Security
Security scanning and vulnerability detection
email-and-password-best-practices
by lukevella
This skill provides guidance and enforcement rules for implementing secure email and password authentication using Better Auth.
octocode-roast
by bgauryy
This skill should be used when the user asks to "roast my code", "review code brutally", "find code sins", "what's wrong with my code", "shame my code", "critique this code", "find antipatterns", "code quality roast", or wants entertaining but actionable code criticism with severity-ranked fixes. Delivers brutally honest roasts with file:line citations and redemption paths.
openai-security-best-practices
by trailofbits
Perform language and framework specific security best-practice reviews and suggest improvements.
openai-security-ownership-map
by trailofbits
'Analyze git repositories to build a security ownership topology (people-to-file), compute
k8s-security-policies
by HermeticOrmus
Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.
ascii-motd-profile-banner
by partme-ai
Generate ASCII-only MOTD / SSH login banner / shell profile welcome messages (short/long variants, quiet mode guidance, security notices).
codex-autoresearch
by leo-lilinxiao
"Autonomous long-running iteration for Codex CLI. Use when the user wants Codex to plan or run an unattended improve-verify loop toward a measurable or verifiable outcome, especially for overnight runs; it also covers repeated debugging, fixing, security auditing, and ship-readiness workflows. Do not use for ordinary one-shot coding help or casual Q&A."
reverse-engineer-rpi
by boshu2
'Reverse-engineer a product into a feature catalog, code map, and specs. Uses RPI-style loop with verification gates. Triggers: “reverse engineer”, “catalog features”, “feature inventory”, “code map”, “docs to code mapping”, “binary analysis”.'
prompt-refiner-gpt
by Factory-AI
Refine prompts for GPT models (GPT-5, GPT-5.1, Codex) using OpenAI's best practices. Use when preparing complex tasks for GPT.
scv-scan
by trailofbits
"Audits Solidity codebases for smart contract vulnerabilities using a four-phase workflow (cheatsheet loading, codebase sweep, deep validation, reporting) covering 36 vulnerability classes. Use when auditing Solidity contracts for security issues, performing smart contract vulnerability scans, or reviewing Solidity code for common exploit patterns."
security-awareness
by trailofbits
Teaches agents to recognize and avoid security threats during normal activity. Covers phishing detection, credential protection, domain verification, and social engineering defense. Use when building or operating agents that access email, credential vaults, web browsers, or sensitive data.
ship-safe-score
by asamassekou10
Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?"
aif-review
by lee-to
Perform code review on staged changes or a pull request. Checks for bugs, security issues, performance problems, and best practices. Use when user says "review code", "check my code", "review PR", or "is this code okay".
cloud-huawei-ecs
by partme-ai
Provides comprehensive guidance for Huawei Cloud ECS including instance creation, configuration, security groups, and ECS management. Use when the user asks about Huawei Cloud ECS, needs to create ECS instances, configure ECS, or manage Huawei Cloud compute resources.
cloud-tencent-cvm
by partme-ai
Provides comprehensive guidance for Tencent Cloud CVM including instance creation, configuration, security groups, and CVM management. Use when the user asks about Tencent Cloud CVM, needs to create CVM instances, configure CVM, or manage Tencent Cloud compute resources.
security-hardening
by rohitg00
Application security covering input validation, auth, headers, secrets management, and dependency auditing
config-analyzer
by cisco-ai-defense
Analyze configuration files for validation and best practices
graphql-inspector-audit
by TheBushidoCollective
Use when auditing GraphQL operations for complexity metrics, depth analysis, directive usage, or query performance concerns.
ship-safe
by asamassekou10
Run a full security audit on this project — 12 agents scan for secrets, injections, auth bypass, SSRF, supply chain attacks, misconfigs, and more. Use when the user wants a security audit, vulnerability scan, or asks if their code is safe to ship.
bk-monitor-security-audit
by TencentBlueKing
对前端代码进行安全审计，检测 XSS、CSRF 等漏洞。当用户请求代码审查或询问代码安全性时使用。
webapp-sqlmap
by AgentSecOps
Automated SQL injection detection and exploitation tool for web application security testing. Use when: (1) Testing web applications for SQL injection vulnerabilities in authorized assessments, (2) Exploiting SQL injection flaws to demonstrate impact, (3) Extracting database information for security validation, (4) Bypassing authentication mechanisms through SQL injection, (5) Identifying vulnerable parameters in web requests, (6) Automating database enumeration and data extraction.
ln-512-tech-debt-cleaner
by levnikolaevich
"Automated tech debt cleanup worker (L3). Reads codebase audit findings, applies safe auto-fixes for low-risk issues (unused imports, dead code, commented-out code, deprecated aliases). Confidence >=90% only. Creates single commit with summary."
ln-620-codebase-auditor
by levnikolaevich
"Coordinates 9 specialized audit workers (security, build, architecture, code quality, dependencies, dead code, observability, concurrency, lifecycle). Researches best practices, delegates parallel audits, aggregates results into docs/project/codebase_audit.md."
what-not-to-do-as-product-manager
by flpbalada
Anti-patterns and mistakes to avoid as a product manager. Use when evaluating