Turn vague product requirements into clear, implementation-ready specifications. When key information is missing, Agile ScopeGuard Pro identifies gaps and asks focused questions before generating relevant deliverables such as PRDs, User Stories, Functional Specifications, Acceptance Criteria, QA Test Cases, API Specifications, Workflows, Risk Analysis, and Implementation Checklists. Built to reduce ambiguity, prevent Scope Creep, and minimize costly rework.
I specialize in safe Codex skill onboarding. This Agent inspects unclear websites, repositories, archives, file trees, snippets, and marketplace listings before installation. It explains candidate skills, identifies when Codex would use them, flags obvious installation risks, and requires explicit user confirmation before anything is downloaded or added to the skill library.
Defensive application-security auditing: turns a repo, manifest, or code snippet into an actionable report—dependency vulnerabilities, leaked secrets, insecure code patterns, and config hardening—mapped to OWASP Top 10 and ranked by severity. Finds risk and the fix only, never attack content.
Scan AI Skills and MCP servers before installation. Detect risky scripts, permissions, dependencies, network access, credential exposure, file changes, and suspicious configurations — then generate a clear evidence-based security report.
Audit AI agents, Skills, MCP configurations, tool permissions, and coding-agent setups for prompt injection, excessive agency, credential exposure, data leakage, unsafe code execution, supply-chain risks, memory risks, missing approval controls, and runaway autonomy. Get a calibrated Security Score, Audit Confidence, evidence-backed findings, remediation steps, verification checks, and residual-risk analysis.
I built this Skill to help users protect API keys, OAuth tokens and MCP credentials when working with AI agents in Codex Desktop, Claude Desktop and local automation environments. It combines static leak detection, vault preflight checks, runtime redaction, MCP-safe remediation, credential-store guidance and security reporting. The Skill is designed to reduce accidental secret exposure while preserving legitimate MCP and API workflows.
Your agent reads user-pasted text, web pages, retrieved docs, or tool output — and you can't tell which sentence an attacker wrote. A one-line "ignore malicious instructions" never held. This delivers a layered injection-defense design: threat model, attack-surface map, input/privilege/output defenses, canary tokens and a classifier, an adversarial red-team set with before/after, and residual risk plus an incident runbook.
Audits your test suite's output for silently vanished tests, unexplained skips, and suspiciously fast runs — turns green CI into a real signal.