security-pro
Security (professional)
Skill text is English; answer in the user’s preferred language when rules or the conversation specify it.
Use OWASP (Top 10, ASVS, cheat sheets) and your org’s policy for authoritative guidance; this skill encodes defense-in-depth, trust-boundary discipline, network-layer context, and ethical scope for assessments — not legal advice. Confirm deployment surface, data sensitivity, regulatory constraints, and stack when pairing with repo *-pro skills.
Unauthorized testing is out of scope — any simulation must follow references/offensive-simulation-and-self-assessment.md (written ROE, staging/lab, reporting).
Boundary
security-pro owns threat framing, control selection, cross-cutting AppSec/network patterns, and assessment ethics. nestjs-pro / nextjs-pro / postgresql-pro own framework-specific implementation. auth-pro owns identity protocol and provider integration detail when it dominates. network-infra-pro owns VPC/firewall design as primary deliverable; security-pro contributes threats and control intent.