Security
Security scanning and vulnerability detection
email-and-password-best-practices
by better-auth
This skill provides guidance and enforcement rules for implementing secure email and password authentication using Better Auth.
cairo-security
by keep-starknet-strange
Use when reviewing Cairo contracts for security — common vulnerabilities, audit patterns, production hardening, Cairo-specific pitfalls, L1/L2 bridging safety, session key security, precision/rounding bugs, static analysis tooling. Sourced from 50+ public audits and the Cairo Book.
hld-reviewer
by TestAny-io
HLD review, High-Level Design review, 技术方案评审。Use when: HLD 完成后、进入 LLD/实现前需要审查技术设计、检测 PRD→HLD 漂移。
instance-security
by groeimetai
This skill should be used when the user asks to "instance security", "hardening", "security best practices", "authentication", "SSO", "MFA", "session", "XSS", "injection", or any ServiceNow Instance Security development.
security-operations
by groeimetai
This skill should be used when the user asks to "security incident", "SecOps", "vulnerability", "security response", "threat", "SIEM", "security case", or any ServiceNow Security Operations development.
acl-security
by groeimetai
This skill should be used when the user asks to "create ACL", "access control", "security rule", "restrict access", "role based access", "row level security", "field level security", or any ServiceNow ACL and security configuration.
code-review-patterns
by romiluz13
"Internal skill. Use cc10x-router for all development tasks."
reflect
by iliaal
Session retrospective and skill audit. Use when "/reflect", "session review", "retrospective", "what went wrong", "lessons learned", "what should we remember", or "what can we improve".
aws-cost-operations
by zxkane
This skill provides AWS cost optimization, monitoring, and operational best practices with integrated MCP servers for billing analysis, cost estimation, observability, and security assessment.
springboot-migration
by a-pavithraa
Migrate Spring Boot projects to version 4.0 with Java 25, including Spring Modulith 2.0 and Testcontainers 2.x upgrades. Use when user requests upgrading Spring Boot, migrating to Java 25, updating dependencies to Spring Boot 4, mentions Jackson 3 migration, asks about starter renames (web→webmvc, aop→aspectj), fixing test annotations (@MockBean→@MockitoBean), or needs help with Spring Modulith 2.0 or Testcontainers 2.x compatibility. Analyzes codebase for migration issues and guides through changes with specific file references.
java25-springboot4-reviewer
by a-pavithraa
Comprehensive code review for Java 25 and Spring Boot 4 apps. Use when reviewing, checking, auditing, or analyzing Java/Spring Boot code (files, modules, PRs, or full codebases) for migration risks, Spring Boot 4 best practices, JSpecify null-safety, security vulnerabilities, performance bottlenecks, data access pitfalls, architecture boundaries (DDD/Hexagonal/Spring Modulith), or modern Java 25 usage.
owasp-mobile-security-checker
by Harishwarrior
Use when performing security audits, vulnerability assessments, or compliance checks on Flutter or mobile applications. Covers OWASP Mobile Top 10 (2024) — hardcoded secrets (M1), insecure storage (M9), weak cryptography (M10), network issues (M5), and 6 more categories with automated scanners and remediation guidance.
meta-audit
by laurigates
Audit Claude subagent configurations for completeness, security, and best practices
data-quality
by JoelLewis
"Financial data quality management: golden source architecture, data lineage, validation rules, exception management, profiling, monitoring, and governance frameworks."
privacy-data-security
by JoelLewis
"Privacy and data security compliance: Reg S-P, Reg S-ID Red Flags Rule, SEC cybersecurity rules, state privacy laws, vendor management, incident response, data governance."
pre-trade-compliance
by JoelLewis
"Automated pre-trade compliance: rule engines, concentration limits, restricted lists, hard and soft blocks, regulatory limits, client-specific restrictions, and compliance rule configuration."
trade-execution
by JoelLewis
"Trade execution and best execution: venue selection, smart order routing, execution algorithms, transaction cost analysis (TCA), market microstructure, and best execution obligations."
settlement-clearing
by JoelLewis
"Settlement and clearing: T+1 settlement cycle, DTC/NSCC clearing, fails management, corporate actions on settlement, DVP/RVP, continuous net settlement, and settlement risk."
reference-data
by JoelLewis
"Financial reference data: security master, client master, account master, identifiers (CUSIP, ISIN, SEDOL, FIGI), pricing, and reference data governance."
financial-planning-integration
by JoelLewis
"Financial planning integration: goal-based plans, Monte Carlo probability-of-success, plan-to-IPS linkage, scenario analysis, tax-aware planning (QCD, tax-loss harvesting, withdrawal sequencing), Roth conversions, RMD management, SECURE 2.0 Act, Social Security optimization, IRMAA Medicare premiums, 529/donor-advised funds, risk capacity, longevity/sequence-of-returns risk, cash flow modeling by life phase, planning tools (eMoney, MoneyGuidePro, RightCapital), assumption synchronization."
sc-analyze
by htlin222
Analyze code quality, security, performance, and architecture. Use when user asks to analyze code, review codebase health, or identify issues.
recommend-image
by RHEcosystemAppEng
Intelligently recommend the optimal S2I builder image or container base image for a project based on detected language/framework, use-case requirements, security posture, and deployment target. Supports GitHub URLs for remote project analysis (delegates to /detect-project). Use this skill when the user needs a container image recommendation, wants to compare image options, or asks about production vs development images. Triggers on /recommend-image command, or when advanced image selection beyond basic version matching is needed. Supports Node.js, Python, Java, Go, Ruby, .NET, PHP, and Perl on Red Hat UBI.
cve-impact
by RHEcosystemAppEng
CRITICAL: This skill must be used for ALL CVE discovery and listing queries. DO NOT use raw MCP tools like get_cves directly. Use this skill when users request: - Listing critical/high-severity CVEs: "show me critical vulnerabilities", "what are the most critical CVEs", "list all high-severity vulnerabilities" - CVE discovery: "what vulnerabilities affect my account", "show me all CVEs", "what are my security risks" - CVE impact analysis for specific CVEs: "what's the impact of CVE-X?", "analyze CVE-Y" - Risk assessment: "which CVEs are most urgent?", "prioritize vulnerabilities" - Understanding affected systems for a CVE - Comparing CVE severity levels - CVE discovery and prioritization (information gathering) DO NOT use this skill when users request remediation actions like: - "Create a remediation playbook" (use sre-agents:remediator agent) - "Patch CVE-X on system Y" (use sre-agents:remediator agent) - "Remediate these CVEs" (use sre-agents:remediator agent) This skill orchestrates MCP tools (get_cves, get_cve, get_cve_systems) to provide comprehensive CVE analysis with Red Hat Lightspeed context. When users ask for remediation after seeing the analysis, invoke the sre-agents:remediator agent. IMPORTANT: ALWAYS use this skill instead of calling get_cves or other vulnerability MCP tools directly.
planner-rt-ica
by Jamie-BitFlight
Identify required inputs, dependencies, and uncertainty during planning. Use when generating plans or task graphs under incomplete information. Does not block plan generation; instead localizes gaps and creates unblock dependencies.