Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
dev-work-summary
otrebu
Scan ~/dev recursively for git repos and report today's work with commits, branches, stats, and detailed change analysis. Use when user asks "what did I work on", "show my work", "daily summary", "what repos did I touch".
backend-development
mamba-mental
Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.
dependabot-alert-issue
shoji9x9
Dependabot alerts または外部 audit findings（例 pnpm audit の正規化 JSON）を確認し、解消 Issue を gh で作成するスキル。対象を「すぐ着手できるか」で分類し、着手可能なものは severity 毎、ブロック中のものは脆弱パッケージ＋解決バージョン毎にまとめる。既存 Issue/PR はスキップし、特定 alert の ignore/dismiss も設定できる。pnpm.overrides 等の品質が保証されない回避策は採らない。「Dependabot alerts から Issue」「pnpm audit の結果から Issue」「脆弱性対応の Issue」「dependabot-alert-issue」で必ず発動する。
Awareness Skill
fabioc-aloha
"Proactive detection, self-correction, and epistemic vigilance"
code-security-audit
LeonMelamud
Perform security audits on code changes, diffs, or branches to find high-confidence exploitable vulnerabilities. Use when asked to "audit security", "review for vulnerabilities", "security scan", "check for security issues", "audit this PR", "review these changes for security", or "find vulnerabilities in diff". Distinct from security-review (which provides secure coding patterns/checklists) — this skill actively audits code changes using a structured methodology with false positive filtering. Includes Python scripts for GitHub Action CI integration and PR evaluation.
skill-vetter
Tai-ch0802
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
damage-control
ThrownLemon
Security protection system that blocks dangerous commands and protects sensitive files
architecture-doc-auditor
Agentient
Systematic completeness audit of Architecture Documentation using 188-item viewpoint-based checklist, severity-classified gap detection, technical debt indicators, and architecture anti-pattern scanning. Supports TOGAF, C4, arc42, and IEEE 42010 frameworks. PROACTIVELY activate for: (1) Architecture review gates, (2) ADR validation before implementation, (3) C4 diagram completeness check, (4) Technical debt assessment, (5) Pre-implementation validation, (6) Governance compliance audit, (7) Design doc handoff review. Triggers: "audit architecture", "review ADR", "check architecture doc", "validate design doc", "architecture review", "audit C4 diagrams", "check system context", "technical debt assessment", "architecture health check", "governance review", "architecture completeness"
code-audit-readonly
Jpkovas
Execute a complete, deterministic, read-only repository audit and produce a single improvements.md action plan with traceable findings (file + lines), severity, category, impact, and high-level fixes. Use when users ask for full code audits, security/performance/architecture reviews, file-by-file analysis, or technical debt mapping without modifying project files.
review-spec
ferueda
Review a spec document against codebase reality, identifying gaps and ensuring sound, robust implementations.
prd-completeness-auditor
Agentient
Systematic completeness audit of Product Requirements Documents using 100+ item MECE checklist, severity-classified gap detection, and anti-pattern scanning. PROACTIVELY activate for: (1) PRD review before development handoff, (2) Requirements completeness assessment, (3) Identifying ambiguous requirements, (4) PRD template validation, (5) Finding missing stakeholder needs, (6) Detecting inconsistent acceptance criteria. Triggers: "audit PRD", "review requirements", "check PRD completeness", "validate requirements document", "PRD review", "requirements audit", "find gaps in PRD", "requirements completeness check", "PRD quality check"
mesh-security
hackIDLE
Analyze Istio, Consul, and Linkerd service mesh configurations for security vulnerabilities with NIST 800-53 control mappings. Use when users need to audit mesh security, identify misconfigurations, check mTLS settings, review ACL policies, or prepare for FedRAMP assessments. Triggers on keywords like "mesh config", "istio security", "consul ACL", "linkerd policy", "service mesh audit", or "NIST compliance".
iac-security-scanner
hackIDLE
Scan Terraform, Kubernetes, CloudFormation, ARM templates, and Dockerfiles for security misconfigurations using 790 Terrascan-derived policies with NIST 800-53 control mappings. Use when users need to review IaC for security issues, audit cloud configurations, check compliance posture, harden infrastructure code, or identify misconfigurations across AWS, Azure, GCP, and Kubernetes before deployment.
firestore-security-rules-generation
Agentient
Firestore Security Rules patterns for user-scoped access, RBAC, and field validation. PROACTIVELY activate for: (1) implementing user-scoped data access rules, (2) setting up role-based access with custom claims, (3) validating fields and enforcing immutability. Triggers: "security rules", "rbac", "firestore rules"
asi_bias_detect
ariffazil
A2A v1.0 federation gateway and state plane. Routes intent. Displays state. Never judges, never executes. DISPLAY_ONLY.
soc2-compliance
peixotorms
Use when building SaaS platforms, cloud services, customer-facing APIs, multi-tenant systems, or any service handling customer data that requires SOC 2 certification — Trust Services Criteria, TSC, CC1 through CC9, Type I, Type II, AICPA, security, availability, processing integrity, confidentiality, privacy, evidence collection, vendor management, penetration testing, risk assessment, access review, change management, incident response
Security Check Skill
hitoshura25
Consider additional security reviews for sensitive changes
frontend-security-basics
SanctifiedOps
Secure Solana frontends against phishing, bad prompts, and unsafe signing requests. Use for audits of wallet UX and dApp sites.
ai-lingo
sunnypatneedi
Meta-skill that maps cognitive mode-switch words to appropriate thinking behaviors and skills. AUTO-INVOKE when user uses these trigger patterns: - Depth: "rigorous", "first-principles", "mechanistic", "axiomatic", "falsifiable", "steelman", "non-trivial", "exhaustive", "load-bearing", "dispositive", "ultra think hard" - Reframe: "reimagine", "orthogonal", "contrarian", "subversive", "invert", "counterfactual", "zero-based", "provocative", "transmute", "reframe" - Precision: "probabilities", "bounded", "monotonic", "asymptotic", "invariant", "order of magnitude", "sensitivity analysis", "convex", "distribution", "marginal", "dimensionality" - Tradeoff: "sacrifice", "irreversible", "binding constraint", "pareto", "second-order", "opportunity cost", "regret minimization", "non-negotiable", "asymmetric" - Quality: "elegant", "idiomatic", "canonical", "production-grade", "battle-tested", "minimalist", "composable", "tasteful", "crisp" - Systems: "emergent", "cascading", "equilibrium", "phase transition", "feedback loop", "attractor", "entropy" - Epistemic: "Bayesian", "calibrated", "crux", "pre-mortem", "adversarial", "sparse", "steel-thread", "epistemic humility", "signal-to-noise"
security-hardening
1Mangesh1
Security hardening and secure coding practices. Use when user asks to "harden security", "secure coding", "OWASP vulnerabilities", "input validation", "sanitization", "SQL injection prevention", "XSS protection", "CORS security", "secure headers", "vulnerability scanning", or mentions security best practices and threat mitigation.
secret-scanner
1Mangesh1
This skill should be used when the user asks to "scan for secrets", "find API keys", "detect credentials", "check for hardcoded passwords", "find leaked tokens", "scan for sensitive keys", "check git history for secrets", "audit repository for credentials", or mentions secret detection, credential scanning, API key exposure, token leakage, password detection, or security key auditing.
database-specialist
samChang72
優化資料庫查詢，消除慢查詢，設計高效索引與 Schema。
suggesting-improvements
C0ntr0lledCha0s
Expert at suggesting specific, actionable improvements to Claude's responses and work. Use when Claude's output needs enhancement, when quality issues are identified, or when iterating on solutions.
security-audit
factorial-io
Use when conducting security reviews, investigating vulnerabilities, or creating security documentation - provides systematic methodology for code audits with severity assessment, dual documentation patterns (client + internal), and acceptance-focused ticket creation