add security-related script - set capabilities