cybersecurity-analyst
Audited by Runlayer on Feb 21, 2026
Tool passed security scan
Malicious tool definition detected
Tool: README.md [2/2] Description: **CIS Controls** - Prioritized security best practices - **MITRE ATT&CK** - Adversary tactics and techniques - **STRIDE/DREAD** - Threat modeling methodologies ### Standards and Compliance - **PCI-DSS** - Payment card industry security - **GDPR** - European data protection regulation - **HIPAA** - Healthcare data security (US) - **SOC 2** - Service organization security controls - **ISO 27001** - Information security management ### Tools - **Burp Suite** - Web
Malicious tool definition detected
Tool: QUICK_REFERENCE.md [1/2] Description: # Cybersecurity Analyst - Quick Reference ## TL;DR Analyze systems through security lenses: threat modeling (STRIDE), vulnerability assessment, cryptography validation, access control, incident response, and application security. Apply defense-in-depth and assume breach mentality to protect confidentiality, integrity, and availability.
Description: in code - Default credentials not changed - No HTTPS (HTTP only) - Missing authentication/authorization checks - Verbose error messages exposing system details - SQL queries built with string concatenation - Outdated dependencies with known CVEs - No security logging or monitoring ## Integration Tips Combine with other skills: - **Computer Scientist** - Cryptography theory, complexity - **Lawyer** - Compliance and regulatory requirements - **Systems Thinker** - Attack propagation an
Tool passed security scan
Malicious tool definition detected
**Sources**: - [CVSS](https://www.first.org/cvss/) - [FAIR Institute](https://www.fairinstitute.org/) - [NIST RMF](https://csrc.nist.gov/projects/risk-management) ### Framework 3: Security Control Frameworks **Purpose**: Structured set of security controls to achieve security objectives **Major Frameworks**: **NIST Cybersecurity Framework**: - Five core functions: Identify, Protect, Detect, Respond, Recover - Not prescriptive—flexible for different organizations - Widely adopted across industrie
Tool: SKILL.md [4/8] Description: Analysis Rubric ### What to Examine **Assets and Data**: - What sensitive data exists? (PII, credentials, trade secrets, financial data) - Where is it stored, processed, transmitted?
Establish bug bounty program **Step 10 - Compliance**: - **PCI-DSS**: Required for payment card data (use tokenization, minimize cardholder data environment) - **GDPR/CCPA**: Customer data privacy requirements (consent, data minimization, breach notification) - **SOC 2**: If B2B customers require assurance **Step 11 - Synthesis**: - Application has solid foundation (modern crypto, input validation, dependency scanning) - Critical issues must be fixed before launch (IDOR, vulnerable dependencies)
Tool: SKILL.md [7/8] Description: Enforce encryption at rest and in transit 4.
Malicious tool definition detected
decrypt decision - Critical services prioritization (life-safety first) - Validation and testing before production - Timeline and resource requirements - [ ] **Regulatory and Legal**: - HIPAA breach notification (HHS, patients, media) - FBI/CISA reporting requirements - State attorney general notifications - Civil liability concerns - Insurance claims - [ ] **Post-Incident Improvements**: - Root cause analysis - Security control gaps (MFA, network segmentation, backup isolation) - User training
Tool: tests/quiz.md [2/3] Description: gap - Missing automated compliance checks - [ ] **Data Sensitivity Assessment**: - PII exposed: Names, emails, purchase history - Regulatory classification: Personal data under GDPR, CCPA - Potential harms: Phishing, identity theft, competitive intelligence - Data minimization principle violation - [ ] **Breach Notification Requirements**: - **GDPR**: 72-hour notification to supervisory authority - **CCPA**: Consumer notification without unreasonable delay
Tool: tests/quiz.md [3/3] Description: - Endpoint forensics: File activity, email, cloud storage uploads - Correlation with business value data - Legal considerations: Privacy, consent, jurisdiction - [ ] **Immediate Actions**: - Enhanced monitoring (not immediate revocation, to gather evidence) - Coordinate with HR, Legal, Management - Document everything (for potential litigation) - Revoke access strategically (when sufficient evidence or risk threshold) - Network egress controls (DLP, email m