Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
sast-semgrep
vchirrav
Run Semgrep SAST scans on code. Supports 30+ languages with OWASP, security, and custom rulesets. Parses results and provides remediation guidance.
dependency-confusion-detect
vchirrav
Run Confused and GuardDog to detect dependency confusion and typosquatting risks. Checks if internal package names exist on public registries and identifies malicious packages.
security
mrsknetwork
Applies OWASP Top 10 mitigations, secure authentication, authorization, secret management, and data protection practices to FastAPI backends and Next.js frontends. Use for any feature involving auth, user data, payments, file uploads, or system access. Always invoke security review before shipping any user-facing API endpoint.
license-scan-scancode
vchirrav
Run ScanCode Toolkit for comprehensive license and copyright detection. Identifies license types, copyright holders, and compliance obligations across codebases.
secure-coding-generate
vchirrav
Generate secure code following OWASP Secure Coding rules. Automatically detects the security domain and produces code with inline Rule ID citations (e.g., [INPUT-04], [AUTH-07]) plus a rules-applied summary.
secret-scan-trufflehog
vchirrav
Run TruffleHog to detect secrets in git repos, filesystems, and S3 buckets. Uses verification to confirm if detected secrets are live/active.
rtos-analysis
tangjunyi23
Real-Time Operating System vulnerability analysis for embedded devices running FreeRTOS, VxWorks, ThreadX, eCos, and other RTOS platforms
ciso-compliance
jforksy
Compliance management - SOC 2 policies, Vanta integration, evidence collection, audit readiness, and gap analysis
owasp-cloud-native-top-10
yariv1025
"OWASP Cloud-Native Application Security Top 10 - prevention, detection, and remediation for containers, orchestration, and cloud-native apps. Use when securing insecure config, injection, auth, CI/CD and supply chain, secrets, network policies. Note - official list has 6 risks; project archived."
web-security-standards
cuioss
Trusted domains, security assessment patterns, and domain research standards for WebFetch permissions
ai-readiness-audit
cartoonitunes
Audit any website for AI agent readiness. Check llms.txt, MCP servers, structured data, semantic HTML, meta quality, and more. Use when optimizing a site for AI agents, checking AI discoverability, or preparing for AI search engines.
permission-management
cuioss
Permission validation, architecture patterns, anti-patterns, and best practices for Claude Code settings management
code-audit
pietz
Structural health assessment for codebases. Use when the user asks to audit code quality, assess code health, review a codebase, find technical debt, clean up code structure, or identify refactoring opportunities. Also use when asked to do a "code audit", "codebase review", "quality assessment", or "tech debt analysis". Provides parallel multi-lens analysis via sub-agents with specialized checklists for code health, cross-module coherence, refactoring detection, and security.
rails-health-audit
srichsun
Audit the health of any Rails codebase and produce a severity-ranked action plan. Use when asked to audit, health-check, scan, or assess a Rails project for security/performance/maintainability issues, or plan a refactor/optimization. A single "audit X" request always means BOTH run the scan AND deliver a filled, prioritized action plan in one go — never hand back a blank template.
systemd-units
rcgsheffield
Create and harden systemd service unit files following modern best practices. Use when writing new systemd units for web applications, background workers, or daemons, or when hardening existing services with security sandboxing and isolation features. Covers service types, dependencies, restart policies, security options, and filesystem restrictions.
blueagent-x402
madebyshun
Security OS for autonomous agents and builders on Base. 31 pay-per-use tools across Quantum Security, Agent Safety, Research, Data, and Earn. Built for AI agents, Zero-Human Companies (ZHC), and Base ecosystem builders. Pay USDC per call via x402 protocol — no subscription, no API key needed.
cui-java-cdi
cuioss
CDI and Quarkus development standards for CUI projects, including CDI aspects, container configuration, testing, and native optimization
clawvitals
ANGUARDA
Security health checks and secure configuration auditing for OpenClaw. Reviews your core security vitals across authentication, version currency, and platform config. Tracks whether your security posture improves or regresses over time, and alerts on new critical findings. Run "run clawvitals" to get your first score in under 30 seconds.
uunet
copyleftdev
Engineer at global scale in the style of UUNET (now Verizon Business). Emphasizes massive infrastructure resilience, "plumbing" the internet, pragmatic problem solving, and the evolution from moving bits to securing them (DBIR). Use when designing backbone networks, security operations centers, or large-scale distributed systems.
repo-security-audit
WyrdWerk
Quick security checklist for evaluating GitHub repos and npm packages before/after installation. For non-coders and users. Heavy details live in references/.
everclaw
profbernardoj
Open-source first AI inference — GLM-5 as default, Claude as fallback only. Own your inference forever via the Morpheus decentralized network. Stake MOR tokens, access GLM-5, GLM-4.7 Flash, Kimi K2.5, and 30+ models with persistent inference by recycling staked MOR. Open-source first model router routes all tiers to Morpheus by default — Claude only kicks in as an escape hatch when needed. Includes Morpheus API Gateway bootstrap for zero-config startup, OpenAI-compatible proxy with auto-session management, automatic retry with fresh sessions, OpenAI-compatible error classification to prevent cooldown cascades, multi-key auth rotation v2 with proactive DIEM balance monitoring and reactive 402 watchdog, Gateway Guardian v5 with direct curl inference probes (eliminates Signal spam), proactive Venice DIEM credit monitoring, circuit breaker for stuck sub-agents, nuclear self-healing restart, always-on proxy-router with launchd auto-restart, smart session archiver, three-shift cyclic execution engine (v2 with 15-minute execution loops), 24/7 always-on power configuration for macOS, bundled security skills, zero-dependency wallet management via macOS Keychain, x402 payment client for agent-to-agent USDC payments, ERC-8004 agent registry reader for discovering trustless agents on Base, and hardware-aware local Ollama fallback with auto model selection (Qwen3.5 family, 1.5B–72B based on available RAM/GPU).
lampson-system-design
copyleftdev
Design systems using Butler Lampson's principles of abstraction, interfaces, and practical wisdom. Emphasizes clean abstractions, security foundations, and time-tested design hints. Use when making architectural decisions, designing APIs, or building systems that must evolve over decades.
skill-security-checker
fyniujin
'Skill Security — 安全审计扫描器，审一下这个 skill、装之前帮我查查、这个 skill 安全吗？一键快扫 30 秒出三档裁定（✅干净/⚠️可疑/🚫恶意）+ Top3 风险 + 一句话理由；全量模式覆盖轻量 SAST 污点追踪（Python AST + JS 词法近似，source→sink 证据链降误报）、规则引擎（YAML 规则包热插拔扩展）、社区规则（schema 校验 + 来源记录 + 签名验证）、提示注入 ML 语义检测（ONNX + 正则降级）、系统级行为捕获（eBPF Linux / ETW Windows）、动态沙箱执行扫描、供应链风险分析、OSV.dev 离线数据包（全生态 CVE 覆盖，零密钥）+ 锁文件深度解析（requirements.txt / package-lock.json / poetry.lock，版本区间级精确匹配）、恶意 Skill 指纹库、健康度与合规检查（质量+结构+权限合并）、全局排除配置、CI/CD 集成、JSON/HTML/SARIF 报告生成。'
managing-npm
Git-Fg
"Manages npm, pnpm, and bun dependencies following strict protocols. Use when installing, updating, or auditing packages. Do not use for TypeScript configuration or build tooling."