Skyler Watson

A client-sponsored UNLV capstone for Station Casinos: research on generative AI in enterprise software delivery, plus a working pipeline with governance built in.

• Intake to pull request ran automatically in 70 seconds in rehearsal, with 26 of 26 tests passing.
• A rule-based gate halts anything touching payments, certified gaming logic, RNG, or payout math.
• Nothing is promoted until a human merges, and the server enforces that.

n8n · Azure DevOps · Claude Code · Node.js · Docker

A Modbus/TCP lab reproducing a Stuxnet-style attack, in which the operator screen showed a steady 1,500 RPM while the motor ran past redline, plus detections for it.

• Five attacks validated on real hardware and mapped to MITRE ATT&CK for ICS.
• Custom Suricata rules flagged unauthorized Modbus writes and safety-bypass tampering.
• A Python ARP monitor caught the man-in-the-middle that the signature rules missed.

Modbus/TCP · Raspberry Pi · Kali · Suricata · scapy · MITRE ATT&CK for ICS

A Windows app that converts files mid-drag: tap Shift while dragging and drop the file on the format you want. Open source, with a native macOS port.

• Images (including HEIC and RAW), video, audio, GIFs, and documents, all converted locally.
• A per-user installer that needs no admin rights, plus a portable zip.
• A native Swift port for macOS, with GitHub Actions CI and tests.

C# / .NET 10 · WPF · SkiaSharp · FFmpeg · Swift

View on GitHub ↗

A web app for collecting place recommendations from friends. They answer a shared link without signing up, and an LLM sorts their tips into organized, mapped places.

• 27 documented production releases, each with lint, build, and smoke checks and a rollback path.
• Passkey and magic-link sign-in, with daily database backups and a verified restore.
• Provider-enforced API quotas and a budget alert.

Next.js · TypeScript · PostgreSQL · LLM parsing · Google Places

Open recspace ↗

Lets an AI assistant run owner-approved commands on a Linux machine I pair with it. Commands are off by default, every one needs approval, and everything is logged.

• One-use pairing codes stored only as SHA-256 hashes, with short-lived keys revoked when the session ends.
• Auth0 OAuth with PKCE, plus RS256 issuer, audience, and scope validation.
• Backend, Go race-detector, and end-to-end tests run in CI. A live ChatGPT connection was verified.

MCP · Node.js · Go · Auth0 OAuth · SQLite

Small Python command-line tools for phishing email triage, log-based threat detection, network reconnaissance, and incident reports.

• phish-detect: sender spoofing, URL and attachment checks, and a weighted 0–100 risk score.
• log-sentinel: brute force, sudo use, off-hours logins, and lockouts, with JSON export for a SIEM.
• ir-report: incident reports with an executive summary, timeline, IOCs, and ATT&CK mapping.

Python · MITRE ATT&CK · CLI

phish-detect ↗log-sentinel ↗ir-report ↗

An offline evaluator that checks whether an AI agent’s recorded tool calls stay inside the task’s permissions.

• Eight synthetic scenarios: prompt injection, data disclosure, destructive actions, forged approval, scope expansion, and benign controls.
• Includes benign scenarios, so an agent that refuses everything still fails.

Node.js · Prompt injection · Agent safety