Skip to content

plugin: add cybersecurity skills and prepare v9.13.0#148

Merged
gaelic-ghost merged 7 commits into
mainfrom
security/cybersecurity-skills-plugin-plan
Jul 14, 2026
Merged

plugin: add cybersecurity skills and prepare v9.13.0#148
gaelic-ghost merged 7 commits into
mainfrom
security/cybersecurity-skills-plugin-plan

Conversation

@gaelic-ghost

Copy link
Copy Markdown
Owner

Summary

  • add the installable, guidance-only cybersecurity-skills plugin with 30 workflows spanning safe triage, malware analysis, macOS defense, authorized testing, incident response, hunting, and detection engineering
  • add explicit evidence, confidence, isolation, authorization, privacy, and non-specialist advice contracts with deterministic scenario tests
  • export the complete portable inventory for Hermes and synchronize marketplace, README, roadmap, architecture, and release metadata
  • prepare Socket 9.13.0

Review

  • CodeRabbit reviewed the authored plugin and final integration commit as separate scopes because the full generated diff exceeds its 150-file service limit; neither scope produced findings

Verification

  • uv run pytest — 99 passed, 1 skipped
  • uv run mypy — passed
  • child validator — 30 skills passed
  • plugin, marketplace, Hermes, and architecture validators — passed
  • all 11 cybersecurity safety-scenario contract tests — passed
  • ruff check . — blocked by two unrelated pre-existing findings outside this branch

Why:
Ship the full guidance-only cybersecurity plugin across malware analysis, macOS defense, authorized testing, incident response, and detection engineering.

Verification:
- 30 child skills validated
- 99 root tests passed; 1 skipped
- mypy passed
- marketplace, Hermes, architecture, and plugin validators passed
- ruff remains blocked by two unrelated baseline findings
Verification:
- shared version inventory reports 9.13.0
- 99 tests passed; 1 skipped
- marketplace and Hermes validation passed
- mypy passed
@gaelic-ghost gaelic-ghost added the enhancement New feature or request label Jul 14, 2026
@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Too many files!

This PR contains 225 files, which is 75 over the limit of 150.

To get a review, narrow the scope:
• coderabbit review --type committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f2ce61a2-cbc7-428e-99ec-d196fb31e76d

📥 Commits

Reviewing files that changed from the base of the PR and between 185d378 and fbf76f7.

⛔ Files ignored due to path filters (9)
  • plugins/agent-portability-skills/uv.lock is excluded by !**/*.lock
  • plugins/apple-dev-skills/uv.lock is excluded by !**/*.lock
  • plugins/cardhop-app/mcp/uv.lock is excluded by !**/*.lock
  • plugins/cybersecurity-skills/assets/cybersecurity-icon.svg is excluded by !**/*.svg
  • plugins/productivity-skills/uv.lock is excluded by !**/*.lock
  • plugins/python-skills/uv.lock is excluded by !**/*.lock
  • plugins/things-app/mcp/uv.lock is excluded by !**/*.lock
  • plugins/things-app/uv.lock is excluded by !**/*.lock
  • uv.lock is excluded by !**/*.lock
📒 Files selected for processing (225)
  • .agents/plugins/marketplace.json
  • README.md
  • ROADMAP.md
  • docs/architecture/ARCHITECTURE.md
  • docs/architecture/architecture.json
  • docs/maintainers/cybersecurity-skills-plugin-plan.md
  • docs/maintainers/hermes-compatibility.md
  • plugins/agent-portability-skills/.codex-plugin/plugin.json
  • plugins/agent-portability-skills/pyproject.toml
  • plugins/agentdeck/.codex-plugin/plugin.json
  • plugins/android-dev-skills/.codex-plugin/plugin.json
  • plugins/apple-creator-studio-skills/.codex-plugin/plugin.json
  • plugins/apple-dev-skills/.codex-plugin/plugin.json
  • plugins/apple-dev-skills/pyproject.toml
  • plugins/cardhop-app/.codex-plugin/plugin.json
  • plugins/cardhop-app/mcp/pyproject.toml
  • plugins/cloud-deployment-skills/.codex-plugin/plugin.json
  • plugins/cloud-inference-skills/.codex-plugin/plugin.json
  • plugins/cybersecurity-skills/.codex-plugin/plugin.json
  • plugins/cybersecurity-skills/AGENTS.md
  • plugins/cybersecurity-skills/scripts/validate_repo_metadata.py
  • plugins/cybersecurity-skills/skills/analyze-suspicious-script-or-document/SKILL.md
  • plugins/cybersecurity-skills/skills/analyze-suspicious-script-or-document/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/analyze-suspicious-script-or-document/references/script-document-analysis.md
  • plugins/cybersecurity-skills/skills/assess-and-explain-threat/SKILL.md
  • plugins/cybersecurity-skills/skills/assess-and-explain-threat/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/assess-and-explain-threat/references/confidence-and-advice.md
  • plugins/cybersecurity-skills/skills/assess-exposure-and-impact/SKILL.md
  • plugins/cybersecurity-skills/skills/assess-exposure-and-impact/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/assess-exposure-and-impact/references/exposure-impact-model.md
  • plugins/cybersecurity-skills/skills/assess-macos-threat/SKILL.md
  • plugins/cybersecurity-skills/skills/assess-macos-threat/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/assess-macos-threat/references/macos-security-layers.md
  • plugins/cybersecurity-skills/skills/author-detection-content/SKILL.md
  • plugins/cybersecurity-skills/skills/author-detection-content/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/author-detection-content/references/detection-quality.md
  • plugins/cybersecurity-skills/skills/author-yara-x-rules/SKILL.md
  • plugins/cybersecurity-skills/skills/author-yara-x-rules/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/author-yara-x-rules/references/yara-x-rule-quality.md
  • plugins/cybersecurity-skills/skills/check-artifact-reputation/SKILL.md
  • plugins/cybersecurity-skills/skills/check-artifact-reputation/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/check-artifact-reputation/references/reputation-evidence.md
  • plugins/cybersecurity-skills/skills/contain-and-recover-macos/SKILL.md
  • plugins/cybersecurity-skills/skills/contain-and-recover-macos/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/contain-and-recover-macos/references/macos-response-ladder.md
  • plugins/cybersecurity-skills/skills/contain-security-incident/SKILL.md
  • plugins/cybersecurity-skills/skills/contain-security-incident/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/contain-security-incident/references/containment-plan.md
  • plugins/cybersecurity-skills/skills/harden-macos/SKILL.md
  • plugins/cybersecurity-skills/skills/harden-macos/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/harden-macos/references/macos-hardening-review.md
  • plugins/cybersecurity-skills/skills/hunt-security-indicators/SKILL.md
  • plugins/cybersecurity-skills/skills/hunt-security-indicators/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/hunt-security-indicators/references/hunt-record.md
  • plugins/cybersecurity-skills/skills/inspect-macos-persistence/SKILL.md
  • plugins/cybersecurity-skills/skills/inspect-macos-persistence/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/inspect-macos-persistence/references/macos-persistence-surfaces.md
  • plugins/cybersecurity-skills/skills/inspect-macos-runtime-activity/SKILL.md
  • plugins/cybersecurity-skills/skills/inspect-macos-runtime-activity/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/inspect-macos-runtime-activity/references/macos-runtime-evidence.md
  • plugins/cybersecurity-skills/skills/map-malware-behavior/SKILL.md
  • plugins/cybersecurity-skills/skills/map-malware-behavior/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/map-malware-behavior/references/behavior-mapping.md
  • plugins/cybersecurity-skills/skills/operate-agentic-security-tools/SKILL.md
  • plugins/cybersecurity-skills/skills/operate-agentic-security-tools/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/operate-agentic-security-tools/references/agent-tool-controls.md
  • plugins/cybersecurity-skills/skills/perform-dynamic-malware-analysis/SKILL.md
  • plugins/cybersecurity-skills/skills/perform-dynamic-malware-analysis/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/perform-dynamic-malware-analysis/references/dynamic-observation-plan.md
  • plugins/cybersecurity-skills/skills/perform-static-malware-analysis/SKILL.md
  • plugins/cybersecurity-skills/skills/perform-static-malware-analysis/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/perform-static-malware-analysis/references/static-analysis-layers.md
  • plugins/cybersecurity-skills/skills/preserve-security-evidence/SKILL.md
  • plugins/cybersecurity-skills/skills/preserve-security-evidence/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/preserve-security-evidence/references/security-record.md
  • plugins/cybersecurity-skills/skills/recover-security-incident/SKILL.md
  • plugins/cybersecurity-skills/skills/recover-security-incident/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/recover-security-incident/references/recovery-gates.md
  • plugins/cybersecurity-skills/skills/report-security-assessment/SKILL.md
  • plugins/cybersecurity-skills/skills/report-security-assessment/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/report-security-assessment/references/security-report-shape.md
  • plugins/cybersecurity-skills/skills/route-security-work/SKILL.md
  • plugins/cybersecurity-skills/skills/route-security-work/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/route-security-work/references/routing-map.md
  • plugins/cybersecurity-skills/skills/scope-authorized-security-test/SKILL.md
  • plugins/cybersecurity-skills/skills/scope-authorized-security-test/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/scope-authorized-security-test/references/active-test-scope.md
  • plugins/cybersecurity-skills/skills/select-analysis-isolation/SKILL.md
  • plugins/cybersecurity-skills/skills/select-analysis-isolation/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/select-analysis-isolation/references/isolation-matrix.md
  • plugins/cybersecurity-skills/skills/test-network-services/SKILL.md
  • plugins/cybersecurity-skills/skills/test-network-services/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/test-network-services/references/network-test-levels.md
  • plugins/cybersecurity-skills/skills/test-web-and-api-security/SKILL.md
  • plugins/cybersecurity-skills/skills/test-web-and-api-security/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/test-web-and-api-security/references/web-api-test-plan.md
  • plugins/cybersecurity-skills/skills/triage-security-incident/SKILL.md
  • plugins/cybersecurity-skills/skills/triage-security-incident/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/triage-security-incident/references/incident-triage-record.md
  • plugins/cybersecurity-skills/skills/triage-suspicious-content/SKILL.md
  • plugins/cybersecurity-skills/skills/triage-suspicious-content/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/triage-suspicious-content/references/content-preflight.md
  • plugins/cybersecurity-skills/skills/triage-vulnerability-report/SKILL.md
  • plugins/cybersecurity-skills/skills/triage-vulnerability-report/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/triage-vulnerability-report/references/vulnerability-intake.md
  • plugins/cybersecurity-skills/skills/use-objective-see-tools/SKILL.md
  • plugins/cybersecurity-skills/skills/use-objective-see-tools/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/use-objective-see-tools/references/objective-see-routing.md
  • plugins/cybersecurity-skills/skills/validate-vulnerability/SKILL.md
  • plugins/cybersecurity-skills/skills/validate-vulnerability/agents/openai.yaml
  • plugins/cybersecurity-skills/skills/validate-vulnerability/references/validation-evidence.md
  • plugins/dotnet-skills/.codex-plugin/plugin.json
  • plugins/game-dev-skills/.codex-plugin/plugin.json
  • plugins/messaging-collaboration-skills/.codex-plugin/plugin.json
  • plugins/network-protocol-skills/.codex-plugin/plugin.json
  • plugins/productivity-skills/.codex-plugin/plugin.json
  • plugins/productivity-skills/pyproject.toml
  • plugins/python-skills/.codex-plugin/plugin.json
  • plugins/python-skills/pyproject.toml
  • plugins/reverse-engineering-skills/.codex-plugin/plugin.json
  • plugins/rust-skills/.codex-plugin/plugin.json
  • plugins/server-side-jvm/.codex-plugin/plugin.json
  • plugins/server-side-swift/.codex-plugin/plugin.json
  • plugins/spotify/.codex-plugin/plugin.json
  • plugins/swift-lang/.codex-plugin/plugin.json
  • plugins/swiftasb-skills/.codex-plugin/plugin.json
  • plugins/things-app/.codex-plugin/plugin.json
  • plugins/things-app/mcp/pyproject.toml
  • plugins/things-app/pyproject.toml
  • plugins/web-dev-skills/.codex-plugin/plugin.json
  • pyproject.toml
  • scripts/export_hermes_skills.py
  • skills.sh.json
  • skills/analyze-suspicious-script-or-document/SKILL.md
  • skills/analyze-suspicious-script-or-document/agents/openai.yaml
  • skills/analyze-suspicious-script-or-document/references/script-document-analysis.md
  • skills/assess-and-explain-threat/SKILL.md
  • skills/assess-and-explain-threat/agents/openai.yaml
  • skills/assess-and-explain-threat/references/confidence-and-advice.md
  • skills/assess-exposure-and-impact/SKILL.md
  • skills/assess-exposure-and-impact/agents/openai.yaml
  • skills/assess-exposure-and-impact/references/exposure-impact-model.md
  • skills/assess-macos-threat/SKILL.md
  • skills/assess-macos-threat/agents/openai.yaml
  • skills/assess-macos-threat/references/macos-security-layers.md
  • skills/author-detection-content/SKILL.md
  • skills/author-detection-content/agents/openai.yaml
  • skills/author-detection-content/references/detection-quality.md
  • skills/author-yara-x-rules/SKILL.md
  • skills/author-yara-x-rules/agents/openai.yaml
  • skills/author-yara-x-rules/references/yara-x-rule-quality.md
  • skills/check-artifact-reputation/SKILL.md
  • skills/check-artifact-reputation/agents/openai.yaml
  • skills/check-artifact-reputation/references/reputation-evidence.md
  • skills/contain-and-recover-macos/SKILL.md
  • skills/contain-and-recover-macos/agents/openai.yaml
  • skills/contain-and-recover-macos/references/macos-response-ladder.md
  • skills/contain-security-incident/SKILL.md
  • skills/contain-security-incident/agents/openai.yaml
  • skills/contain-security-incident/references/containment-plan.md
  • skills/harden-macos/SKILL.md
  • skills/harden-macos/agents/openai.yaml
  • skills/harden-macos/references/macos-hardening-review.md
  • skills/hunt-security-indicators/SKILL.md
  • skills/hunt-security-indicators/agents/openai.yaml
  • skills/hunt-security-indicators/references/hunt-record.md
  • skills/inspect-macos-persistence/SKILL.md
  • skills/inspect-macos-persistence/agents/openai.yaml
  • skills/inspect-macos-persistence/references/macos-persistence-surfaces.md
  • skills/inspect-macos-runtime-activity/SKILL.md
  • skills/inspect-macos-runtime-activity/agents/openai.yaml
  • skills/inspect-macos-runtime-activity/references/macos-runtime-evidence.md
  • skills/map-malware-behavior/SKILL.md
  • skills/map-malware-behavior/agents/openai.yaml
  • skills/map-malware-behavior/references/behavior-mapping.md
  • skills/operate-agentic-security-tools/SKILL.md
  • skills/operate-agentic-security-tools/agents/openai.yaml
  • skills/operate-agentic-security-tools/references/agent-tool-controls.md
  • skills/perform-dynamic-malware-analysis/SKILL.md
  • skills/perform-dynamic-malware-analysis/agents/openai.yaml
  • skills/perform-dynamic-malware-analysis/references/dynamic-observation-plan.md
  • skills/perform-static-malware-analysis/SKILL.md
  • skills/perform-static-malware-analysis/agents/openai.yaml
  • skills/perform-static-malware-analysis/references/static-analysis-layers.md
  • skills/preserve-security-evidence/SKILL.md
  • skills/preserve-security-evidence/agents/openai.yaml
  • skills/preserve-security-evidence/references/security-record.md
  • skills/recover-security-incident/SKILL.md
  • skills/recover-security-incident/agents/openai.yaml
  • skills/recover-security-incident/references/recovery-gates.md
  • skills/report-security-assessment/SKILL.md
  • skills/report-security-assessment/agents/openai.yaml
  • skills/report-security-assessment/references/security-report-shape.md
  • skills/route-security-work/SKILL.md
  • skills/route-security-work/agents/openai.yaml
  • skills/route-security-work/references/routing-map.md
  • skills/scope-authorized-security-test/SKILL.md
  • skills/scope-authorized-security-test/agents/openai.yaml
  • skills/scope-authorized-security-test/references/active-test-scope.md
  • skills/select-analysis-isolation/SKILL.md
  • skills/select-analysis-isolation/agents/openai.yaml
  • skills/select-analysis-isolation/references/isolation-matrix.md
  • skills/test-network-services/SKILL.md
  • skills/test-network-services/agents/openai.yaml
  • skills/test-network-services/references/network-test-levels.md
  • skills/test-web-and-api-security/SKILL.md
  • skills/test-web-and-api-security/agents/openai.yaml
  • skills/test-web-and-api-security/references/web-api-test-plan.md
  • skills/triage-security-incident/SKILL.md
  • skills/triage-security-incident/agents/openai.yaml
  • skills/triage-security-incident/references/incident-triage-record.md
  • skills/triage-suspicious-content/SKILL.md
  • skills/triage-suspicious-content/agents/openai.yaml
  • skills/triage-suspicious-content/references/content-preflight.md
  • skills/triage-vulnerability-report/SKILL.md
  • skills/triage-vulnerability-report/agents/openai.yaml
  • skills/triage-vulnerability-report/references/vulnerability-intake.md
  • skills/use-objective-see-tools/SKILL.md
  • skills/use-objective-see-tools/agents/openai.yaml
  • skills/use-objective-see-tools/references/objective-see-routing.md
  • skills/validate-vulnerability/SKILL.md
  • skills/validate-vulnerability/agents/openai.yaml
  • skills/validate-vulnerability/references/validation-evidence.md
  • tests/test_cybersecurity_skill_contracts.py
  • tests/test_validate_hermes_compatibility.py

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch security/cybersecurity-skills-plugin-plan

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@gaelic-ghost gaelic-ghost merged commit d798326 into main Jul 14, 2026
2 checks passed
@gaelic-ghost gaelic-ghost deleted the security/cybersecurity-skills-plugin-plan branch July 14, 2026 19:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant