Skill UI

A comprehensive skill for auditing service accounts across complex enterprise environments, including Active Directory, major cloud platforms (AWS, Azure, GCP), and databases. It identifies risks such as orphaned accounts, over-privileged access, and non-compliant credentials, ensuring adherence to industry standards like SOX, PCI DSS, and HIPAA. Used during security assessments and compliance reviews.

This skill guides the planning and review process for complex home or small-lab network changes. It covers creating staged migration plans for VLAN segmentation, implementing local DNS resolvers (like Pi-hole), setting up secure VPN access, and ensuring network safety through detailed inventory checks and rollback procedures. It emphasizes security best practices and trust zoning.

A risk-paranoid, mandatory review process designed to interrogate any plan that touches sensitive customer data, regulatory compliance, or production access. It forces consideration of critical security pillars including STRIDE threat modeling, blast radius quantification, detection mechanisms (MTTD), incident response runbooks, regulatory notification windows, and third-party vendor security posture. Essential before deploying features handling PII, PHI, or before compliance audits (SOC 2, HIPAA, GDPR).

This skill provides comprehensive management for Opencode's permission system. It allows users to review currently always-allowed commands, suggest safe read-only commands, and configure granular access controls using allow/deny/ask patterns. It is essential for optimizing security, performing system audits, and managing the operational scope of the agent.

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

A comprehensive security auditing tool designed to identify over-permissive Role-Based Access Control (RBAC) roles and potential service-account token abuse paths within a Kubernetes cluster. It systematically reviews cluster bindings, effective permissions, and common escalation primitives using advanced tools like `kubectl auth can-i`, `rbac-police`, and `rakkess`, ensuring adherence to the principle of least privilege.