security-hardening

---

name: security-hardening description: AIDefence security layer with prompt injection blocking, input validation, sandboxed execution, output sanitization, and STRIDE threat modeling. allowed-tools: Read, Write, Edit, Bash, Grep, Glob, WebFetch, WebSearch, Agent, AskUserQuestion graph: domains: [domain:software-engineering] skillAreas: [skill-area:agentic-loops, skill-area:orchestration-loop] workflows: [workflow:feature-development] topics: [topic:developer-experience] roles: [role:tech-lead, role:backend-engineer]

• When processing untrusted inputs
• Security audits of agent-generated code
• Compliance verification (OWASP Top 10, CIS)

AIDefence Layers

1. Prompt Injection Detection - Pattern + heuristic blocking
2. Input Validation - Path traversal, type coercion, parameter sanitization
3. Static Analysis (SAST) - Vulnerability scanning, CWE matching
4. Sandboxed Execution - Network isolation, filesystem restrictions, resource limits
5. Output Sanitization - Secrets, PII, injection vector redaction

Security Levels

Level	Layers	Use Case
standard	SAST + validation + sanitization	Routine audits
elevated	+ threat modeling + compliance	Pre-release audits
maximum	+ sandbox + full STRIDE + remediation	Critical systems

Agents Used

• agents/security-auditor/ - Vulnerability detection
• agents/reviewer/ - Code quality verification

Tool Use

Invoke via babysitter process: methodologies/ruflo/ruflo-security-audit