Security
Security scanning and vulnerability detection
reviewing-design-docs
by axiomantic
"Use when reviewing design documents, technical specifications, architecture docs, RFCs, ADRs, or API designs for completeness and implementability. Triggers: 'review this design', 'is this spec complete', 'can someone implement from this', 'what's missing from this design', 'review this RFC', 'is this ready for implementation', 'audit this spec'. Core question: could an implementer code against this without guessing?"
plugin-dev
by rube-de
"Validate plugin SKILL.md frontmatter and audit hook scripts for silent failures. Run validation to check all plugins pass schema, source path, and frontmatter checks. Run hook audit to detect unhandled errors in shell and Python scripts."
security
by rube-de
Security scan: dependency audits, SAST analysis, and secret detection. Detects project type, runs available security tools, classifies findings by severity, and creates a structured GitHub issue.
tarot-mode
by axiomantic
"Use when session returns mode.type='tarot', user says '/tarot', or requests roundtable dialogue with archetypes. Ten tarot archetypes (Magician, Priestess, Hermit, Fool, Chariot, Justice, Lovers, Hierophant, Emperor, Queen) collaborate via visible roundtable with instruction-engineering embedded."
nats-design-subject
by TrogonStack
Design NATS subject hierarchies for messaging patterns (pub/sub, request/reply, streaming). Apply naming conventions, segmentation strategies, and wildcard patterns to create scalable subject architectures. Use when designing NATS messaging systems, planning multi-tenant communication, or auditing existing subject hierarchies. Do not use for: (1) NATS server configuration or cluster setup, (2) client library implementation or connection code, (3) debugging connectivity or performance issues, (4) choosing between NATS and other messaging systems.
gathering-requirements
by axiomantic
"Use when eliciting or clarifying feature requirements, defining scope, identifying constraints, or capturing user needs. Triggers: 'what are the requirements', 'define the requirements', 'scope this feature', 'user stories', 'acceptance criteria', 'what should this do', 'what problem are we solving', 'what are the constraints'. Also invoked by implementing-features during DISCOVER stage and by the Forged workflow."
security-auditing
by axiomantic
"Use when auditing skills, commands, hooks, and MCP tools for security vulnerabilities. Triggers: 'security audit', 'scan for vulnerabilities', 'check security', 'audit skills', 'audit MCP tools'. Integrates with code-review --audit, implementing-features Phase 4, and distilling-prs for PR security review."
dlc
by rube-de
Dev Life Cycle quality gates: run security scans, code quality checks, performance analysis, test coverage, and PR review compliance. Routes to domain-specific sub-skills or runs all checks in sequence.
update
by rube-de
Audit open GitHub issues for staleness, orphaned blockers, missing labels, codebase drift, and already-implemented features. Categorizes issues into close-candidates, update-needed, needs-triage, stale, and healthy. Supports bulk and individual remediation via interactive approval. Triggers: audit issues, clean up issues, update stale issues, issue hygiene, backlog cleanup, prune issues.
cloud-infrastructure
by maroffo
"AWS/GCP cloud infrastructure: Well-Architected, security, cost, observability. Use when working with Terraform outputs, IAM policies, VPC design, load balancers, or cloud architecture decisions."
workflow-preflight
by charlesjones-dev
"Run code quality checks (typecheck, lint, tests) - auto-detects configured tools and offers to fix issues."
security-audit
by charlesjones-dev
"Comprehensive security audit to identify vulnerabilities, OWASP Top 10 issues, and security anti-patterns."
security-audit
by dirnbauer
Security audit patterns for PHP/OWASP. Use when conducting security assessments, identifying vulnerabilities (XXE, SQL injection, XSS), or CVSS scoring.
enterprise-readiness
by dirnbauer
Assess and enhance software projects for enterprise-grade security, quality, and automation. Aligned with OpenSSF Scorecard, SLSA, and S2C2F. Use when working with enterprise, openssf, slsa, security, scorecard, supply chain, badge.
odoo-security
by ahmed-lakosha
"Comprehensive Odoo security auditor for model access rules, HTTP route authentication, sudo() usage, SQL injection risks, and record rule completeness across Odoo 14-19."
git
by tao3k
Use when committing code, managing branches, pushing to remote, creating pull requests, or performing version control operations. Conforms to docs/reference/skill-routing-value-standard.md.
code-security-audit
by ssrsec
AI 驱动的生产级代码安全审计协议。面向企业内部授权审计，默认使用结构化 harness：项目画像、攻击面枚举、Sink/Control 双轨候选发现、验证队列、能力链、质量门、报告渲染和完整证据交付。支持 PHP、Java、C# / ASP.NET、Go、Python、JavaScript / TypeScript Node.js、Ruby、Rust、Kotlin、Deno/Bun，以及 JVM/.NET 编译产物反编译计划。用户说「开始审计 / 对 XXX 做安全审计 / 代码审计 / 安全扫描 / 找漏洞 / security audit / 红队审计」时触发。
Feature Development Complete
by DNYoussef
Context Cascade - Nested Plugin Architecture for Claude Code Official Claude Code Plugin Version 3.1.0 Last updated: 2026-01-09 (see docs/COMPONENT-COUNTS.json for source counts) Context-saving nested architecture: Playbooks -> Skills -> Agents -> Commands. Load only what you need, saving 90%+ context space.
nestjs-best-practices
by koolamusic
NestJS best practices and architecture patterns for building production-ready applications. This skill should be used when writing, reviewing, or refactoring NestJS code to ensure proper patterns for modules, dependency injection, security, and performance.
implementing-service-mesh
by ancoleman
Implement production-ready service mesh deployments with Istio, Linkerd, or Cilium. Configure mTLS, authorization policies, traffic routing, and progressive delivery patterns for secure, observable microservices. Use when setting up service-to-service communication, implementing zero-trust security, or enabling canary deployments.
operating-kubernetes
by ancoleman
Operating production Kubernetes clusters effectively with resource management, advanced scheduling, networking, storage, security hardening, and autoscaling. Use when deploying workloads to Kubernetes, configuring cluster resources, implementing security policies, or troubleshooting operational issues.
backend-development
by samhvw8
"Production backend systems development. Stack: Node.js/TypeScript, Python, Go, Rust NestJS, FastAPI, Django, Express PostgreSQL, MongoDB, Redis. Capabilities: REST/GraphQL/gRPC APIs, OAuth 2.1/JWT auth, OWASP security, microservices, caching, load balancing, Docker/K8s deployment. Actions: design, build, implement, secure, optimize, deploy, test APIs and services. Keywords: API design, REST, GraphQL, gRPC, authentication, OAuth, JWT, RBAC, database, PostgreSQL, MongoDB, Redis, caching, microservices, Docker, Kubernetes, CI/CD, OWASP, security, performance, scalability, NestJS, FastAPI, Express, middleware, rate limiting. Use when: designing APIs, implementing auth/authz, optimizing queries, building microservices, securing endpoints, deploying containers, setting up CI/CD."
near-contract-audit
by near
Comprehensive security audit skill for NEAR Protocol smart contracts written in Rust. Use when auditing NEAR contracts, reviewing security vulnerabilities, or analyzing contract code for issues like reentrancy, unhandled promises, unsafe math, access control flaws, and callback security.
brand-analyzer
by ailabs-393
This skill should be used when the user requests brand analysis, brand guidelines creation, brand audits, or establishing brand identity and consistency standards. It provides comprehensive frameworks for analyzing brand elements and creating actionable brand guidelines based on requirements.