Security
Security scanning and vulnerability detection
Feature Development Complete
by DNYoussef
Context Cascade - Nested Plugin Architecture for Claude Code Official Claude Code Plugin Version 3.1.0 Last updated: 2026-01-09 (see docs/COMPONENT-COUNTS.json for source counts) Context-saving nested architecture: Playbooks -> Skills -> Agents -> Commands. Load only what you need, saving 90%+ context space.
code-quality-audit
by camoa
Use when checking code quality, running security audits, testing coverage, finding violations, or setting up quality tools - supports Drupal (PHPStan, PHPMD, PHPCPD, Psalm, Semgrep, Trivy, Gitleaks via DDEV) and Next.js (ESLint, Jest, jscpd, madge, Semgrep, Trivy, Gitleaks) projects with TDD, SOLID, DRY, and OWASP security checks
code-pattern-checker
by camoa
Use before committing code - validates Drupal coding standards, SOLID/DRY principles, security practices, and CSS standards
security-auditor
by zhaono1
Security vulnerability expert covering OWASP Top 10 and common security issues. Use when conducting security audits or reviewing code for vulnerabilities.
blogwatcher
by EthanAlgoX
Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.
nestjs
by claude-dev-suite
NestJS enterprise Node.js framework. Covers modules, controllers, services, guards, and dependency injection. Use when building scalable Node.js applications. USE WHEN: user mentions "NestJS", "nest", "@nestjs", "@Module", "@Controller", "@Injectable", asks about "dependency injection in Node.js", "enterprise Node.js framework", "TypeScript backend framework", "decorators in backend", "guards and pipes", "modular Node.js architecture" DO NOT USE FOR: Express (minimalist framework) - use express instead, Fastify (performance-focused) - use fastify instead, Hono (edge runtimes) - use hono instead, Deno frameworks - use oak or fresh instead
library-design-patterns
by akaszubski
Standardized library design patterns for autonomous-dev including two-tier design, progressive enhancement, non-blocking enhancements, and security-first architecture. Use when creating or refactoring Python libraries.
security-patterns
by akaszubski
Security best practices, API key management, input validation. Use when handling secrets, user input, or security-sensitive code.
code-review
by akaszubski
Enforcement skill for consistent, thorough code reviews
code-reviewer
by nguyenthienthanh
"Comprehensive code review with multi-agent analysis. Checks security, performance, maintainability, tests."
compliance-audit
by NickCrew
Regulatory compliance auditing across GDPR, HIPAA, PCI DSS, SOC 2, and ISO frameworks with automated evidence collection and gap analysis. Use when conducting compliance assessments, preparing for certifications, or implementing regulatory controls.
accessibility-audit
by NickCrew
Fast, high-signal accessibility triage for pages, components, or PRs targeting WCAG 2.2 AA compliance.
django-expert
by vintasoftware
Expert Django backend development guidance. Use when creating Django models, views, serializers, or APIs; debugging ORM queries or migrations; optimizing database performance; implementing authentication; writing tests; or working with Django REST Framework. Follows Django best practices and modern patterns.
webapp-nikto
by AgentSecOps
Web server vulnerability scanner for identifying security issues, misconfigurations, and outdated software versions. Use when: (1) Conducting authorized web server security assessments, (2) Identifying common web vulnerabilities and misconfigurations, (3) Detecting outdated server software and known vulnerabilities, (4) Performing compliance scans for web server hardening, (5) Enumerating web server information and enabled features, (6) Validating security controls and patch levels.
Technology Assessment
by zircote
This skill should be used when the user asks to "assess technology", "technology evaluation", "tech stack analysis", "technical feasibility", "technology trends", "build vs buy", "technology roadmap", "architecture assessment", or needs guidance on evaluating technologies, technical due diligence, or technology strategy decisions.
hld-reviewer
by TestAny-io
HLD review, High-Level Design review, 技术方案评审。Use when: HLD 完成后、进入 LLD/实现前需要审查技术设计、检测 PRD→HLD 漂移。
event-driven-detector
by Geeksfino
Identify and analyze corporate events that create mispricing opportunities, including M&A, spinoffs, buybacks, restructurings, and index changes. Use when the user asks about merger arbitrage, spinoff opportunities, share buyback analysis, corporate restructuring plays, index rebalancing trades, special situations investing, or event-driven strategies.
Gemini CLI
by blacktop
Consult Google Gemini CLI for second opinions on architecture, debugging, and security audits. Use Gemini's 1M+ context window for comprehensive code analysis. Compare Flash (fast) vs Pro (thorough). Use when: need second opinion on architectural decisions, stuck debugging after 2+ attempts, writing security- sensitive code, planning refactors (5+ files), approaching 70%+ context capacity, unfamiliar with tech stack, need peer review, or want Flash vs Pro comparison. Keywords: gemini-cli, google gemini, gemini command line, second opinion, model comparison, gemini-3-flash-preview, gemini-3-pro-preview, architectural decisions, debugging assistant, code review gemini, security audit gemini, 1M context window, AI pair programming, gemini consultation, flash vs pro, AI-to-AI prompting, peer review, codebase analysis, gemini CLI tool, shell gemini, command line AI assistant, gemini architecture advice, gemini debug help, gemini security scan, gemini code compare
aws-infrastructure
by shipshitdev
Expert in AWS infrastructure setup including EC2, VPC, security groups, Application Load Balancers, Route53 DNS, and SSL/TLS certificates. Use this skill for AWS infrastructure configuration and deployment.
cto-advisor
by shipshitdev
Technical leadership guidance for engineering teams, architecture decisions, and technology strategy. Includes tech debt analyzer, team scaling calculator, engineering metrics frameworks, technology evaluation tools, and ADR templates. Use when assessing technical debt, scaling engineering teams, evaluating technologies, making architecture decisions, establishing engineering metrics, or when user mentions CTO, tech debt, technical debt, team scaling, architecture decisions, technology evaluation, engineering metrics, DORA metrics, or technology strategy.
code-audit
by 3stoneBrother
Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning, penetration testing preparation, or code review for security issues. Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust. Includes 143 mandatory detection items across all languages with language-specific checklists. Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection, authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android). WooYun integration adds: statistical-driven parameter priority, bypass techniques library, logic vulnerability patterns, and real-case references. v1.0: Initial public release with Docker deployment verification framework.
red-team
by geekatron
"Offensive security team skill providing methodology guidance for penetration testing and red team engagements. Invoked when users request penetration testing, reconnaissance, vulnerability analysis, exploitation methodology, social engineering, C2 infrastructure, or engagement reporting. Routes to 11 specialized agents covering the full MITRE ATT&CK kill chain. All engagements require red-lead scope authorization before any other agent. Follows PTES, OSSTMM, and ATT&CK methodology frameworks."
eng-team
by geekatron
"Secure engineering team skill providing methodology guidance for building security-hardened software. Invoked when users request system design, implementation, code review, testing, CI/CD security, or incident response with security considerations. Routes to 10 specialized agents covering architecture through post-deployment. Integrates NIST SSDF governance, Microsoft SDL phases, OWASP ASVS verification, SLSA supply chain integrity, and DevSecOps automation patterns."
secure-coding
by baz-scm
Incorporating security at every step of software development – writing code that defends against vulnerabilities and protects user data.