adobe/security-hardening
plugins/aem/cloud-service/skills/dispatcher/security-hardening/SKILL.md
Perform security audits for the Adobe Dispatcher Apache HTTP Server module and Apache HTTPD in AEMaaCS cloud workflows only, with cloud-specific hardening verification.
$ install --global
skillsauthnpx skillsauth add adobe/skills security-hardeningInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 29, 2026, 6:37 AM177.2s19 files scanned
SKILL.md
- name:
- security-hardening
- description:
- Perform security audits for the Adobe Dispatcher Apache HTTP Server module and Apache HTTPD in AEMaaCS cloud workflows only, with cloud-specific hardening verification.
- license:
- Apache-2.0
- compatibility:
- Requires Dispatcher MCP configured for cloud variant (`AEM_DEPLOYMENT_MODE=cloud`).
- allowed-tools:
- validate lint sdk trace_request inspect_cache monitor_metrics tail_logs
- mcp-tool-contract:
- core-7-tools
Dispatcher Security Hardening (Cloud)
Deliver evidence-backed security findings and remediations for cloud workflows that use the Adobe Dispatcher Apache HTTP Server module and related HTTPD configuration.
Variant Scope
- This skill is cloud-service-only.
- Scope is fixed by this skill directory; do not ask the user to choose deployment variant.
MCP Tool Contract
Use only these Dispatcher MCP tools:
validatelintsdktrace_requestinspect_cachemonitor_metricstail_logs
Workflow
- Define threat model and audit scope.
- Apply cloud guardrails (immutable/default include constraints, reserved probe-path behavior, and CDN-vs-Dispatcher ownership).
- Gather baseline evidence (
validate,lint,sdk). - Verify exposure controls (
trace_request). - Verify cache/header protections (
inspect_cache,tail_logs,monitor_metrics). - Return risk-rated findings, prioritized remediation, and rollback.
Verification Scope Selection
Use shared references to select security evidence depth:
- mode-specific-verification-matrix.md
- test-case-catalog.md
Output Contract
Always return:
- scope + threat model assumptions
- risk-rated findings table
- evidence table (tool/input/result)
- prioritized remediation plan
- selected test IDs and outcomes
- rollback plan and residual risk
Guardrails
- Do not downgrade severity without evidence.
- Do not claim a control is effective without verification evidence.
- Keep cloud assumptions explicit for each remediation recommendation.
- Separate mandatory remediations from defense-in-depth guidance.
- Separate Dispatcher hardening findings from CDN/WAF edge-policy findings.
References
- security-baseline-checklist.md
- security-scenario-playbooks.md – scenario-driven security workflows adapted from broader MCP prompt surfaces
- security-headers-checklist.md
- sensitive-paths-catalog.md
- owasp-coverage-matrix.md
- security-audit-report-template.md
- quick-start-execution-path.md – single entry path for broad or first-time audits
- repo-layout-workflows.md – map findings to actual dispatcher file families
- playbook-command-linkage.md – exact MCP command chains for security playbooks
- mode-specific-verification-matrix.md
- cloud-service-aemaacs-guardrails.md – cloud-service-only immutable/include/runtime boundary checks from AEMaaCS patterns
- test-case-catalog.md
- change-risk-and-rollback-template.md
- public-docs-index.md
- public-doc-citation-rules.md
- core-7-tools-reference.md
Related Skills
adobe/cja-top-movers-watchlist
tools
VerifiedTrustedCommunity
Identifies which items (pages, campaigns, products, channels, regions) had the biggest increases or decreases for a key metric between two time periods. Use this skill when someone asks "what's up and what's down," "which campaigns moved the most," "top gainers and losers," "what pages are trending," "show me what changed by channel," or any variation of identifying the biggest movers and decliners for a metric.
112SKILL.mdUpdated Jun 2, 2026
adobe/cja-segment-performance-comparator
tools
VerifiedTrustedCommunity
Compares the performance of two or more audience segments across key metrics side by side. Use this skill when someone wants to compare audiences, cohorts, or groups — for example, "how do mobile users compare to desktop users on conversion," "compare new vs. returning visitors," "show me the difference between these two segments," "compare these audiences on our KPIs," or "which segment performs better." Also trigger for "segment comparison," "audience comparison," or "cohort comparison."
112SKILL.mdUpdated Jun 2, 2026
adobe/cja-kpi-pulse
business
VerifiedTrustedCommunity
Produces a compact KPI digest showing how key metrics changed over a period and what's driving the movement. Use this skill when someone asks for a performance summary, a weekly recap, a morning briefing, a KPI update, or any variation of "how did we do this week/month." Also trigger for requests like "give me a performance overview," "what moved in the last 7 days," "pull our KPI report," or "summarize our metrics."
112SKILL.mdUpdated Jun 2, 2026
adobe/cja-funnel-health-check
testing
VerifiedTrustedCommunity
Analyzes a multi-step conversion funnel to find where users drop off and which steps have the worst leakage. Use this skill when someone describes a journey or funnel and asks about conversion rates, drop-off, fallout, or step completion. Trigger for phrases like "analyze our onboarding funnel," "where are users dropping off," "what's our checkout conversion rate," "funnel analysis," "show me fallout between these steps," or "which step loses the most users."
112SKILL.mdUpdated Jun 2, 2026