Auth
Authentication and authorization
non-repudiation-privacy
by florianbuetow
This skill should be used when the user asks to "check for non-repudiation privacy risks", "analyze excessive audit logging", "find privacy issues related to accountability", "check for forced identity linking", or mentions "non-repudiation" in a privacy context. Maps to LINDDUN category N. This is the INVERSE of STRIDE repudiation -- here too much proof is the threat.
learn
by florianbuetow
This skill should be used when the user asks to "learn about security", "teach me OWASP", "security tutorial", "learn threat modeling", or invokes /appsec:learn. Interactive guided walkthrough using your codebase as teaching material.
strava
by eddmann
Query Strava fitness data including activities, athlete stats, segments, routes, clubs, and gear. Use when the user asks about cycling, running, swimming, workouts, training, or Strava data.
pasta-vulns
by florianbuetow
This skill should be used when the user asks to "analyze vulnerabilities", "find security weaknesses", "map CWEs", "run vulnerability analysis", or is running PASTA stage 5. Also triggers when the user asks about SAST, DAST, dependency scanning, or CWE mapping in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 5 of 7).
api
by florianbuetow
This skill should be used when the user asks to "check API security", "audit REST API", "find BOLA vulnerabilities", "check for mass assignment", "analyze API rate limiting", "detect excessive data exposure", or mentions "API security", "BOLA", "IDOR", "mass assignment", "rate limiting", "broken function-level authorization", "excessive data exposure", or "OWASP API Top 10" in a security context.
auth
by florianbuetow
This skill should be used when the user asks to "check for authentication issues", "analyze auth", "find credential vulnerabilities", "review login security", "check session management", or mentions "authentication", "passwords", "MFA", "sessions", or "brute force" in a security context. Maps to OWASP Top 10 2021 A07: Identification and Authentication Failures.
postkit
by varunchopra
PostgreSQL-native identity, configuration, metering, and job queues. SQL functions that work with any language or driver. Use when working with user management, sessions, permissions, access control, login/logout, MFA, password resets, relationship-based access, versioned configuration, prompts, usage tracking, quotas, billing periods, or background jobs in PostgreSQL. Covers authn (user/session management), authz (ReBAC permissions), config (versioned key-value storage), meter (usage tracking with reservations), and queue (job scheduling with retries and dead letters).
attack-surface
by florianbuetow
This skill should be used when the user asks to "map attack surface", "list entry points", "inventory API endpoints", "find all inputs", "enumerate routes", "discover exposed endpoints", or "map external interfaces". Also triggers when the user asks about exposed APIs, form handlers, file upload endpoints, WebSocket handlers, CLI argument parsers, or wants to understand where external data enters the system.
access-control
by florianbuetow
This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDOR vulnerabilities", "audit CORS configuration", "check for privilege escalation", or mentions "access control", "authorization", "IDOR", "CORS", "JWT tampering", or "directory traversal" in a security context. Maps to OWASP Top 10 2021 A01: Broken Access Control.
review-plan
by florianbuetow
This skill should be used when the user asks to "review plan for security", "check plan for security issues", "security review of implementation plan", "audit the plan for vulnerabilities", or "check my plan before coding". Also triggers when the user mentions security in the context of an implementation plan, architecture proposal, or design document before code has been written. This is the FLAGSHIP pre-code security skill -- no other tool reviews plans at design time.
tmux
by sebnow
"Teaches agents to control tmux sessions for interactive CLIs and long-running processes via the Bash tool. Use when running REPLs, debuggers, database shells, long-running servers, or any tool requiring a persistent TTY. Triggers: 'start a REPL', 'run interactively', 'interactive session', 'long-running process', 'background server', 'keep running'. Do NOT use for simple one-shot commands or non-interactive background tasks that the Bash tool handles natively."
adr-writing
by sebnow
"Use when documenting significant architectural decisions. Creates focused ADRs explaining context, decision, and alternatives. Prevents vague documentation and implementation detail bloat. Triggers: 'create ADR', 'document decision', making technology/framework/persistence/auth choices, cross-cutting concerns."
form-security
by Bbeierle12
Security patterns for web forms including autocomplete attributes for password managers, CSRF protection, XSS prevention, and input sanitization. Use when implementing authentication forms, payment forms, or any form handling sensitive data.
commit
by nweii
"Create well-formatted commits with conventional commit messages. Use when user asks to commit, wants to commit changes, or needs help with commit messages."
archive-conversation
by nweii
"Create analytical archival summaries of AI conversations, capturing intellectual journeys, key insights, and technical logs. Use when archiving, saving, or documenting a chat session."
reppo
by diegosouzapw
Publish content to Moltbook (a social network for AI agents) and mint it on Reppo.ai's AgentMind subnet. Use when an agent wants to post poems, ideas about Moltbook's future, or creative content. Covers the full flow: generate content, post to Moltbook, mint pod on-chain (Base), submit metadata. Can also buy REPPO tokens via Uniswap. Earns $REPPO emissions through human voting.
go-backend-clean-architecture
by rebyteai-template
Go backend with Gin, MongoDB, JWT auth, and Clean Architecture.
clawvault
by Versatly
Agent memory system with checkpoint/recover, structured storage, semantic search, session transcript repair, and optional cloud sync. Use when: storing/searching memories, preventing context death, repairing broken sessions. Don't use when: general file I/O.
flow-note
by benkruger
"Invoke automatically whenever the user corrects Claude, disagrees with a response, or says something was wrong. Also invoke explicitly with /flow:flow-note to capture any learning mid-session. Fast — captures and continues without interrupting flow."
flow-continue
by benkruger
"Resume the current FLOW feature. Mid-session: re-asks the last phase transition question. New session: reads state file, shows status, then asks."
detect-product
by parhumm
Product reality extraction with evidence-backed features, monetization, and metrics. Use when analyzing product capabilities.
springboot-security
by x-cmd
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
iterative-retrieval
by x-cmd
Pattern for progressively refining context retrieval to solve the subagent context problem
eval-harness
by x-cmd
Formal evaluation framework for Claude Code sessions implementing eval-driven development (EDD) principles