Security
Security scanning and vulnerability detection
learn
by florianbuetow
This skill should be used when the user asks to "learn about security", "teach me OWASP", "security tutorial", "learn threat modeling", or invokes /appsec:learn. Interactive guided walkthrough using your codebase as teaching material.
outdated-deps
by florianbuetow
This skill should be used when the user asks to "check for vulnerable dependencies", "audit dependencies", "find outdated packages", "scan for CVEs", "check for typosquatting", or mentions "vulnerable components", "outdated dependencies", or "supply chain" in a security context. Maps to OWASP Top 10 2021 A06: Vulnerable and Outdated Components.
fix
by florianbuetow
This skill should be used when the user asks to "fix security finding", "fix vulnerability", "generate security fix", "appsec fix", "patch vulnerability", "remediate finding", or "apply security patch". Also triggers when the user references a finding ID (e.g., INJ-001) and asks for a fix, or points to a file:line and asks to fix the security issue there.
integrity
by florianbuetow
This skill should be used when the user asks to "check for integrity issues", "analyze deserialization", "find supply chain vulnerabilities", "review CI/CD security", "check SRI", or mentions "deserialization", "integrity", "pipeline security", "code signing", or "supply chain" in a security context. Maps to OWASP Top 10 2021 A08: Software and Data Integrity Failures.
logging
by florianbuetow
This skill should be used when the user asks to "check for logging issues", "analyze security logging", "find missing audit logs", "check for log injection", "audit monitoring configuration", or mentions "logging", "audit trail", "log injection", "monitoring", or "alerting" in a security context. Maps to OWASP Top 10 2021 A09: Security Logging and Monitoring Failures.
repudiation
by florianbuetow
This skill should be used when the user asks to "check for repudiation", "analyze audit logging", "find logging gaps", or mentions "repudiation" or "non-repudiation" in a security context. Maps to STRIDE category R.
config
by florianbuetow
This skill should be used when the user asks to "configure security", "appsec settings", "security preferences", or invokes /appsec:config. Manages security tool preferences and thresholds.
business-logic
by florianbuetow
This skill should be used when the user asks to "check business logic security", "find logic flaws", "audit workflow security", "check for coupon abuse", "detect negative amount exploits", "analyze state machine security", or mentions "business logic", "workflow bypass", "negative amount", "coupon abuse", "self-referral", "state manipulation", or "time-based exploit" in a security context.
pasta-vulns
by florianbuetow
This skill should be used when the user asks to "analyze vulnerabilities", "find security weaknesses", "map CWEs", "run vulnerability analysis", or is running PASTA stage 5. Also triggers when the user asks about SAST, DAST, dependency scanning, or CWE mapping in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 5 of 7).
crypto
by florianbuetow
This skill should be used when the user asks to "check for cryptographic issues", "analyze encryption", "find weak hashing", "audit password storage", "check for hardcoded keys", or mentions "cryptography", "encryption", "hashing", "TLS", "certificates", or "random number generation" in a security context. Maps to OWASP Top 10 2021 A02: Cryptographic Failures.
audit-deps
by helderberto
Check dependencies for vulnerabilities. Use when user asks to "audit dependencies", "/audit-deps", "check for vulnerabilities", or wants to check dependency health.
insecure-design
by florianbuetow
This skill should be used when the user asks to "check for design flaws", "analyze security design", "find insecure design patterns", "review threat model", "check business logic security", "find missing security controls", or mentions "insecure design" in a security context. Maps to OWASP Top 10 2021 A04:2021 - Insecure Design.
auth
by florianbuetow
This skill should be used when the user asks to "check for authentication issues", "analyze auth", "find credential vulnerabilities", "review login security", "check session management", or mentions "authentication", "passwords", "MFA", "sessions", or "brute force" in a security context. Maps to OWASP Top 10 2021 A07: Identification and Authentication Failures.
report
by florianbuetow
This skill should be used when the user asks to "generate security report", "create appsec report", "export findings", "security summary", "findings report", "executive security summary", or "export to SARIF". Also triggers when the user wants a formatted overview of all security findings, remediation progress, scanner coverage, or needs to share security status with stakeholders.
github-actions
by el-feo
Create, evaluate, and optimize GitHub Actions workflows and custom actions. Use when building CI/CD pipelines, creating workflow files, developing custom actions, troubleshooting workflow failures, performing security analysis, optimizing performance, or reviewing GitHub Actions best practices. Covers Ruby/Rails, TypeScript/Node.js, Heroku and Fly.io deployments.
brakeman
by el-feo
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.
full-audit
by florianbuetow
This skill should be used when the user asks for a "full security audit", "exhaustive audit", "comprehensive security review", or invokes /appsec:full-audit. Launches every framework, every tool, and every red team agent, producing a dated report file.
code-assistant
by kriscard
"Development: Use when writing, debugging, or refactoring code. Orchestrates specialist agents (TypeScript, React, etc). NOT for architecture decisions."
access-control
by florianbuetow
This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDOR vulnerabilities", "audit CORS configuration", "check for privilege escalation", or mentions "access control", "authorization", "IDOR", "CORS", "JWT tampering", or "directory traversal" in a security context. Maps to OWASP Top 10 2021 A01: Broken Access Control.
misconfig
by florianbuetow
This skill should be used when the user asks to "check for misconfigurations", "analyze security headers", "find misconfigured settings", "check CORS policy", "find debug mode", "audit server configuration", or mentions "misconfiguration" in a security context. Maps to OWASP Top 10 2021 A05: Security Misconfiguration.
review-plan
by florianbuetow
This skill should be used when the user asks to "review plan for security", "check plan for security issues", "security review of implementation plan", "audit the plan for vulnerabilities", or "check my plan before coding". Also triggers when the user mentions security in the context of an implementation plan, architecture proposal, or design document before code has been written. This is the FLAGSHIP pre-code security skill -- no other tool reviews plans at design time.
skillshare
by jasonraimondi
Syncs skills across AI CLI tools from a single source of truth. Global (~/.config/skillshare/) or project (.skillshare/) mode. Install from any Git host. Use when: "skillshare" CLI, skill management, or troubleshooting.
frontend-react-doctor
by jasonraimondi
Run after making React changes to catch issues early. Use when reviewing code, finishing a feature, or fixing bugs in a React project.
meta-skillshare
by jasonraimondi
Syncs skills across AI CLI tools (Claude, Cursor, Windsurf, etc.) from a single source of truth. Global mode (~/.config/skillshare/) and project mode (.skillshare/ per-repo). Commands: status, sync, install, uninstall, update, check, search, new, collect, push, pull, diff, list, doctor, audit, init-rules, trash, log, backup, restore, target, ui, upgrade. Features: target-level skill filtering (include/exclude), skill-level targets field, XDG Base Directory support, fuzzy subdirectory resolution for monorepo installs, .skillignore for repo-level skill filtering, --exclude flag, license display, multi-skill and group uninstall (--group/-G), declarative skill manifest (global + project), group field for organized placement, 49+ supported targets. Use when: managing skills across AI tools, "skillshare" CLI, skill sync/install/search, project skills setup, target filtering, security audit, web dashboard, or troubleshooting.