Senior Security

A security-engineering advisor — application security, threat modeling, and audits. It helps us reason about how our connectors and data could be attacked and what to lock down, in plain English.

Cowork & Chat

How to use it

Describe the system or share the code/config and it walks a threat model, points out risks, and recommends fixes and safer patterns. Works in Cowork/Chat as advisory review — it analyzes what you give it. (Note: some bundled scripts assume a dev machine; the everyday value is the guided review and recommendations.)

How to invoke / keep it on

Ask for a security review / threat model and Claude loads it. For a recurring audit cadence, name it in a Project’s instructions.

20 powerful examples for Melinda Maria

Copy, tweak, make them yours. Just describe the task — Claude loads the skill automatically.

01"Threat-model our custom MCP connectors — they sign in with our MM Google work account and some hit write-capable APIs — and tell me, plainly, where the biggest risks are."

02"Review how a connector stores its API key and history mirror and recommend how to harden it."

03"We’re about to enable a write tool on a connector — walk me through what could go wrong and the guardrails (like confirm-gating) we should require first."

04"Audit our handling of customer data across the connectors at a high level and give me a prioritized fix list for non-coders."

05"Explain the risks of giving a connector write access to Shopify and the safest way to scope it down."

06"Threat-model the onboarding hub if we add in-browser editing of the knowledge docs via the GitHub API, and tell me how to keep the token safe."

07"Review our plan to store credentials in Cloudflare secrets and tell me if there’s a safer pattern."

08"Walk me through what an attacker could do if one of our connector subdomains were spoofed, and how to prevent it."

09"Assess the risk of the gorgias send-reply tool and confirm the confirm-gate is a sufficient guardrail."

10"Tell me which connectors touch the most sensitive data (customer PII, financials) and how to tier their protections."

11"Review how we rotate API keys today and recommend a simple, safe rotation routine the team can actually follow."

12"Explain prompt-injection in plain English and how a malicious document or email could try to trick a connector into acting."

13"Threat-model the Higgsfield / ElevenLabs credit-spending tools and what stops runaway spend."

14"Audit our use of OAuth across connectors and flag any scope that’s broader than it needs to be."

15"Give me a one-page, non-coder security checklist for adding any new connector."

16"Review whether connector logs could accidentally contain customer data or secrets, and how to scrub them."

17"Assess the blast radius if a single MM Google work account were compromised, given everything it can reach."

18"Walk me through the safest way to let a contractor work on a connector without handing over production secrets."

19"Evaluate whether our read-only connectors are truly read-only (no hidden write paths) and how to verify it."

20"Help me write a short incident-response plan for “a connector key leaked” so we know exactly what to do."

← Back to Engineering & Prompt-craft