Security
Security scanning and vulnerability detection
pdf-look-scanned
by vladmdgolam
Make PDF documents look like they were scanned on a physical scanner. Applies realistic effects: grayscale conversion, Gaussian noise, slight rotation, blur, edge shadows, and random offset. Optionally extract real handwritten signatures from a source PDF (or user-provided images) and replace digital signatures on specific pages. Use when the user asks to: make a PDF look scanned, give a PDF a scanned appearance, replace digital signatures with real/handwritten ones, fake a scan, add scan effects to a document, or make a document look printed and scanned.
insecure-defaults
by lv416e
"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling."
sensitive-content-scanner
by dazuck
Scan files for sensitive content before sharing. Detects personal info, credentials, private URLs, local paths, and security risks. Use before publishing repos, sharing code, or exporting configs.
code-review
by DanielKerridge
Deep code audit that finds dead wiring, silent failures, unfinished features, placeholder stubs, bloated files, and unnecessary complexity. Produces an actionable report with file:line references grouped by severity. Think of it as a senior dev doing a thorough PR review of the entire codebase. Triggers on: "code review", "audit the code", "review the code", "find dead code", "find placeholders", "check for stubs", "prune the code", "code cleanup", "implementation review", "completeness check", "find unused code".
personalize-skills
by dazuck
Customize Operator Skills for your environment. Use when first installing skills or when you want to update your personal values.
nginx
by fellipeutaka
Nginx web server and reverse proxy expert: configuration, reverse proxying, load balancing, SSL/TLS termination, rate limiting, caching, gzip compression, WebSocket proxying, and security hardening. Use for nginx.conf creation/review, performance tuning, HTTPS setup, upstream configuration, and troubleshooting.
defectdojo
by julianobarbosa
Guide for implementing DefectDojo - an open-source DevSecOps, ASPM, and vulnerability management platform. Use when querying vulnerabilities, managing findings, configuring CI/CD pipeline imports, or working with security scan data. Includes MCP tools for direct API interaction.
code-reviewer
by nahisaho
Copilot agent that assists with comprehensive code review focusing on code quality, SOLID principles, security, performance, and best practices Trigger terms: code review, review code, code quality, best practices, SOLID principles, code smells, refactoring suggestions, code analysis, static analysis Use when: User requests involve code reviewer tasks.
image-security-scanner
by armanzeroeight
Scans Docker images for security vulnerabilities, outdated packages, and misconfigurations. Use when checking image security, finding vulnerabilities, or hardening containers.
security-auditor
by nahisaho
security-auditor skill Trigger terms: security audit, vulnerability scan, OWASP, security analysis, penetration testing, security review, threat modeling, security best practices, CVE Use when: User requests involve security auditor tasks.
security-group-analyzer
by armanzeroeight
Audit AWS security groups for overly permissive rules and security vulnerabilities. Use when reviewing AWS security, auditing security groups, or improving network security posture.
design-reviewer
by nahisaho
Copilot agent that assists with systematic design review using ATAM (Architecture Tradeoff Analysis Method), SOLID principles, design patterns, coupling/cohesion analysis, error handling, and security requirements Trigger terms: design review, architecture review, ATAM, SOLID principles, design patterns, coupling, cohesion, ADR review, C4 review, architecture analysis, design quality Use when: User requests involve design document review, architecture evaluation, or design quality assessment tasks.
ssl-helper
by armanzeroeight
Configures SSL/TLS certificates, implements secure protocols and ciphers, and sets up security headers. Use when setting up HTTPS, SSL certificates, TLS configuration, or web security hardening.
iso-17025-de
by cleverlab-ai
"Fachberater für DIN EN ISO/IEC 17025:2018 — die internationale Norm für die Kompetenz von Prüf- und Kalibrierlaboratorien. Verwenden Sie diesen Skill wenn: (1) Vorbereitung auf Akkreditierungs- oder Überwachungsaudits der DAkkS, (2) Aufbau oder Überprüfung von Qualitätsmanagementsystemen für Laboratorien, (3) Erstellung von Verfahren, Richtlinien oder Arbeitsanweisungen gemäß 17025, (4) Erstellung von Audit-Checklisten oder Gap-Analysen, (5) Beantwortung von Fragen zu Laboranforderungen (Unparteilichkeit, Vertraulichkeit, Struktur, Ressourcen, Prozesse, Management), (6) Entwurf von LIMS-Systemen oder Laborsoftware, die 17025-konform sein muss, (7) Bewertung von Methodenvalidierung, Messunsicherheit, metrologischer Rückverfolgbarkeit, (8) Umgang mit fehlerhafter Arbeit, Beschwerden, Korrekturmaßnahmen, (9) Vorbereitung von Managementbewertungen oder internen Audits. Deutsche Version (DE)."
plan
by Terryc21
Epic decomposition into trackable, right-sized tasks. Audit-aware mode ingests codebase-audit/tech-reportcard reports. Standalone mode plans features, bugs, and refactors from scratch.
audit
by chaterm
安全审计
workflow-audit
by Terryc21
'Systematic UI workflow auditing for SwiftUI applications. Discovers entry points, traces user flows, detects dead ends and broken promises, audits data wiring, evaluates from user perspective. Triggers: "workflow audit", "audit flows", "find dead ends", "check navigation".'
security-audit
by Terryc21
'Automated security vulnerability scan for iOS/macOS apps. Covers secrets, storage, network, input validation, privacy manifest, and file protection. Triggers: "security audit", "check for secrets", "security scan".'
delegation-framework
by mfwarren
Production-ready entrepreneurship skills for Claude Code — marketing, sales, operations, finance, and leadership. 24 skills built by a founder, for founders.
sast-semgrep
by rohunj
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based detection, (3) Integrating SAST checks into CI/CD pipelines, (4) Providing remediation guidance with OWASP Top 10 and CWE mappings, (5) Creating custom security rules for organization-specific patterns, (6) Analyzing dependencies for known vulnerabilities.
sca-trivy
by rohunj
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.
security-engineering
by mujez
Application security and infrastructure security expert. Use when reviewing code for vulnerabilities, implementing authentication/authorization, securing APIs, hardening infrastructure, threat modeling, implementing encryption, or conducting security audits. Covers OWASP Top 10, secure coding, DevSecOps, and compliance.
agent-team-review
by damianpapadopoulos
Multi-perspective parallel code review with specialist reviewers for security, quality, and spec compliance.
adversarial-code-review
by third774
Review code through hostile perspectives to find bugs, security issues, and unintended consequences the author missed. Use when reviewing PRs, auditing codebases, or before critical deployments.