The problem

Vulnerability scanners and generic security prompts often flag theoretical issues without understanding business logic, economic impact, or trust boundaries. This leads to noise, false positives, and remediation advice that developers cannot practically implement.

What it does

• Builds a structured threat model identifying assets, trust boundaries, and privileged roles before analyzing code.
• Audits complex DeFi logic including oracle dependencies, flash-loan risks, and economic insolvency scenarios.
• Evaluates web and API security surfaces for broken access control, tenant isolation failures, and injection risks.
• Analyzes AI agent architectures for prompt injection, tool abuse, and excessive permission risks.
• Generates detailed remediation plans with safe validation steps and invariant tests to verify fixes.

Frameworks & tools

Works across Solidity smart contracts, DeFi protocols, Web APIs, Cloud IAM (AWS/Azure/GCP), and AI agent frameworks. Covers security standards including OWASP Top 10 and DeFi-specific attack vectors.

Why this beats prompting it yourself

This skill enforces a rigorous auditor-grade methodology that separates confidence from severity. It stops you from chasing low-impact bugs by connecting every finding to a specific asset at risk and providing a concrete verification roadmap.

Use cases

• Perform a pre-audit security review of a new DeFi protocol or smart contract.
• Analyze an API specification for authorization bypasses and mass assignment risks.
• Audit an AI agent deployment for prompt injection and tool-calling safety.
• Review cloud infrastructure configurations for IAM over-privileging and secret leakage.

Known limitations

Requires authorized access to code or architecture docs. Will not generate offensive exploits or malware for live targets.