Security
Security scanning and vulnerability detection
owasp-top-10
by NickCrew
OWASP Top 10 security vulnerabilities with detection and remediation patterns. Use when conducting security audits, implementing secure coding practices, or reviewing code for common security vulnerabilities.
kubernetes-security-policies
by NickCrew
Kubernetes security policies, RBAC, and Pod Security Standards for hardened cluster deployments. Use when implementing cluster security, defining network policies, or enforcing security compliance in Kubernetes environments.
accessibility-audit
by NickCrew
Fast, high-signal accessibility triage for pages, components, or PRs targeting WCAG 2.2 AA compliance.
constructive-dissent
by NickCrew
Structured disagreement protocols to strengthen proposals through systematic challenge and alternative generation.
Canon
by simota
ä¸çæ¨æºã»æ¥çæ¨æºã§ç©äºã解決ãã調æ»ã»åæã¨ã¼ã¸ã§ã³ããOWASP/WCAG/OpenAPI/ISO 25010çã®æ¨æºã¸ã®æºæ 度è©ä¾¡ãæ¨æºéåæ¤åºãæ¹åææ¡ãæ å½ãæ¨æºæºæ è©ä¾¡ãè¦æ ¼é©ç¨ãå¿ è¦ãªæã«ä½¿ç¨ã
audit-ux
by doodledood
Audit UI/UX changes in a focus area against design guidelines for accessibility, consistency, and usability issues.
solidity-security
by scaffold-eth
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
analyze-repo
by miles990
Enterprise-grade repository analysis with arc42/C4 architecture documentation, technical debt quantification, security assessment, and multi-stakeholder reporting
security-practices
by miles990
OWASP Top 10, authentication, and secure coding practices
code-review-medium
by breaking-brake
Standard code review for medium PRs (100-500 lines). Includes code quality, security basics, and test coverage analysis.
review-security
by ssiumha
Reviews code for security vulnerabilities. Use when implementing auth, handling user input, adding APIs, or before deployment. Checks OWASP Top 10, credentials, injection.
threat-modeling
by bobmatnyc
"Threat modeling workflow for software systems: scope, data flow diagrams, STRIDE analysis, risk scoring, and turning mitigations into backlog and tests"
env-manager
by bobmatnyc
"Environment variable validation, security scanning, and management for Next.js, Vite, React, and Node.js applications"
sunday-review
by mycelium-hq
'Use when the user asks for the weekly meta-review or Sunday wrap-up of their week and vault: says /sunday, /sunday-review, ''let''s do the weekly review,'' ''Sunday review,'' ''review my week,'' ''weekly retro,'' ''week in review,'' ''end-of-week review,'' or wants journals, patterns, vault health, and stale decisions reviewed together at week''s end. Not for a journal-pattern read alone (use /weekly) or mid-week single checks.'
compliance-frameworks
by Logos-Liber
SOC 2 compliance requirements, ISO 27001 standards, PCI DSS requirements, HIPAA security rules, GDPR data protection, NIST Cybersecurity Framework, and industry-specific compliance requirements
secret-warn
by mycelium-hq
Use when adding or tuning edit-time secret and code-injection guardrails or security hooks in Claude Code, or on mentions of secret detection, API key safety, hardcoded or leaked keys (AWS, Stripe, GCP, OpenAI, Anthropic, GitHub, Slack, JWT, PEM, .env), gitleaks-style or pre-commit secret scanning, false positives or allowlists, unsafe pipe-to-shell or MCP server installs, or prompt injection in audited third-party content (README, AGENTS.md). Not for full security audits, pen testing, or DLP.
security-snapshot
by mycelium-hq
'Use when the user says /security-snapshot, /snapshot <domain>, "run a security check on X", "generate a security report for [company]", or wants a security hygiene snapshot or free lead-magnet report on a prospect''s public domain: SSL/TLS grade, HTTP security headers, SPF/DMARC email authentication, server fingerprint leaks. Passive, unauthenticated scans only. NOT for penetration testing, internal infrastructure audits, or application-layer vulnerability assessment.'
network-scan
by proficientlyjobs
Scan your LinkedIn contacts' companies for matching job openings
insecure-defaults
by lv416e
"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling."
kaizen:analyse-problem
by NeoLabHQ
Comprehensive A3 one-page problem analysis with root cause and action plan
reflexion:reflect
by NeoLabHQ
Reflect on previus response and output, based on Self-refinement framework for iterative improvement with complexity triage and verification
code-review:review-local-changes
by NeoLabHQ
Comprehensive review of local uncommitted changes using specialized agents with code improvement suggestions
android-apk-audit
by DragonJAR
Comprehensive Android APK security audit with static analysis, dynamic instrumentation, source-to-sink tracing, IPC/component abuse analysis, and CVSS 4.0 reporting. Covers decompilation, manifest analysis, deep links and intent injection, secrets detection, crypto analysis, Frida/Objection integration, and APK repackaging. Use when user says "audit APK", "analyze android app", "mobile pentest", "APK security", "decompile APK", "android vulnerability assessment", "reverse engineer android", "modify APK", "intent injection", "deep link abuse", "bypass SSL pinning", "bypass root detection", or provides an APK for security review, decompiled Android sources, or decoded resources.
data-quality
by JoelLewis
"Financial data quality management: golden source architecture, data lineage, validation rules, exception management, profiling, monitoring, and governance frameworks."