security, and identity governance across AWS, Azure, and GCP. Orchestrates cloud-specific posture reviews and zero trust program assessments. Auto-invoked when the user needs help with cloud security configuration, IaC hardening, container orchestrator security, or identity governance in cloud environments.
> Performs a container and Kubernetes security review against the CIS Docker Benchmark v1.6.0, CIS Kubernetes Benchmark v1.9.0, and NIST SP 800-190. Auto-invoked when reviewing Dockerfiles, Kubernetes manifests, Helm charts, or container orchestration configurations. Evaluates image security, runtime hardening, RBAC, Pod Security Standards, network policies, and secrets management. Produces a prioritized findings report with remediation guidance.
> Provides structured incident containment strategies mapped to NIST SP 800-61 Rev 2 and MITRE ATT&CK techniques. Auto-invoked when a confirmed incident requires isolation decisions, credential revocation, network segmentation, or DNS sinkholing. Produces a containment plan with short-term and long-term actions, business impact assessment, and ATT&CK-mapped countermeasures.
> Triages and prioritizes CVEs using CVSS 4.0, SSVC 2.1 decision trees, EPSS scores, and CISA KEV catalog cross-referencing. Auto-invoked when a CVE ID is mentioned, vulnerability scan results are shared, or the user asks "should we patch this?" Produces a prioritized remediation recommendation with SLA assignment and business risk context.
> Guide v4.2. Auto-invoked when reviewing OWASP ZAP configurations, DAST CI/CD integration, scan policies, or authenticated scanning setups. Produces a DAST maturity assessment covering scan policy configuration, active vs passive scanning, API scanning, authentication handling, and results deduplication.
> Analyzes project dependencies for known vulnerabilities, license risks, and supply chain integrity. Auto-invoked when package manifests (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml) are shared or when discussing dependency security. Produces an SBOM assessment with CVE findings triaged by EPSS and CISA KEV, license compliance check, and supply chain risk rating.
> Guides creation of detection rules using Sigma rule specification and the Palantir Alerting and Detection Strategy (ADS) framework, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user discusses detection logic, Sigma rules, ATT&CK coverage gaps, or asks "how do I detect this technique?" Produces Sigma-formatted detection rules, ADS documentation, and coverage heatmap methodology for systematic detection program management.
> Performs a structured DNS security review against NIST SP 800-81 Rev 2 (Secure Domain Name System Deployment Guide) and CIS Controls v8 (Control 9.2 -- Use DNS Filtering Services). Auto-invoked when reviewing DNS configurations, DNSSEC deployment, or investigating DNS-based exfiltration and tunneling indicators. Produces a DNS security assessment covering DNSSEC validation, protective DNS, and exfiltration detection patterns.
> Performs a structured firewall rule base audit against CIS Controls v8 (Controls 4.4 and 4.5) and NIST SP 800-41 Rev 1 (Guidelines on Firewalls and Firewall Policy). Auto-invoked when reviewing firewall configurations, ACLs, or network security policies. Produces a prioritized findings report covering overly permissive rules, shadowed rules, logging gaps, and egress filtering deficiencies.
> Guides digital forensic evidence collection following NIST SP 800-86 and RFC 3227 order of volatility. Auto-invoked when the user needs to collect forensic evidence, preserve chain of custody, capture volatile data, create disk images, or handle cloud forensics. Produces an evidence collection plan with volatility-prioritized acquisition steps, integrity verification, and chain-of-custody documentation.
> Performs a GCP security posture review against the CIS Google Cloud Platform Foundation Benchmark v2.0.0. Auto-invoked when reviewing GCP infrastructure, IAM bindings, VPC firewall rules, Cloud Audit Logs, or GCS bucket security. Walks through all seven benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
> Performs a HIPAA Security Rule compliance review against all Administrative, Physical, and Technical Safeguards defined in 45 CFR Part 164, Subpart C. Auto-invoked when discussing healthcare data security, ePHI protection, HIPAA audit readiness, or business associate compliance. Evaluates required and addressable implementation specifications, identifies gaps, and produces a remediation roadmap aligned to HHS enforcement priorities.
> Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or Pulumi configurations. Detects hardcoded secrets, public exposure patterns, encryption gaps, overly permissive IAM, and misconfigurations equivalent to Checkov, tfsec, and KICS rules. Produces a structured findings report with remediation guidance.
> Reviews identity and access management configurations against NIST SP 800-63B, NIST SP 800-207 zero trust principles, and CIS Controls v8. Auto-invoked when reviewing IAM policies, role definitions, user provisioning workflows, or when asked to assess identity security posture. Produces findings on least privilege violations, MFA gaps, stale accounts, and service account hygiene with prioritized remediation.
> Executes a structured incident response workflow based on NIST SP 800-61 Rev 2 and the SANS Incident Handler's Handbook. Auto-invoked when the user reports a security incident, asks how to respond to a breach, or needs help with incident classification, containment decisions, stakeholder notification, or evidence preservation. Produces an incident response plan with severity determination, containment decision tree, communication templates, and escalation criteria.
> (Clauses 4-10) and all 93 Annex A controls reorganized into four themes. Auto-invoked when discussing ISO 27001 certification readiness, ISMS implementation, or Statement of Applicability development. Identifies control gaps, scores implementation maturity, and produces a remediation roadmap aligned to the 2022 revision structure.
> Reviews LLM-powered applications against the OWASP Top 10 for Large Language Model Applications (2025 edition). Auto-invoked when reviewing code that integrates LLM APIs, builds RAG pipelines, or deploys AI-powered features. Produces a structured findings report mapped to LLM01-LLM10 with severity ratings, CWE mappings, and prioritized remediation guidance.
> Guides structured security log analysis across authentication, network, endpoint, and cloud audit log sources. Auto-invoked when the user shares log data, asks about suspicious events, needs help interpreting Windows Event IDs or Linux auth logs, or is establishing baselines for anomaly detection. Produces log source taxonomy, anomaly identification, baseline recommendations, and correlation findings mapped to MITRE ATT&CK v16 techniques.
> Reviews AI/ML model supply chains for security risks including model provenance verification, training data lineage, fine-tuning pipeline integrity, inference dependency review, and backdoor detection. Auto-invoked when reviewing systems that download pre-trained models, fine-tune foundation models, or deploy models from third-party sources. Produces a structured assessment mapped to OWASP supply chain techniques.
> Performs a NIST Cybersecurity Framework 2.0 assessment across all six functions (Govern, Identify, Protect, Detect, Respond, Recover) and their categories and subcategories. Auto-invoked when discussing cybersecurity maturity, risk posture evaluation, or NIST CSF alignment. Develops current and target organizational profiles, assesses maturity tiers, maps informative references, and produces a prioritized improvement roadmap.
> Auto-invoked when reviewing web application code, server configurations, or when a user asks for a general security review of a web application. Produces structured findings mapped to A01-A10 with CWE references, severity ratings, and specific remediation guidance.
> Prioritizes patches and manages remediation SLAs using SSVC 2.1 decision outcomes, EPSS v3 trend analysis, and CISA KEV catalog cross-referencing. Covers SLA frameworks by severity tier, compensating controls assessment, patch window scheduling, risk acceptance criteria, and exception management. Auto-invoked when users ask about patch scheduling, SLA compliance, risk exceptions, or remediation backlogs.
> Performs a PCI DSS v4.0 compliance review across all 12 requirements and their sub-requirements. Auto-invoked when discussing payment card security, cardholder data protection, PCI compliance validation, or merchant/service provider assessment. Covers scope reduction strategies, SAQ vs ROC determination, compensating controls, customized approach, and the new targeted risk analysis requirements introduced in v4.0.
> Reviews CI/CD pipeline configurations against SLSA v1.0 build levels and OWASP Top 10 CI/CD Security Risks. Auto-invoked when reviewing GitHub Actions workflows, GitLab CI configs, Jenkins pipelines, or when discussing supply chain security. Produces a pipeline security assessment with SLSA level determination and CICD-SEC risk findings.
> Conducts a structured post-incident review following NIST SP 800-61 Rev 2 Post-Incident Activity guidance. Auto-invoked when an incident has been resolved and the team needs to conduct a blameless retrospective, reconstruct the timeline, perform root cause analysis, document lessons learned, and track remediation actions. Produces a PIR report with metrics (MTTD, MTTR, MTTC), control failure mapping, and actionable improvement plan.
> Performs a Privileged Access Management (PAM) review against CIS Controls v8 (Controls 5.4, 6.5) and NIST SP 800-53 AC-6 (Least Privilege). Evaluates PAM tool effectiveness, just-in-time access patterns, break-glass procedures, session recording, and credential vaulting. Produces findings with severity, framework mapping, and remediation guidance.
> Covers direct injection (user input manipulating model behavior) and indirect injection (external content containing hidden instructions). Auto-invoked when reviewing LLM applications that process external content, build RAG pipelines, or accept user input that reaches a language model. Produces a test report with categorized findings and defense recommendations.
> Guides the design and assessment of RBAC and ABAC authorization models against the NIST RBAC model (Sandhu et al.) and NIST SP 800-162 (ABAC guide). Auto-invoked when designing role hierarchies, evaluating permission boundaries, implementing ABAC policy patterns, performing role mining, or preventing role explosion. Produces architecture recommendations with framework-grounded rationale.
> Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI integration patterns.
> Analyzes Software Bills of Materials (SBOMs) for completeness against NTIA minimum elements, interprets VEX status documents, performs transitive dependency risk analysis, and detects license conflicts. Supports CycloneDX 1.5 and SPDX 2.3 formats with CSAF-based VEX correlation. Auto-invoked when SBOM files are shared, supply chain risk questions arise, or VEX documents require interpretation.
> Tunes vulnerability scanners to reduce false positives, optimize scan policies, and improve result accuracy. Covers false positive identification patterns, scan policy configuration, authenticated vs unauthenticated scanning tradeoffs, severity override criteria, plugin/check selection, scan scheduling, and result correlation across multiple scanners. Uses CVSS 4.0 for severity validation and CWE for vulnerability classification.
> Performs a structured secrets management review against OWASP Secrets Management Cheat Sheet and NIST SP 800-57 Part 1 Rev 5 (Recommendation for Key Management). Auto-invoked when reviewing secret handling patterns, vault configurations, .env files, or credential rotation policies. Produces a secrets management assessment covering detection patterns, rotation automation, vault integration, and agent-specific credential handling.
> Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity ratings and specific remediation guidance.
> Security Engineer role bundle for building security into products and infrastructure. Orchestrates code review, pipeline hardening, vulnerability response, and infrastructure review workflows. Auto-invoked when the user needs help with secure development practices, CI/CD security, vulnerability management, or infrastructure security assessment. Sequences the appropriate security skills based on engineering engagement type.
> Performs a structured network segmentation review against NIST SP 800-207 (Zero Trust Architecture) and CIS Controls v8 (Control 12 -- Network Infrastructure Management). Auto-invoked when reviewing network architecture, VLAN configurations, micro-segmentation policies, or DMZ designs. Produces a segmentation maturity assessment with zone mapping, trust boundary analysis, and remediation guidance.
> Guides development of SIEM detection rules using KQL (Microsoft Sentinel) and SPL (Splunk) query languages, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user needs to write SIEM queries, tune alert thresholds, build correlation rules, or manage the detection rule lifecycle. Produces production-ready queries with detection logic patterns, threshold tuning guidance, and lifecycle management.
> Performs a SOC 2 Type II readiness gap analysis against AICPA Trust Services Criteria. Auto-invoked when discussing SOC 2 compliance, audit preparation, or security program maturity. Walks through all Common Criteria (CC1-CC9) plus selected additional criteria, identifies gaps, and produces a remediation roadmap with evidence requirements and 90-day action plan.
> SOC Analyst role bundle covering Tier 1 through Tier 3 operations. Orchestrates alert triage, threat hunting, incident investigation, and detection engineering workflows. Auto-invoked when the user needs help with security monitoring, alert analysis, threat hunting hypotheses, incident timelines, or detection rule development. Sequences the appropriate security skills based on the operational engagement type.
> Runs a structured STRIDE threat model on any system design, API specification, or codebase. Auto-invoked when the user discusses architecture, shares a system diagram or design document, or asks "what could go wrong?" Produces threat actor profiles, component-threat matrix, a threat register with STRIDE classification, data-flow diagram template, trust boundary identification, and prioritized mitigations mapped to MITRE ATT&CK techniques.
> Virtual CISO role bundle for organizations without a full-time CISO. Orchestrates security program assessment, compliance readiness, risk management, and board-level reporting. Auto-invoked when the user asks for security program guidance, compliance assessment, risk posture evaluation, or board reporting preparation. Sequences the appropriate security skills based on engagement type.
> Performs a Zero Trust Architecture maturity assessment against NIST SP 800-207 and the CISA Zero Trust Maturity Model v2. Evaluates all five CISA ZT pillars (Identity, Devices, Networks, Applications & Workloads, Data) across maturity stages. Covers microsegmentation readiness, continuous verification, and produces a pillar-by-pillar maturity scorecard with remediation roadmap.