Autenticació
Autenticació i autorització
backend-development
samhvw8
"Production backend systems development. Stack: Node.js/TypeScript, Python, Go, Rust NestJS, FastAPI, Django, Express PostgreSQL, MongoDB, Redis. Capabilities: REST/GraphQL/gRPC APIs, OAuth 2.1/JWT auth, OWASP security, microservices, caching, load balancing, Docker/K8s deployment. Actions: design, build, implement, secure, optimize, deploy, test APIs and services. Keywords: API design, REST, GraphQL, gRPC, authentication, OAuth, JWT, RBAC, database, PostgreSQL, MongoDB, Redis, caching, microservices, Docker, Kubernetes, CI/CD, OWASP, security, performance, scalability, NestJS, FastAPI, Express, middleware, rate limiting. Use when: designing APIs, implementing auth/authz, optimizing queries, building microservices, securing endpoints, deploying containers, setting up CI/CD."
payment-integration
samhvw8
"Payment gateway integration. Providers: SePay (Vietnamese: VietQR, bank transfer, cards), Polar (global SaaS: subscriptions, usage-based billing). SDKs: Node.js, PHP, Python, Go, Laravel, Next.js. Capabilities: checkout flows, subscription management, webhooks, QR code generation, benefit automation, tax compliance. Actions: integrate, implement, configure, handle payments/subscriptions/webhooks. Keywords: payment gateway, SePay, Polar, VietQR, bank transfer, subscription, usage-based billing, checkout, webhook, QR code, API key, OAuth2, product management, customer portal, tax compliance, MoR, recurring payment, invoice. Use when: integrating payment processing, implementing checkout, managing subscriptions, handling payment webhooks, generating payment QR codes, building billing systems."
Security Code Review
kousen
Identify security vulnerabilities and suggest secure coding practices
playwriter
samhvw8
Control the user Chrome browser via Playwriter extension with Playwright code snippets in a stateful local js sandbox. Automate web interactions, take screenshots, inspect accessibility trees, and debug web applications.
bigcommerce-api
qdhenry
BigCommerce API expert for building integrations, apps, headless storefronts, and automations. Full lifecycle - REST APIs, GraphQL Storefront, webhooks, authentication, app development, and multi-storefront. Use when working with BigCommerce platform APIs.
secure-coding
Logos-Liber
OWASP secure coding practices, language-specific security considerations, input validation and output encoding, authentication and authorization patterns, cryptography best practices, secure API design, and common security anti-patterns
standard-security-auth
salavender
Security & Authentication Specialist - Expert in JWT, cookie-based auth, MFA, and generic security patterns
session-resume
salavender
Resume context from previous session
commit
kriscard
"Git: Use for /commit or when committing changes with semantic messages. NOT for PR creation (use /pr) or branch management."
coderabbit
indrasvat
Local AI code reviews via CodeRabbit CLI. ONLY use when (1) user explicitly requests "coderabbit"/"cr review", OR (2) code changes are high-risk (security, concurrency, complex logic). Rate-limited to 1 review/hour—be highly selective.
create-nextjs-ddd-auth-db
micheleangioni
Create a new fullstack Next.js. Use this skill when the user asks to create a new Next.js project or application.
agent-browser
freekmurze
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
signup-flow-cro
freekmurze
When the user wants to optimize signup, registration, account creation, or trial activation flows. Also use when the user mentions "signup conversions," "registration friction," "signup form optimization," "free trial signup," "reduce signup dropoff," or "account creation flow." For post-signup onboarding, see onboarding-cro. For lead capture forms (not account creation), see form-cro.
analytics-tracking
freekmurze
When the user wants to set up, improve, or audit analytics tracking and measurement. Also use when the user mentions "set up tracking," "GA4," "Google Analytics," "conversion tracking," "event tracking," "UTM parameters," "tag manager," "GTM," "analytics implementation," or "tracking plan." For A/B test measurement, see ab-test-setup.
onboarding-cro
freekmurze
When the user wants to optimize post-signup onboarding, user activation, first-run experience, or time-to-value. Also use when the user mentions "onboarding flow," "activation rate," "user activation," "first-run experience," "empty states," "onboarding checklist," "aha moment," or "new user experience." For signup/registration optimization, see signup-flow-cro. For ongoing email sequences, see email-sequence.
discover-security
rand
Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.
insecure-defaults
runkids
"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling."
firebase-apk-scanner
runkids
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
codex-claude-cursor-loop
bear2u
Orchestrates a triple-AI engineering loop where Claude plans, Codex validates logic and reviews code, and Cursor implements, with continuous feedback for optimal code quality
Agent Browser
am-will
A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured commands.
session-reflect
i9wa4
End-of-session retrospective skill. Collects today's commits and vault notes, analyzes friction patterns, and proposes improvements to CLAUDE.md and skills. Use when: - User says "session-reflect", "振り返り", or "今日の振り返り" - End of a work session - User asks for improvement proposals
session-summary-japanese
ryoppippi
Summarise the current session in Japanese. Use when finishing a session, handing off work, or wanting a recap of what was discussed and accomplished.
session-analytics
spences10
Query Claude Code session analytics from ccrecall database. Use when user asks about token usage, costs, session history, or wants to analyze their Claude Code usage patterns.
gathering-requirements
axiomantic
"Use when eliciting or clarifying feature requirements, defining scope, identifying constraints, or capturing user needs. Triggers: 'what are the requirements', 'define the requirements', 'scope this feature', 'user stories', 'acceptance criteria', 'what should this do', 'what problem are we solving', 'what are the constraints'. Also invoked by implementing-features during DISCOVER stage and by the Forged workflow."