automated-security-workflow - Claude MCP Skill

# Automated Security Workflow Skill

## Purpose

Automated workflow coordination skill that orchestrates comprehensive security validation processes while maintaining seamless user experience and intelligent threat response.

## Core Workflow Automation

###

1. Content Ingestion Pipeline

yamlinput_handlers:
  url_analysis:
  triggers: [http://, https://, www., domain patterns]    process:
  - extract_domain_and_path

- identify_content_type

- check_ssl_certificate

- perform_initial_reputation_check

- route_to_appropriate_analyzer        repository_analysis:
  triggers: [github.com, gitlab.com, bitbucket.org, .git]    process:
  - clone_or_access_repository

- identify_project_structure

- scan_for_configuration_files

- analyze_dependency_manifest

- route_to_code_analyzer        ai_tool_analysis:
  triggers: [AI, GPT, Claude, ChatGPT, prompt, LLM]    process:
  - identify_ai_service_type

- check_prompt_interface

- analyze_data_handling_policies

- test_for_injection_vulnerabilities

- route_to_ai_specific_validation

###

2. Progressive Analysis Orchestration

yamlanalysis_stages:
  stage_1_rapid_screening:
  duration_target: 2_seconds    scope: critical_threat_detection    methods:
  - known_malicious_domain_check

- basic_pattern_matching

- ssl_and_certificate_validation

- immediate_blocking_patterns    decision_points:
  - immediate_block_if_critical

- proceed_to_stage_2_if_clear

- escalate_if_uncertain        stage_2_comprehensive_analysis:
  duration_target: 30_seconds    scope: full_security_assessment    methods:
  - deep_content_pattern_analysis

- behavioral_assessment

- privacy_policy_review

- code_security_scanning    decision_points:
  - generate_risk_assessment

- prepare_user_notifications

- compile_recommendations        stage_3_contextual_enhancement:
  duration_target: 60_seconds    scope: personalized_recommendations    methods:
  - user_context_integration

- alternative_suggestion_generation

- mitigation_strategy_development

- educational_content_preparation    decision_points:
  - finalize_recommendation

- prepare_detailed_report

- schedule_follow_up_monitoring

###

3. Intelligent Notification Orchestration

yamlnotification_coordination:
  immediate_critical:
  trigger_conditions:
  - risk_score = 8.0

- known_malware_detected

- active_credential_theft

- financial_fraud_indicators    response_protocol:
  - block_content_immediately

- display_critical_alert_modal

- log_security_incident

- activate_threat_response_team        contextual_warning:
  trigger_conditions:
  - risk_score 5.0-7.9

- prompt_injection_detected

- privacy_violations_found

- suspicious_code_patterns    response_protocol:
  - display_contextual_warning

- provide_detailed_explanation

- offer_mitigation_options

- enable_informed_override        advisory_notification:
  trigger_conditions:
  - risk_score 3.0-4.9

- minor_security_concerns

- best_practice_violations

- outdated_dependencies    response_protocol:
  - show_discrete_advisory

- provide_improvement_suggestions

- enable_detailed_view

- continue_monitoring        silent_monitoring:
  trigger_conditions:
  - risk_score  3.0

- establi

shed_safe_patterns

- user_override_history

- low_confidence_detections    response_protocol:
  - continue_background_analysis

- update_safety_profiles

- prepare_escalation_triggers

- maintain_audit_logs

## Integration Automation Framework

### Skill Coordination Automation

pythonasync def coordinate_security_analysiscontent_input:
  Automated coordination of all security analysis skills        # Initialize analysis context    analysis_context =         input: content_input,        timestamp: current_timestamp,        user_context: get_user_context,        analysis_id: generate_unique_id            # Stage 1: Rapid screening    rapid_results = await parallel_execute[        encoding_pattern_detection.scancontent_input,        domain_reputation_checkextract_domaincontent_input,        basic_threat_patterns.matchcontent_input    ]        if anyresult.risk_level == CRITICAL for result in rapid_results:
  return immediate_block_responserapid_results, analysis_context        # Stage 2: Comprehensive analysis    comprehensive_results = await parallel_execute[        content_safety_validator.full_analysiscontent_input,        web_content_analyzer.deep_scancontent_input,        behavioral_pattern_analyzer.assesscontent_input    ]        # Stage 3: Decision synthesis    final_assessment = synthesize_results        rapid_results,         comprehensive_results,         analysis_context            # Generate appropriate response    return generate_coordinated_responsefinal_assessment, analysis_context

### Agent Coordination Logic

yamlagent_coordination:
  jailbreak_detection_agent:
  role: threat_response_specialist    activation_triggers:
  - encoding_patterns_detected

- injection_attempts_identified

- behavioral_anomalies_found    coordination_protocol:
  - receive_pattern_analysis_results

- apply_contextual_risk_assessment

- generate_threat_response_plan

- coordinate_user_communication        security_workflow_orchestrator:
  role: master_coordinator    activation_triggers:
  - complex_multi_stage_analysis

- user_workflow_management

- cross_platform_coordination    coordination_protocol:
  - manage_analysis_pipeline

- coordinate_notification_timing

- optimize_user_experience

- ensure_comprehensive_coverage

## Adaptive Workflow Configuration

### User Behavior Learning

yamllearning_mechanisms:
  usage_pattern_analysis:
  - track_content_types_analyzed

- identify_user_risk_tolerance

- learn_preferred_notification_styles

- optimize_analysis_depth_preferences      false_positive_reduction:
  - correlate_user_feedback_with_decisions

- adjust_sensitivity_thre

sholds

- improve_context_recognition

- reduce_unnecessary_interruptions      efficiency_optimization:
  - identify_repetitive_analysis_patterns

- cache_frequently_accessed_assessments

- prioritize_relevant_threat_cate

gories

- streamline_familiar_workflows

### Dynamic Thre

shold Adjustment

pythondef adjust_analysis_thre

sholdsuser_feedback, analysis_history:
  Dynamically adjust analysis sensitivity based on user behavior        feedback_weights =         false_positive_reported: -0.1,        missed_threat_reported: +0.2,        appropriate_warning: +0.05,        unnecessary_interruption: -0.05            context_modifiers =         professional_context: +0.1,        personal_use: -0.05,        research_context: -0.15,        high_security_environment: +0.2            return calculate_optimal_thre

sholds        baseline_thre

sholds,        feedback_weights,        context_modifiers,        analysis_history    #

# Performance Monitoring and Optimization

### Real-Time Performance Metrics

yamlmonitoring_da

shboard:
  analysis_performance:
  - average_analysis_time: target 3_seconds

- detection_accuracy_rate: target 95%

- false_positive_rate: target 5%

- user_satisfaction_score: target 4.5/5      workflow_efficiency:
  - notification_relevance_score

- workflow_interruption_frequency

- user_override_frequency

- alternative_adoption_rate      system_health:
  - skill_coordination_latency

- agent_response_times

- pattern_database_update_status

- external_service_availability

### Automated Optimization Triggers

yamloptimization_triggers:
  performance_degradation:
  thre

shold: response_time  5_seconds    action: enable_fast_mode_analysis      high_false_positive_rate:
  thre

shold: fp_rate  10%    action: recalibrate_detection_thre

sholds      user_dissatisfaction:
  thre

shold: satisfaction  4.0/5    action: review_notification_strategies      threat_detection_gaps:
  thre

shold: missed_threats  2%    action: update_pattern_databases

## Emergency Response Automation

### Automated Threat Response

yamlemergency_protocols:
  zero_day_threat_detection:
  automated_actions:
  - immediate_pattern_extraction

- global_threat_database_update

- coordinated_community_alert

- emergency_blocking_activation        widespread_attack_campaign:
  automated_actions:
  - pattern_correlation_analysis

- bulk_content_blocking

- user_base_notification

- law_enforcement_alert_prep        system_compromise_indicators:
  automated_actions:
  - emergency_lockdown_mode

- integrity_verification_check

- safe_mode_operation

- administrator_notification

### Failsafe Mechanisms

yamlfailsafe_systems:
  analysis_system_failure:
  fallback_protocol:
  - conservative_blocking_mode

- manual_override_availability

- basic_pattern_matching_only

- administrator_notification        external_service_unavailable:
  fallback_protocol:
  - local_analysis_only

- cached_reputation_data

- reduced_feature_set

- graceful_degradation_notice        user_workflow_disruption:
  recovery_protocol:
  - immediate_issue_identification

- workflow_restoration_priority

- user_impact_minimization

- post_incident_optimization

This automated workflow skill provides comprehensive orchestration of the entire security validation process while maintaining optimal user experience and system reliability.