Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
repo-compliance-audit
okwinds
对任意代码仓库进行合规审计并生成可取证报告（Markdown + JSON findings），覆盖“是否遵循 AGENTS.md/仓库规则/用户指令”“文档索引/规格/工作记录/任务总结”“TDD 与离线回归证据”“可复现性（.env.example 等）”“潜在密钥泄露与仓库卫生”等；并支持在人类勾选 finding.id 后执行选择性低风险整改（默认不改业务逻辑）。触发场景：仓库交付前自检、接手陌生仓库、需要合规审计报告、需要把整改条目做成可选择的执行清单。
code-reviewer
sidetoolco
Expert code review specialist. Reviews code for quality, security, and maintainability. Use immediately after writing or modifying code, or when you need thorough code quality assessment.
enumeration-protocol-execution
starwreckntx
Enforce a Divergent-Convergent Scan loop to overcome 'Prevalent Noun Bias' and statistical probability reflexes (System 1).
concept-mastery-validator
jorgealves
Verifies alignment between curriculum modules and generated projects to ensure no knowledge gaps. Use to audit the logical flow of a teaching program and ensure students are prepared for assigned tasks.
security
pluginagentmarketplace
Production-grade security testing skill with OWASP Top 10, vulnerability scanning, penetration testing guidance, and compliance validation
antidote-threat-handler
starwreckntx
Detect and respond to ideological drift, sycophantic patterns, and alignment threats using the Antidote Protocol.
solidity-security
Krosebrook
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
aiken-dex-security-audit
Flux-Point-Studios
Adversarial security audit playbook for Plutus V3 Aiken DEX contracts (threat model, invariants, findings, tests, tx repro shapes).
Security Review
violetio
Security review with blocking authority for critical vulnerabilities
lint
carmandale
Use this agent when you need to run linting and code quality checks on Ruby and ERB files. Run before pushing to origin.
aiken-dex-security-audit-operator
Flux-Point-Studios
"Operator skill: run local Aiken build/test commands and capture evidence for the audit. Manual invoke only."
docker-architect
BjornMelin
SOTA Docker/Compose architecture, implementation, refactor, and security hardening. Use when working on containerization tasks such as creating or rewriting Dockerfiles, docker-compose files, buildx/bake configs, .dockerignore, and CI pipelines for build/test/scan/publish; auditing existing container setups for security, correctness, size/perf, and best practices (least privilege, non-root, minimal images, pinned base images, BuildKit secrets, healthchecks); debugging Docker build/run issues; or designing dev vs prod compose workflows across services (DB/cache/queues) with correct networking, volumes, secrets, and resource limits.
code-review-excellence
liuchiawei
Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.
streamlit-master-architect
BjornMelin
Architect-level Streamlit development for building, refactoring, debugging, testing, and deploying Streamlit apps (single-page or multipage) with correct rerun/state/caching/fragments, AppTest-based testing, custom components v2, safe theming/CSS, security-by-default, and Playwright MCP end-to-end automation.
ui-ux-audit
WomenDefiningAI
Mandatory audit workflow for UI/UX changes that reads current state FIRST, checks for redundancy, respects clean design philosophy, and identifies genuine gaps before implementation. Auto-invoked when user mentions UI, UX, design, layout, homepage, page improvements, visual changes, or interface modifications.
sast-semgrep
rohunj
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based detection, (3) Integrating SAST checks into CI/CD pipelines, (4) Providing remediation guidance with OWASP Top 10 and CWE mappings, (5) Creating custom security rules for organization-specific patterns, (6) Analyzing dependencies for known vulnerabilities.
sca-trivy
rohunj
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.
javascript-security
cuioss
"Use when reviewing or hardening JavaScript security — DOM trust boundaries, XSS sinks (innerHTML/outerHTML/insertAdjacentHTML), safe text rendering, sanitization (DOMPurify), and Trusted Types. The focused JavaScript security surface resolved via skills_by_profile.security; a thin pointer that delegates cross-cutting foundations upward to plan-marshall:persona-security-expert."
persona-security-expert
cuioss
Security-expert persona — the work identity for security review and hardening, and the central authoritative home for cross-cutting security knowledge (OWASP Top 10, STRIDE, secrets, secure logging, trust boundaries, authn/authz, secure design)
length-extension-attacks-anti-pattern
igbuend
"Security anti-pattern for hash length extension vulnerabilities (CWE-328). Use when generating or reviewing code that uses hash(secret + message) for authentication, API signatures, or integrity verification. Detects Merkle-Damgard hash misuse."
integer-overflow-anti-pattern
igbuend
"Security anti-pattern for integer overflow vulnerabilities (CWE-190). Use when generating or reviewing code that performs arithmetic on user-controlled values, handles sizes/quantities, or calculates prices/amounts. Detects overflow in validated inputs."
security-hunter-ts
skyosev
Audit TypeScript code for security vulnerabilities — hardcoded secrets, injection risks, missing input validation at trust boundaries, insecure defaults, auth gaps, sensitive data exposure, and unsafe patterns like eval or innerHTML. Use when: reviewing TypeScript code before deployment, auditing trust boundaries, preparing for a security review, onboarding third-party integrations, or hardening an application.
simplicity-hunter-go
skyosev
Audit Go code for unnecessary structural complexity — duplication, avoidable abstractions, dead logic paths, over-parameterized APIs, deep nesting, interface pollution, channel misuse, and mixed concerns. Recommends the simplest shape that preserves intended behavior. Use when: reviewing Go code for over-engineering, reducing complexity after prototyping, enforcing reuse over addition, or simplifying before a refactor.
persona-auditor
cuioss
Audit persona that composes other personas as evaluation lenses across a wide scope