Security
Security scanning and vulnerability detection
api-spectral
by AgentSecOps
API specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1) Validating OpenAPI/AsyncAPI specifications for security issues and design flaws, (2) Enforcing API design standards and governance policies across API portfolios, (3) Creating custom security rules for API specifications in CI/CD pipelines, (4) Detecting authentication, authorization, and data exposure issues in API definitions, (5) Ensuring API specifications comply with organizational security standards and regulatory requirements.
iac-checkov
by AgentSecOps
Infrastructure as Code (IaC) security scanning using Checkov with 750+ built-in policies for Terraform, CloudFormation, Kubernetes, Dockerfile, and ARM templates. Use when: (1) Scanning IaC files for security misconfigurations and compliance violations, (2) Validating cloud infrastructure against CIS, PCI-DSS, HIPAA, and SOC2 benchmarks, (3) Detecting secrets and hardcoded credentials in IaC, (4) Implementing policy-as-code in CI/CD pipelines, (5) Generating compliance reports with remediation guidance for cloud security posture management.
claude-reflect
by BayramAnnakov
Self-learning system that captures corrections during sessions and reminds users to run /reflect to update CLAUDE.md. Use when discussing learnings, corrections, or when the user mentions remembering something for future sessions.
discover-infrastructure
by rand
Automatically discover infrastructure and DevOps skills when working with Terraform, IaC, infrastructure as code, cloud platforms, Cloudflare Workers, or cost optimization. Activates for infrastructure development tasks.
accelint-ts-audit-all
by gohypergiant
Comprehensive TypeScript file audit system. Command-only skill (no natural triggers). Accepts file or directory path to systematically audit through accelint-ts-testing, accelint-ts-best-practices, accelint-ts-performance, and accelint-ts-documentation skills. Maintains progress tracking across sessions with interactive change approval. Uses isolated git worktrees to enable parallel audits without conflicts.
Next.js Security Scan
by sugarforever
"Comprehensive security vulnerability scanner for Next.js and TypeScript/JavaScript projects. Detects OWASP Top 10 vulnerabilities, XSS, injection flaws, authentication issues, hardcoded secrets, and Next.js-specific security problems. Audits dependencies for known CVEs and generates actionable security reports."
cve-impact
by RHEcosystemAppEng
CRITICAL: This skill must be used for ALL CVE discovery and listing queries. DO NOT use raw MCP tools like get_cves directly. Use this skill when users request: - Listing critical/high-severity CVEs: "show me critical vulnerabilities", "what are the most critical CVEs", "list all high-severity vulnerabilities" - CVE discovery: "what vulnerabilities affect my account", "show me all CVEs", "what are my security risks" - CVE impact analysis for specific CVEs: "what's the impact of CVE-X?", "analyze CVE-Y" - Risk assessment: "which CVEs are most urgent?", "prioritize vulnerabilities" - Understanding affected systems for a CVE - Comparing CVE severity levels - CVE discovery and prioritization (information gathering) DO NOT use this skill when users request remediation actions like: - "Create a remediation playbook" (use sre-agents:remediator agent) - "Patch CVE-X on system Y" (use sre-agents:remediator agent) - "Remediate these CVEs" (use sre-agents:remediator agent) This skill orchestrates MCP tools (get_cves, get_cve, get_cve_systems) to provide comprehensive CVE analysis with Red Hat Lightspeed context. When users ask for remediation after seeing the analysis, invoke the sre-agents:remediator agent. IMPORTANT: ALWAYS use this skill instead of calling get_cves or other vulnerability MCP tools directly.
tool-ast-grep-rules
by Heyvhuang
'Write AST-based code search and rewrite rules using ast-grep YAML. Create linting rules, code modernizations, and API migrations with auto-fix. Use when the user mentions ast-grep, tree-sitter patterns, code search rules, lint rules with YAML, AST matching, or code refactoring patterns.'
competitor-scan
by WellApp-ai
Research best-in-class products using Browser MCP and WebSearch
mcp-cloudflare
by Heyvhuang
"Manage Workers/KV/R2/D1/Hyperdrive via Cloudflare MCP, perform observability/build troubleshooting/audit/container sandbox operations. Triggers: worker/KV/R2/D1/logs/build/deploy/screenshot/audit/sandbox. Three permission tiers: Diagnose (read-only), Change (write requires confirmation), Super Admin (isolated environment). Write operations must follow read-first, user confirmation, post-execution verification."
cloudflare
by Heyvhuang
"Infrastructure operations for Cloudflare: Workers, KV, R2, D1, Hyperdrive, observability, builds, audit logs. Triggers: worker/KV/R2/D1/logs/build/deploy/audit. Three permission tiers: Diagnose (read-only), Change (write requires confirmation), Super Admin (isolated environment). Write operations follow read-first, confirm, execute, verify pattern. MCP is optional — works with Wrangler CLI/Dashboard too."
cybersecurity-analyst
by rysweet
Analyzes events through cybersecurity lens using threat modeling, attack surface analysis, defense-in-depth, zero-trust architecture, and risk-based frameworks (CIA triad, STRIDE, MITRE ATT&CK). Provides insights on vulnerabilities, attack vectors, defense strategies, incident response, and security posture. Use when: Security incidents, vulnerability assessments, threat analysis, security architecture, compliance. Evaluates: Confidentiality, integrity, availability, threat actors, attack patterns, controls, residual risk.
code-review
by SimHacker
Systematic code analysis with evidence collection
security-assessment
by rsmdt
Vulnerability review, OWASP patterns, secure coding practices, and threat modeling approaches. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations.
network-scan
by proficientlyjobs
Scan your LinkedIn contacts' companies for matching job openings
ai-discoverability-audit
by BrianRWagner
Audit how a brand appears in AI-powered search (ChatGPT, Perplexity, Claude, Gemini). Use when user mentions "AI search," "how do I show up in ChatGPT," "AI discoverability," "AEO," "LLM visibility," or wants to understand their brand's AI presence.
audit
by howells
Comprehensive codebase audit with specialized reviewers. Generates actionable reports. Use when asked to "audit the codebase", "review code quality", "check for issues", "security review", or "performance audit". Accepts path scope like "apps/web". Reviewers run in batches of 2 by default to avoid resource exhaustion. Use --parallel to run all reviewers simultaneously (resource-intensive). Use --diff to scope audit to files changed vs main branch (or specify base: --diff develop). Use --docs for a focused JSDoc/documentation coverage audit. Use --copy for a focused UX writing/copy quality audit.
defender-for-devops
by JosiahSiegel
Microsoft Defender for DevOps integration with Azure Pipelines (2025)
sast-semgrep
by AgentSecOps
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based detection, (3) Integrating SAST checks into CI/CD pipelines, (4) Providing remediation guidance with OWASP Top 10 and CWE mappings, (5) Creating custom security rules for organization-specific patterns, (6) Analyzing dependencies for known vulnerabilities.
accelint-ts-performance
by gohypergiant
"Systematic JavaScript/TypeScript performance audit and optimization using V8 profiling and runtime patterns. Use when (1) Users say 'optimize performance', 'audit performance', 'this is slow', 'reduce allocations', 'improve speed', 'check performance', (2) Analyzing code for performance anti-patterns (O(n²) complexity, excessive allocations, I/O blocking, template literal waste), (3) Optimizing functions regardless of current usage context - utilities, formatters, parsers are often called in hot paths even when they appear simple, (4) Fixing V8 deoptimization (monomorphic/polymorphic issues, inline caching). Audits ALL code for anti-patterns and reports findings with expected gains. Covers loops, caching, batching, memory locality, algorithmic complexity fixes with ❌/✅ patterns."
accelint-security-best-practices
by gohypergiant
"Comprehensive security audit and vulnerability detection for JavaScript/TypeScript applications following OWASP Top 10. Use when (1) Users say 'audit security', 'check for vulnerabilities', 'security review', 'implement authentication', 'secure this code', (2) Adding authentication, API endpoints, file uploads, or handling user input, (3) Working with secrets, credentials, or sensitive data, (4) Implementing payment features or blockchain integrations, (5) Conducting pre-deployment security checks. Audits for: hardcoded secrets, injection vulnerabilities, XSS/CSRF, broken access control, insecure authentication, rate limiting, dependency vulnerabilities, sensitive data exposure."
rails-audit-thoughtbot
by thoughtbot
Perform comprehensive code audits of Ruby on Rails applications based on thoughtbot best practices. Use this skill when the user requests a code audit, code review, quality assessment, or analysis of a Rails application. The skill analyzes the entire codebase focusing on testing practices (RSpec), security vulnerabilities, code design (skinny controllers, domain models, PORO with ActiveModel), Rails conventions, database optimization, and Ruby best practices. Outputs a detailed markdown audit report grouped by category (Testing, Security, Models, Controllers, Code Design, Views) with severity levels (Critical, High, Medium, Low) within each category.
solo-audit
by fortunto2
Health check knowledge base for broken links, missing frontmatter, tag inconsistencies, and coverage gaps. Use when user says "audit KB", "check frontmatter", "find broken links", "tag cleanup", or "knowledge base quality". Do NOT use for SEO audits (use /seo-audit) or code reviews.
ai-code-review
by sundial-org
Top OpenClaw skills, with the most popular and useful ones.