Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
security-review
daniel-ospina
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
find-bugs
daniel-ospina
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
meta-skillshare
jasonraimondi
Syncs skills across AI CLI tools (Claude, Cursor, Windsurf, etc.) from a single source of truth. Global mode (~/.config/skillshare/) and project mode (.skillshare/ per-repo). Commands: status, sync, install, uninstall, update, check, search, new, collect, push, pull, diff, list, doctor, audit, init-rules, trash, log, backup, restore, target, ui, upgrade. Features: target-level skill filtering (include/exclude), skill-level targets field, XDG Base Directory support, fuzzy subdirectory resolution for monorepo installs, .skillignore for repo-level skill filtering, --exclude flag, license display, multi-skill and group uninstall (--group/-G), declarative skill manifest (global + project), group field for organized placement, 49+ supported targets. Use when: managing skills across AI tools, "skillshare" CLI, skill sync/install/search, project skills setup, target filtering, security audit, web dashboard, or troubleshooting.
cso
jthorare
"OWASP Top 10 + STRIDE threat model. Runs on a plan (pre-impl mode) or a PR diff (post-impl mode). Outputs severity-rated findings with mitigations."
security
musterd-io
The security role — the member who owns the team's application-security evidence (threat models, authorized scans, validated findings, private disclosure, the smallest defensible fix, and honest posture claims). Use when threat-modeling a system or a change, reviewing code or a workflow for security, running or reading a scanner, judging whether a finding is real and how severe, handling a leaked secret, reviewing a new dependency or the release pipeline, or writing anything public about security.
architecting-security
ancoleman
Design comprehensive security architectures using defense-in-depth, zero trust principles, threat modeling (STRIDE, PASTA), and control frameworks (NIST CSF, CIS Controls, ISO 27001). Use when designing security for new systems, auditing existing architectures, or establishing security governance programs.
configuring-nginx
ancoleman
Configure nginx for static sites, reverse proxying, load balancing, SSL/TLS termination, caching, and performance tuning. When setting up web servers, application proxies, or load balancers, this skill provides production-ready patterns with modern security best practices for TLS 1.3, rate limiting, and security headers.
architecting-networks
ancoleman
Design cloud network architectures with VPC patterns, subnet strategies, zero trust principles, and hybrid connectivity. Use when planning VPC topology, implementing multi-cloud networking, or establishing secure network segmentation for cloud workloads.
implementing-service-mesh
ancoleman
Implement production-ready service mesh deployments with Istio, Linkerd, or Cilium. Configure mTLS, authorization policies, traffic routing, and progressive delivery patterns for secure, observable microservices. Use when setting up service-to-service communication, implementing zero-trust security, or enabling canary deployments.
operating-kubernetes
ancoleman
Operating production Kubernetes clusters effectively with resource management, advanced scheduling, networking, storage, security hardening, and autoscaling. Use when deploying workloads to Kubernetes, configuring cluster resources, implementing security policies, or troubleshooting operational issues.
java-spring-framework
AyrtonAldayr
Senior Java & Spring Boot 4 / Spring Framework 7 architect skill for 2026-standard development. Use when the user asks to build, scaffold, design, review, or explain Java applications using Spring Boot 4.x, Spring Framework 7.x, Spring Modulith, or any related Spring ecosystem project. Triggers include: creating REST APIs, designing microservices, configuring data access (JdbcClient, JPA 3.2, R2DBC), reactive programming (WebFlux), security (Spring Security 7), observability, GraalVM native images, Gradle/Maven build configuration, Jakarta EE 11 migration, and any task requiring idiomatic modern Java (Java 25: records, sealed classes, structured concurrency, scoped values, pattern matching, JSpecify null safety).
architecture
dy9759
Comprehensive system architecture design and implementation workflow that orchestrates expert analysis, technical decision-making, and architectural pattern selection using the integrated toolset. Handles everything from initial system analysis to implementation-ready technical specifications.
ai-generated-business-code-review
openharmonyinsight
Use when reviewing or scoring AI-generated business/application code quality in any language, especially when a numeric score, risk level, or must-fix checklist is requested, or when C++ code must comply with OpenHarmony C++ and security standards
code-checker
openharmonyinsight
Scan C/C++ codebases for code quality issues including extra large files/functions and circular dependencies. Use when the user asks to check file sizes, find oversized functions, detect circular dependencies, analyze code complexity, find code smells, or identify maintainability issues in C/C++ code. Supports scanning individual files or entire directories with configurable thresholds.
quality-scoring
akaszubski
"Multi-dimensional data assessment for training quality evaluation including IFD scoring, factuality, and reasoning validation. Use when scoring training data or evaluating dataset quality. TRIGGER when: quality scoring, data assessment, IFD, factuality, training data quality. DO NOT TRIGGER when: code quality, test coverage, documentation, non-data tasks."
security-patterns
akaszubski
"Security best practices covering API key management, input validation, injection prevention, and OWASP patterns. Use when handling secrets, user input, or security-sensitive code. TRIGGER when: security, API key, secret, input validation, injection, OWASP. DO NOT TRIGGER when: non-security code, styling, documentation, test scaffolding."
software-security
project-codeguard
A software security skill that integrates with Project CodeGuard to help AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
SEO Audit
quran
Frontend build on next.js
security
booch
Security guidelines for secure coding and code review. This skill should be used when architecting/designing systems, writing code, or reviewing code. Use proactively when discussing vulnerabilities, OWASP, injection attacks, XSS, CSRF, SQL injection, authentication, authorization, access control, encryption, secrets management, input validation, or secure coding practices. (user)
sdlc
booch
Software development lifecycle guidance. This skill should be used when planning development work, conducting code reviews, or establishing development workflows. Use proactively when reviewing code, preparing commits, creating pull requests, refactoring, or discussing development process and best practices. (user)
SEO Audit
quran
Frontend build on next.js
geo-infer-sec
ActiveInferenceInstitute
Security and threat detection for geospatial systems. Use when implementing spatial access control, anomaly detection on access patterns, geospatial threat assessment, security auditing, or spatial data anonymization.
solo-audit
fortunto2
Health check knowledge base for broken links, missing frontmatter, tag inconsistencies, and coverage gaps. Use when user says "audit KB", "check frontmatter", "find broken links", "tag cleanup", or "knowledge base quality". Do NOT use for SEO audits (use /seo-audit) or code reviews.
SEO Audit
quran
Frontend build on next.js