Security
Security scanning and vulnerability detection
dlc
by rube-de
Dev Life Cycle quality gates: run security scans, code quality checks, performance analysis, test coverage, and PR review compliance. Routes to domain-specific sub-skills or runs all checks in sequence.
belai-patcher
by Vulnetix
Remediates one vulnerability finding on its own branch: finds the resolution path, picks the lowest fixed version, applies the narrowest per-ecosystem mechanism (lockfile update, parent bump, override, replacement, code fix), re-scans, and files an honest verdict. Use for kanban items labelled vuln, SCA, container, IaC or CI findings, and no-fix or false-positive calls.
update
by rube-de
Audit open GitHub issues for staleness, orphaned blockers, missing labels, codebase drift, and already-implemented features. Categorizes issues into close-candidates, update-needed, needs-triage, stale, and healthy. Supports bulk and individual remediation via interactive approval. Triggers: audit issues, clean up issues, update stale issues, issue hygiene, backlog cleanup, prune issues.
supabase-audit-rls
by yoanbernabeu
Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.
supabase-detect
by yoanbernabeu
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
supabase-audit-buckets-list
by yoanbernabeu
List all storage buckets and their configuration to identify the storage attack surface.
supabase-pentest
by yoanbernabeu
Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.
supabase-help
by yoanbernabeu
Quick reference for all Supabase security audit skills with usage examples and command overview.
supabase-report
by yoanbernabeu
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
supabase-audit-tables-read
by yoanbernabeu
Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.
supabase-audit-rpc
by yoanbernabeu
List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.
supabase-audit-functions
by yoanbernabeu
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
supabase-extract-anon-key
by yoanbernabeu
Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.
bug-reaper
by shaniidev
"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth bypass, RCE, SSTI, LFI, XXE, CORS, CSRF, prototype pollution, subdomain takeover, HTTP smuggling, open redirect, API/GraphQL bugs; auditing locally downloaded GitHub repos or source code (white-box/source code review); writing platform-specific reports. Trigger on: 'pentest', 'find bugs', 'security audit', 'bug bounty', 'find vulnerabilities', 'source code review', 'audit this repo', 'review repo', 'white-box', 'local repo', vulnerability class names, or program/target names. Reports only real, confirmed medium+ severity bugs that pass real triage."
near-contract-audit
by near
Comprehensive security audit skill for NEAR Protocol smart contracts written in Rust. Use when auditing NEAR contracts, reviewing security vulnerabilities, or analyzing contract code for issues like reentrancy, unhandled promises, unsafe math, access control flaws, and callback security.
backend-dev
by julianromli
Comprehensive backend development workflow that orchestrates expert analysis, architecture design, implementation, and deployment using the integrated toolset. Handles everything from API design and database architecture to security implementation and DevOps automation.
vulnerability-exploitation
by Eitanvinokur12345
"Penetration testing, security research, malicious attacks."
audit-review
by KingInYellows
Run 1-3 parallel quick-audit passes (code quality, security, error handling) over a diff and gate on findings. Use when smart-submit or gt-amend need to audit uncommitted changes before committing.
audit-review
by KingInYellows
'Run 1-3 parallel quick-audit passes (code quality, security, error handling) over a diff and gate on findings. Use when smart-submit or gt-amend need to audit uncommitted changes before committing.'
corporate-network-attack-simulation
by Eitanvinokur12345
"Cybersecurity assessment, red teaming, vulnerability analysis"
technical-debt-manager-php-laravel
by LaravelDaily
Expert technical debt analyst for PHP/Laravel code health, maintainability, and strategic refactoring planning. Use PROACTIVELY when a Laravel codebase shows complexity growth, when planning sprints, or when prioritizing engineering work.
typo3-security
by dirnbauer
Security hardening checklist and best practices for TYPO3 v13/v14 installations, covering configuration, file permissions, and common vulnerabilities. Use when working with security, hardening, permissions, authentication, vulnerabilities.
appsec-expert
by martinholovsky
"Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments."
Encryption Skill
by martinholovsky
Encryption done wrong is worse than no encryption - it provides false confidence.