Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
security
outfitter-dev
This skill should be used when auditing code for security issues, reviewing authentication/authorization, evaluating input validation, analyzing cryptographic usage, or reviewing dependency security. Provides OWASP patterns, CWE analysis, and threat modeling guidance.
plugin-engineer
outfitter-dev
Transforms external repositories (CLIs, libraries, MCP servers) into Claude Code plugins with skills. Use when "build plugin for", "create skills for CLI", "package as plugin", "repo to plugin", or "turn into plugin" are mentioned.
code-review
outfitter-dev
This skill should be used when reviewing code before commit, conducting quality gates, or when "review", "fresh eyes", "pre-commit review", or "quality gate" are mentioned.
sec-audit-remediate
parhumm
Generate security fixes from detect-dev findings with regression tests. Use when remediating security vulnerabilities.
detect-dev
parhumm
Engineering audit with SARIF evidence, 4-level confidence, and OpenSSF scoring. Use when evaluating repository health or code quality.
audit
howells
Comprehensive codebase audit with specialized reviewers. Generates actionable reports. Use when asked to "audit the codebase", "review code quality", "check for issues", "security review", or "performance audit". Accepts path scope like "apps/web". Reviewers run in batches of 2 by default to avoid resource exhaustion. Use --parallel to run all reviewers simultaneously (resource-intensive). Use --diff to scope audit to files changed vs main branch (or specify base: --diff develop). Use --docs for a focused JSDoc/documentation coverage audit. Use --copy for a focused UX writing/copy quality audit.
healthcheck
smallnest
Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).
iosdev-cn
kuangre123
通用 iOS App 开发、构建、签名、测试与 App Store 上架流程（中国区）指南。用于当用户询问 iOS 开发/上架/审核/签名/TestFlight/App Store Connect/隐私合规/订阅配置，或输入触发词 iosdev 时。
deps
johnlindquist
Manage dependencies with npm/yarn/pnpm. Use for auditing vulnerabilities, checking outdated packages, understanding dependency trees, and upgrading packages safely.
security-checklist
ToanMobile
Dùng khi đổi external Intent/URI/file handling, exported component, permission, WebView, auth/cloud, network security, telemetry privacy hoặc trước release/security review. Bỏ qua UI thuần và rename không đổi behavior.
audit-plugin
richfrem
Audits a local plugin directory to ensure it perfectly matches the Agent Skills and Claude Plugin Open Standards.
skills-eval
Ven0m0
'Evaluate and improve Claude skill quality through auditing. Use when
audit-plugin-l5
richfrem
Triggers the L5 Red Team Sub-Agent to rigorously audit a plugin against the 39-point L4 pattern matrix.
red-team-review
richfrem
"(Industry standard: Review and Critique Pattern) Primary Use Case: Iterative generation paired with adversarial review, continuing until an 'Approved' verdict is reached. Orchestrated adversarial review loop. Use when: research, designs, architectures, or decisions need to be reviewed by red team agents (human, browser, or CLI). Iterates in rounds of research → bundle → review → feedback until approved."
copilot-cli-agent
richfrem
Copilot CLI sub-agent system for persona-based analysis. Use when piping large contexts to GitHub Copilot models for security audits, architecture reviews, QA analysis, or any specialized analysis requiring a fresh model context.
vulnerability-scan
ymd38
Run an offensive security audit (OWASP-based) using Semgrep and produce a read-only vulnerability report. Use before committing code to detect Broken Access Control, Injection (SQL/NoSQL/OS/Template), Frontend Security issues (XSS/CSP/HSTS), SSRF, and hardcoded secrets or PII exposure. Triggers on requests like "security scan", "vulnerability check", "audit security", "find vulnerabilities", "/vulnerability-scan", or when asked for an offensive security review of the codebase. Does NOT modify any code — read-only inspection only.
compliance
luisschmitzheadline
Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance.
audit-support
luisschmitzheadline
Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.
strategic-planning
luisschmitzheadline
Analyzes the founder's business context to deliver the 3 highest-impact next moves for growth (marketing or sales). Asks up to 10 diagnostic questions when needed to uncover bottlenecks, struggles, and opportunities. Use when user needs strategic guidance, next steps, growth planning, or actionable business strategy.
belai-vuln-scout
Vulnetix
Specialist brief for the Belai vulnerability scout. Triage and prioritise findings from Vulnetix SCA, SAST, secrets, IaC and container scans in any customer repository: ground each finding in manifests, scope, reachability and exploitation evidence (KEV, EPSS), group by package and fix, then hand off at most five vuln cards with an exact fix. Use when a request asks for a vulnerability scan, advisory triage, CVE prioritisation or a fix plan.
quality-assurance
JochenYang
Comprehensive code quality assurance covering code review, testing strategies, and security auditing. Identifies bugs, vulnerabilities, performance issues, and maintainability problems. Implements unit/integration/E2E testing and provides actionable recommendations following OWASP and industry best practices.
self-serve-motion
SkeneTechnologies
When the user wants to reduce friction in the self-serve buying experience, optimize in-product checkout, remove "contact sales" gates, or design self-serve onboarding and support. Also use when the user says "frictionless," "self-service," "remove sales gates," "no-demo experience," or "friction audit." For signup flow optimization, see signup-flow-cro. For pricing page design, see pricing-strategy.
spring-boot-scanner
joaquimscosta
Smart code scanner that detects Spring Boot patterns and routes to appropriate skills. Use when editing Java or Kotlin files in Spring Boot projects, working with pom.xml/build.gradle containing spring-boot-starter, or when context suggests Spring Boot development. Detects annotations (@RestController, @Entity, @EnableWebSecurity, @SpringBootTest) to determine relevant skills and provides contextual guidance. Uses progressive automation - auto-invokes for low-risk patterns (web-api, data, DDD), confirms before loading high-risk skills (security, testing, verify).
skills-audit
JochenYang
List all installed skills with line counts and analyze for improvement opportunities. Use when user wants to review, optimize, or clean up their skill collection.