Security
Security scanning and vulnerability detection
fortify-ssc
by crance
"use this skill whenever the user wants to list and filter application security findings, discover applications and versions, and manage applications using Fortify Software Security Center (SSC). Triggers include: any mention of 'SSC', 'list vulnerabilities', 'list applications', and similar requests indicating interaction with Fortify SSC for application security tasks. OpenText Application Security is the new name for Fortify Software Security Center."
npm-migrate
by AlejandroRV
AI-assisted migration and upgrade of npm packages. Handles breaking changes between major versions, deprecation cleanup within minor versions, adopting new APIs and patterns, security-driven upgrades from npm audit, and full dependency replacement (swapping one package for another, e.g. moment → dayjs). Analyzes changelogs, git diffs, and docs, scans your codebase for actual usage, cross-references to find what's affected, generates targeted code fixes or codemods, and verifies with your test suite. Use this skill whenever a user mentions upgrading, migrating, or updating npm packages, dealing with breaking changes, fixing deprecation warnings, replacing a dependency with an alternative, adopting new APIs from a package update, running npm audit fix with code changes, or comparing what changed between package versions. Trigger phrases include: "upgrade axios to v2", "migrate to express 5", "replace moment with dayjs", "fix deprecation warnings", "npm audit says vulnerable", "adopt the new API", "what changed between version X and Y", "swap lodash for es-toolkit", "help me upgrade my dependencies", "clean up deprecated calls".
forge
by SvarogForge
⚒️ Forge — IT-фабрика, ключевой навык семейства SvarogForge. Supervisor/Worker оркестратор полного IT-цикла: хотелка → Talaria (гонцы pre-market) → отчёт → OK Gate → команда субагентов → Crucible → релиз. Оптимизирован для DeepSeek V4 Flash. Делегирование через delegate_task(role='orchestrator').
code-review
by hrdtbs
Perform a comprehensive and constructive code review. Use this skill when you need to review a pull request, a specific file, or a code snippet. It focuses on correctness, security, performance, maintainability, and style.
backend-audit
by pmco23
Use after build is complete to audit backend code against the project style guide. Supports Go, Python, TypeScript, and C# backends. Checks naming, error handling patterns, package structure, and API conventions. Requires .pipeline/build.complete.
error-handling
by Nomik94
FastAPI 에러 핸들링 패턴 레퍼런스. Use when: 예외 처리, 에러 핸들러, exception handler, 에러 응답, 커스텀 예외, 도메인 예외를 HTTP로 매핑, 전역 에러 핸들링, ValidationError 처리, 404 Not Found, 비즈니스 예외, 에러 코드 체계, 에러 로깅, 예외 계층 설계, mappings.py, DOMAIN_EXCEPTION_MAPPINGS, ErrorBody, @transactional, @retry, @log_execution. NOT for: 보안 관련 예외 (security-audit 참조).
fsharp-review
by bromanko
This skill should be used when the user asks to "review F#", "full F# review", "review all F#", "comprehensive F# review", "review fsharp", or wants a complete review covering code quality, security, performance, and testing for F# code.
ad-intelligence
by tonyflo79
Build comprehensive competitive intelligence on what ads are running and winning in a target vertical. Use when launching a new ad campaign, entering a new market, or refreshing competitive intelligence. Scrapes 500+ competitor ads across 2+ platforms (Meta Ad Library, TikTok Creative Center), classifies every ad by hook type (32-type taxonomy), format, visual style, and estimated run duration. Extracts top 20 winning ad specimens with full verbatim copy transcription and identifies opportunity gaps (underused hook types, format gaps, messaging whitespace). Three modes: Initial Scan (new projects), Continuous Monitor (active campaigns), and Tool-Assisted Scan (pre-scraped data import). Trigger when users mention ad research, competitor ads, ad intelligence, what ads are running, or competitive ad analysis. First skill in the Ad Engine pipeline.
spell-security-review
by codemagicianhq
Use PROACTIVELY before shipping any change that introduces new attack surface, handles sensitive data, or changes trust boundaries.
security-audit-rlm
by freejasonNN
Run and troubleshoot privacy-preserving, local DSPy RLM security audits for large legacy .NET codebases. Use when asked to scan repositories for vulnerabilities, tune RLM/tool limits, fix truncation/stall issues, or produce actionable markdown/json audit outputs without loading entire codebases into model context.
mcp-security-scanner
by contextware
Scan for unprotected MCP servers using @contextware/mcp-scan package. Enables security auditing of local AI tools and network endpoints.
qr-code-scanner-tracking
by tippyentertainment
Design, build, and refine a QR code–based tracking system. This skill helps generate QR codes, define what happens when they are scanned, and track scan events (who, where, when, how) for marketing, operations, product flows, or internal tools.
supabase-best-practices
by jcastillotx
Supabase development standards. Triggers when working with Supabase projects, Row Level Security, real-time subscriptions, or Edge Functions.
vibedefender
by vibedefender
Run the VibeDefender security scanner on the current project and report its security score and the problems it finds — exposed secret keys, Supabase tables without RLS, IDOR (reading another user's data by changing an ID), API routes without authentication, permissive CORS, insecure session cookies, SQL injection and .env files committed to Git. Use when the user asks to check, scan, audit or review the security of their project, app or code, especially apps built with AI tools (Lovable, Bolt, v0, Cursor, Replit). The scan runs locally; the code never leaves the machine.
elm-review
by bromanko
This skill should be used when the user asks to "review Elm", "full Elm review", "review all Elm", "comprehensive Elm review", or wants a complete review covering code quality, security, performance, and testing for Elm code.
fsharp-security-review
by bromanko
This skill should be used when the user asks for "security review", "vulnerability scan", "audit F# security", "security audit", "find vulnerabilities", "check for security issues", or wants a deep security analysis of F# code including input validation, .NET interop safety, and dependency concerns.
base-rules
by ryoshimm
AI エージェンティック開発の基本ルール。プロジェクト調査・コード品質・安全性の共通規約を自動適用する。
solidity-code-review
by whackur
Smart contract code review and security audit methodology for Solidity. Use when reviewing, auditing, or assessing the security of Solidity code. Provides structured review process, severity classification, key inspection areas, and OWASP SCWE integration. Triggers on tasks involving code review, security audit, vulnerability assessment, smart contract review, or best practices check.
security-bounty-hunter
by YuukiFST
Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.
openclaw-skill-auditor
by CalWade
Audit installed OpenClaw skills for security risks, token bloat, and hidden cost patterns. Use this skill whenever the user asks to scan, audit, check, or review their installed skills — including questions like "are my skills safe?", "which skills are wasting tokens?", "do I have any suspicious skills?", "clean up my skills", or "check my OpenClaw skills". Always invoke this skill for any skill health, quality, or cost investigation.
code-review
by Nomik94
Code Reviewer 에이전트 스폰. Use when: /code-review, 코드 리뷰해줘, PR 리뷰, 리뷰해줘, 코드 품질 점검, 리팩토링 방향, 기술 부채 식별, 코드 스멜. NOT for: 단순 포맷팅, 오타 수정.
smart-code-review
by lordprotein
"Expert code review with a senior engineer lens. Reviews git changes or targeted code (files, folders, features). Detects SOLID violations, security risks, and proposes actionable improvements."
security-sweep
by kirvin
Retrospective security analysis of a PR or branch. Detects the project stack, loads matching finding patterns, scans changed files across seven categories, triages by severity, and creates beads tasks for remediation. Use after code is written to catch what proactive review missed.
_security-compliance-mastery
by TriNgo0108
Master application security, threat mitigation, compliance frameworks, and secure authentication. Use this as a central index to access specialized sub-skills.