Security
Security scanning and vulnerability detection
remove-dead-code
by qdhenry
Safely identifies and removes dead code in TypeScript/JavaScript projects using multi-agent analysis with automatic backup branches. Use when cleaning up unused exports, orphaned files, dead imports, unreachable functions, or unused dependencies.
cognitive-fallacies-guard
by lyndonkl
Use when detecting and preventing visual misleads, cognitive biases, and design failures in data visualizations, dashboards, reports, or presentations. Invoke when user mentions chartjunk, misleading chart, truncated axis, data integrity, visual deception, 3D chart problems, cherry-picking data, or needs to audit visualizations for honesty and accuracy.
debt-audit
by wcygan
Re-audit regularly - debt grows; quarterly audits prevent accumulation
launch-ready
by wcygan
Vague recommendations: "Monitor closely" is not a mitigation plan
postmortem-team
by wcygan
Blameless language guide
security-review
by wcygan
Run a targeted security audit on specified files or modules. Uses OWASP-informed checks, dependency vulnerability scanning, and auth/input validation review. Use for security audits, vulnerability checks, or before deploying sensitive code. Keywords: security, audit, vulnerability, OWASP, CVE, secrets, injection, XSS, auth, authentication, authorization
arch-review
by wcygan
RFC-style review of major technical decisions using a 5-agent debate team. Spawns tech-lead, security-auditor, performance-analyst, reliability-engineer, and devils-advocate for independent analysis followed by structured discussion. Produces decision document with pros/cons, dissenting opinions, and recommendation. Use for architecture decisions, technology selection, major refactors, design reviews. Keywords: architecture, RFC, design review, technical decision, architecture review, design decision, major change
symfony:form-types-validation
by MakFly
Strengthen Symfony authorization and validation boundaries with explicit, test-backed enforcement. Use for form types validation tasks.
symfony:symfony-voters
by MakFly
Strengthen Symfony authorization and validation boundaries with explicit, test-backed enforcement. Use for symfony voters tasks.
symfony:api-platform-security
by MakFly
Deliver robust API Platform contracts in Symfony with explicit operations, mapping, and policy-safe behavior. Use for api platform security tasks.
graphql-inspector-audit
by TheBushidoCollective
Use when auditing GraphQL operations for complexity metrics, depth analysis, directive usage, or query performance concerns.
risk-assess
by sd0xdev
"Uncommitted code risk assessment with breaking change detection, blast radius analysis, and scope metrics. Use when: evaluating PR risk, pre-commit risk check, large refactoring review. Not for: security vulnerabilities (use /codex-security), code correctness (use /codex-review-fast). Output: 3-dimension weighted score + risk level + gate."
project-audit
by sd0xdev
"Project health audit with deterministic scoring. Use when: evaluating project quality, onboarding to new codebase, periodic health checks. Not for: runtime performance analysis, security-specific audits (use /codex-security). Output: 5-dimension score + actionable findings."
security-review
by sd0xdev
"Security review via Codex MCP. Use when: OWASP Top 10 audit, dependency vulnerability check, security-sensitive changes. Not for: code review (use codex-code-review), test review (use test-review). Output: security findings + audit report."
agent-teams-simplify-and-harden
by pskoett
"Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or the loop cap is reached. Use when: implementing features from a spec or plan, hardening existing code, fixing a batch of issues, or any multi-file task that benefits from a build-verify-fix cycle."
security
by OpenHands
Security best practices for secure coding, authentication, authorization, and data protection. Use when developing features that handle sensitive data, user authentication, or require security review.
Desktop Application Development (Electron & Tauri)
by anton-abyzov
"Desktop application development with Electron and Tauri. Covers cross-platform native apps, IPC communication, security hardening, packaging, auto-updates, native APIs, and performance optimization. Activates for: Electron, Tauri, desktop app, native app, cross-platform desktop, BrowserWindow, IPC, system tray, menubar app, auto-updater, code signing, notarization."
DevSecOps Expert - Shift-Left Security
by anton-abyzov
DevSecOps expert for shift-left security including container scanning, SAST/DAST, dependency scanning, secret detection, SBOM generation, supply chain security (SLSA/Sigstore), Kubernetes security policies, compliance-as-code, and secure CI/CD pipeline design.
Code Grill Expert
by anton-abyzov
Critical code review and quality interrogation before increment completion. Use when finishing a feature, before /sw:done, or when saying "grill the code", "review my work", "critique implementation".
android-apk-audit
by DragonJAR
Comprehensive Android APK security audit with static analysis, dynamic instrumentation, source-to-sink tracing, IPC/component abuse analysis, and CVSS 4.0 reporting. Covers decompilation, manifest analysis, deep links and intent injection, secrets detection, crypto analysis, Frida/Objection integration, and APK repackaging. Use when user says "audit APK", "analyze android app", "mobile pentest", "APK security", "decompile APK", "android vulnerability assessment", "reverse engineer android", "modify APK", "intent injection", "deep link abuse", "bypass SSL pinning", "bypass root detection", or provides an APK for security review, decompiled Android sources, or decoded resources.
vuln-analysis-expert
by tanweai
WooYun漏洞分析专家系统。基于88,636个真实漏洞案例提炼的元思考方法论、测试流程、利用技巧、绕过方法。覆盖SQL注入、XSS、命令执行、逻辑漏洞、文件上传、未授权访问等主要漏洞类型。当用户进行漏洞挖掘、渗透测试、安全审计、代码审计时触发。
asking-questions
by oaustegard
Guidance for asking clarifying questions when user requests are ambiguous, have multiple valid approaches, or require critical decisions. Use when implementation choices exist that could significantly affect outcomes.
ast-grep-search
by laurigates
Find and replace code patterns structurally using ast-grep. Use when you need to match code by its AST structure (not just text), such as finding all functions with specific signatures, replacing API patterns across files, or detecting code anti-patterns that regex cannot reliably match.
memory-audit
by nhadaututtheky
Comprehensive memory quality review across 6 dimensions: purity, freshness, coverage, clarity, relevance, and structure. Generates prioritized findings with specific memory references and actionable recommendations.