Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
supabase-detect
yoanbernabeu
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
supabase-audit-buckets-list
yoanbernabeu
List all storage buckets and their configuration to identify the storage attack surface.
supabase-pentest
yoanbernabeu
Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.
supabase-help
yoanbernabeu
Quick reference for all Supabase security audit skills with usage examples and command overview.
supabase-report
yoanbernabeu
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
supabase-audit-tables-read
yoanbernabeu
Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.
supabase-audit-rpc
yoanbernabeu
List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.
supabase-audit-functions
yoanbernabeu
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
supabase-extract-anon-key
yoanbernabeu
Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.
bug-reaper
shaniidev
"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth bypass, RCE, SSTI, LFI, XXE, CORS, CSRF, prototype pollution, subdomain takeover, HTTP smuggling, open redirect, API/GraphQL bugs; auditing locally downloaded GitHub repos or source code (white-box/source code review); writing platform-specific reports. Trigger on: 'pentest', 'find bugs', 'security audit', 'bug bounty', 'find vulnerabilities', 'source code review', 'audit this repo', 'review repo', 'white-box', 'local repo', vulnerability class names, or program/target names. Reports only real, confirmed medium+ severity bugs that pass real triage."
near-contract-audit
near
Comprehensive security audit skill for NEAR Protocol smart contracts written in Rust. Use when auditing NEAR contracts, reviewing security vulnerabilities, or analyzing contract code for issues like reentrancy, unhandled promises, unsafe math, access control flaws, and callback security.
backend-dev
julianromli
Comprehensive backend development workflow that orchestrates expert analysis, architecture design, implementation, and deployment using the integrated toolset. Handles everything from API design and database architecture to security implementation and DevOps automation.
vulnerability-exploitation
Eitanvinokur12345
"Penetration testing, security research, malicious attacks."
audit-review
KingInYellows
Run 1-3 parallel quick-audit passes (code quality, security, error handling) over a diff and gate on findings. Use when smart-submit or gt-amend need to audit uncommitted changes before committing.
audit-review
KingInYellows
'Run 1-3 parallel quick-audit passes (code quality, security, error handling) over a diff and gate on findings. Use when smart-submit or gt-amend need to audit uncommitted changes before committing.'
corporate-network-attack-simulation
Eitanvinokur12345
"Cybersecurity assessment, red teaming, vulnerability analysis"
technical-debt-manager-php-laravel
LaravelDaily
Expert technical debt analyst for PHP/Laravel code health, maintainability, and strategic refactoring planning. Use PROACTIVELY when a Laravel codebase shows complexity growth, when planning sprints, or when prioritizing engineering work.
typo3-security
dirnbauer
Security hardening checklist and best practices for TYPO3 v13/v14 installations, covering configuration, file permissions, and common vulnerabilities. Use when working with security, hardening, permissions, authentication, vulnerabilities.
appsec-expert
martinholovsky
"Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments."
Encryption Skill
martinholovsky
Encryption done wrong is worse than no encryption - it provides false confidence.
OS Keychain Skill
martinholovsky
The OS keychain is your first line of defense. Misuse negates all downstream encryption.
Auto-Update Systems Expert
martinholovsky
Expert in Tauri auto-update implementation with focus on signature verification, rollback mechanisms, staged rollouts, and secure update distribution
rust
martinholovsky
Systems programming expertise for Tauri desktop application backend development with memory safety and performance optimization
macos-accessibility
martinholovsky
"Expert in macOS Accessibility APIs (AXUIElement) for desktop automation. Specializes in secure automation of macOS applications with proper TCC permissions, element discovery, and system interaction. HIGH-RISK skill requiring strict security controls."