007

What it does

The skill acts as a Chief Security Architect AI with expertise across code, infrastructure, APIs, bots, payments, AI agents, compliance, and operations. It provides operational modes for Audit, Threat-Model, Approve, Block, Monitor, and Incident, guiding a structured six-phase analysis: Mapeamento Da Superficie, Threat Modeling (STRIDE+PASTA), Checklist Tecnico De Seguranca, Red Team, Blue Team, and Veredito. It supports proactive security work like threat modeling, security checklists, incident playbooks, and hardening recommendations. It also includes automation scripts for surface mapping, threat modeling, hardening, scoring, and modular integration with ecosystem skills. The skill invokes specific scripts and commands for automation and is designed to be invoked via explicit triggers related to security auditing and threat modeling. It emphasizes strong security principles such as Zero Trust, sandboxed execution, and audit trails, and provides a formal final veredict with a scoring system across multiple security domains.

How it works

• The agent operates in six modes: Audit, Threat-Model, Approve, Block, Monitor, Incident. Each mode has a defined trigger and outcome (e.g., Audit is the default trigger for comprehensive security analysis).
• It maps the system surface (Phase 1), performs threat modeling using STRIDE and PASTA (Phase 2), conducts a technical security checklist (Phase 3), simulates Red Team (Phase 4) and Blue Team (Phase 5) activities, then provides a final verdict (Phase 6).
• Phase 1 uses a surface-mapping process and provides an example command for automation: python C:\Users\renat\skills\007\scripts\surface_mapper.py --target <caminho> to generate a JSON map of the surface.
• Phase 2 presents two frameworks: STRIDE and PASTA, with explicit attack vectors, impacts, mitigations, and automation commands for threat modeling: python C:\Users\renat\skills\007\scripts\threat_modeler.py --target <caminho> --framework stride, --framework pasta, and --framework both.
• Phase 3 provides a universal security checklist with sections for Python specifics and API/API security controls, plus example automation commands for hardening: python C:\Users\renat\skills\007\scripts\hardening_advisor.py --target <caminho> --level maximum|balanced|minumum.
• Phase 4–6 describe Red Team scenarios, Blue Team defenses, a formal scoring system across domains, and a final verdict with a structured format. Final scoring uses weighted domains such as Secrets, Input Validation, Auth, Data Protection, Resilience, Monitoring, Supply Chain, and Compliance.
• It includes integration hooks to ecosystem skills like skill-sentinel, web-scraper, WhatsApp API, and agent orchestration, and enforces principles like Zero Trust, sandboxing, and audit trails throughout.

When to use it

• Trigger phrases related to auditing security, threat modeling, STRIDE/PASTA, security reviews, and deployment approvals.
• Use when an organization needs formal threat modeling, security hardening, incident response planning, and comprehensive security reviews for a project.

What it can touch

• The skill references and uses automation scripts located under scripts within the 007 skill folder for surface mapping, threat modeling, hardening, and scoring. It lists supported tools for the skill as claude-code, antigravity, cursor, gemini-cli, and codex-cli, and describes commands to run specific automation scripts with <caminho> targets.

Caveats

• Declares critical risk and operates with explicit security constraints (e.g., sandboxed execution, zero trust). It relies on external automation scripts and defined triggers; behavior and outputs are as documented within the skill's operational modes and phases, not guaranteed beyond those statements.