Security
Security scanning and vulnerability detection
regula
by kuzivaai
AI governance risk indication for Claude Code. Detects patterns that correlate with EU AI Act risk tiers, blocks prohibited practices, logs to hash-chained audit trail. Triggers on: AI/ML libraries, model files, LLM API calls, biometric processing, automated decisions. Also when the user mentions compliance, governance, AI Act, risk assessment, or audit.
sonarcloud-analysis
by harshanandak
Pull issues, metrics, quality gates, and analysis data from SonarCloud. Use when checking code quality, security vulnerabilities, test coverage, technical debt, or CI/CD quality gates.
astro-security
by Soborbo
Security patterns for Astro lead generation websites on Cloudflare. Forms, headers, bot protection, GDPR. Use for any production lead gen site.
supabase-report-compare
by yoanbernabeu
Compare two security audit reports to track remediation progress and identify new vulnerabilities.
supabase-pentest
by yoanbernabeu
Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.
supabase-report
by yoanbernabeu
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
supabase-audit-functions
by yoanbernabeu
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
vulnerability-scan
by ymd38
Run an offensive security audit (OWASP-based) using Semgrep and produce a read-only vulnerability report. Use before committing code to detect Broken Access Control, Injection (SQL/NoSQL/OS/Template), Frontend Security issues (XSS/CSP/HSTS), SSRF, and hardcoded secrets or PII exposure. Triggers on requests like "security scan", "vulnerability check", "audit security", "find vulnerabilities", "/vulnerability-scan", or when asked for an offensive security review of the codebase. Does NOT modify any code — read-only inspection only.
Project Scanner Workflow
by KhaiHuynhVN
production-ready
by adamos486
Use when preparing any project for production deployment, performing security audits, or release preparation. Triggers on "make production ready", "security audit", "prepare for release", "hardening", "pre-deployment checklist".
security
by Tyler-R-Kendrick
Use when addressing cross-cutting security concerns that apply to all languages, frameworks, and platforms. Covers OWASP standards, threat modeling, authentication, cryptography, supply chain security, and AI security. USE FOR: application security strategy, security architecture, choosing security controls, OWASP compliance, security tool selection, secure development lifecycle DO NOT USE FOR: specific language security implementations (use language-specific skills), infrastructure hardening (use iac skills), network security appliance configuration
supabase-audit-authenticated
by yoanbernabeu
Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.
supabase-audit-realtime
by yoanbernabeu
Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.
ideaverse-maintenance
by mrfelton
Keep Ideaverse vaults healthy through audits, diagnostics, and maintenance workflows. Use when running vault diagnostics, detecting link rot, identifying orphan notes, finding MOC bloat, suggesting archival candidates, validating frontmatter, or generating vault health reports. Triggers on requests like "audit my vault", "find broken links", "check vault health", "what needs archiving", "find orphan notes", or "run maintenance".
solidity-security
by 0xlayerghost
"[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers private key handling, access control, reentrancy prevention, gas safety, and pre-audit checklists. Trigger: any task involving creating, editing, or reviewing .sol source files."
smart-contract-audit
by greatpie
Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology. Use when asked to audit a smart contract repo from a URL or local path, auto-prepare the environment, find high-severity loss-of-funds vulnerabilities, validate exploitability, propose safe fixes, and deliver a structured report with exact code references.
Python Backend Architecture Review
by rknall
"Comprehensive design architecture review for Python backend applications. Use this skill when users ask you to review, analyze, or provide feedback on backend architecture designs, system design documents, or Python application architecture. Covers scalability, security, performance, database design, API design, microservices patterns, deployment architecture, and best practices."
security
by kcns008
Security Agent (Shield) — handles Pod Security Standards, RBAC audits, NetworkPolicy enforcement, secrets management (Vault), image scanning (Trivy), policy enforcement (Kyverno/OPA), CIS benchmarks, and compliance for Kubernetes and OpenShift clusters.
Security Specialist
by udapy
Auditing for unsafe code and secrets.
artifacts
by kcns008
Artifact Agent (Cache) — handles container registry management, artifact promotion between environments, vulnerability scanning (Trivy/Grype), SBOM generation (Syft), image signing (Cosign), retention policies, and CI/CD integration for Kubernetes and OpenShift supply chain security.
frontend-design-fix
by matteocervelli
Fix generic frontend designs by applying aesthetic upgrades across the 5 design dimensions
Agent Router
by udapy
Analyzing user intent and delegating tasks.
supabase-detect
by yoanbernabeu
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
supabase-audit-buckets-list
by yoanbernabeu
List all storage buckets and their configuration to identify the storage attack surface.