Security
Security scanning and vulnerability detection
doctor
by ScarXparth
Audits any project for security, test coverage, and Claude Code automation. 46 checks across 6 layers: secrets, CLAUDE.md, hooks, skills, agents, rules, MCP, CI, memory. Adaptive scoring — auto-detects project maturity (Starter/Growing/Mature/Pro). Diagnoses gaps, prescribes project-specific fixes, applies them. Usage: /doctor — full audit (all 6 layers) /doctor quick — TOP-3 priorities + score (30 seconds) /doctor scan — diagnose only (no changes) /doctor fix — prescribe + apply fixes /doctor layer <N> — audit specific layer (0-5) /doctor verify — health check Triggers: "/doctor", "audit", "setup automation", "configure Claude Code", "project health", "what's missing", "security check", "аудит", "проверь проект"
iosdev-cn
by kuangre123
通用 iOS App 开发、构建、签名、测试与 App Store 上架流程（中国区）指南。用于当用户询问 iOS 开发/上架/审核/签名/TestFlight/App Store Connect/隐私合规/订阅配置，或输入触发词 iosdev 时。
iso-17025
by cleverlab-ai
"Expert consultant for ISO/IEC 17025:2017 — the international standard for testing and calibration laboratory competence. Use when: (1) preparing for accreditation or surveillance audits, (2) building or reviewing quality management systems for laboratories, (3) writing procedures, policies or work instructions aligned with 17025, (4) generating audit checklists or gap analyses, (5) answering questions about laboratory requirements (impartiality, confidentiality, structure, resources, processes, management), (6) designing LIMS systems or laboratory software that must comply with 17025, (7) evaluating method validation, measurement uncertainty, metrological traceability, (8) handling nonconforming work, complaints, corrective actions, (9) preparing management reviews or internal audits. Supports both Polish (PL) and English (EN) languages."
code-review
by Montimage
Perform code reviews following best practices from Code Smells and The Pragmatic Programmer. Use when asked to "review this code", "check for code smells", "review my PR", "audit the codebase", or need quality feedback on code changes. Supports both full codebase audits and focused PR/diff reviews. Outputs structured markdown reports grouped by severity.
find-your-margin
by cdeistopened
Help a knowledge worker find where their attention earns the fattest margin when combined with AI. Maps their skill stack against AI capabilities to identify high-surplus opportunities vs. commodity traps. Use when someone asks where to focus their AI efforts, how to avoid the allocation economy race-to-zero, or how to build a defensible position as an individual operator.
attack-tree-construction
by xfstudio
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
iso-17025-pl
by cleverlab-ai
"Ekspert-konsultant ISO/IEC 17025:2017 — międzynarodowa norma dotycząca kompetencji laboratoriów badawczych i wzorcujących. Używaj gdy: (1) przygotowujesz się do audytu akredytacyjnego lub nadzoru PCA, (2) budujesz lub przeglądasz system zarządzania jakością w laboratorium, (3) piszesz procedury, polityki lub instrukcje zgodne z 17025, (4) tworzysz checklisty audytowe lub analizy luk, (5) odpowiadasz na pytania o wymagania laboratoryjne (bezstronność, poufność, struktura, zasoby, procesy, zarządzanie), (6) projektujesz systemy LIMS lub oprogramowanie laboratoryjne zgodne z 17025, (7) oceniasz walidację metod, niepewność pomiaru, spójność pomiarową, (8) obsługujesz pracę niezgodną z wymaganiami, skargi, działania korygujące, (9) przygotowujesz przeglądy zarządzania lub audyty wewnętrzne. Wersja polska (PL)."
skill-auditor
by Montimage
Analyze agent skills for security risks, malicious patterns, and potential dangers before installation. Use when asked to "audit a skill", "check if a skill is safe", "analyze skill security", "review skill risk", "should I install this skill", "is this skill safe", or when evaluating any skill directory for trust and safety. Also triggers when the user pastes a skill install command like "npx skills add https://github.com/org/repo --skill name". Produces a comprehensive security report with a clear install/reject verdict.
open-source-best-practices
by AndreaGriffiths11
Complete framework for preparing GitHub projects for sustainable open source release. Covers security scanning with Git History Cleaner, legal foundations, governance, contributor onboarding, maintainer expectations, and GitHub Sponsors setup. Use when launching a project publicly, preparing a private repo for open source, or hardening an existing public repo for long-term maintenance.
skill-issue
by krispuckett
"Audit and review all installed agent skills. Run on-demand or via cron to get a health report: skill inventory, usage tracking, version checks, dependency health, and actionable recommendations (keep, update, review, remove). Use when asked to review skills, check for skill updates, find unused skills, or audit the skill ecosystem."
springboot-security
by Ashfaqbs
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
code-security-review
by DauQuangThanh
Conducts comprehensive security code reviews including vulnerability detection (OWASP Top 10, CWE), authentication/authorization flaws, injection attacks, cryptography issues, sensitive data exposure, API security, dependency vulnerabilities, security misconfigurations, and compliance validation (PCI-DSS, GDPR, HIPAA). Produces detailed security assessment reports with CVE references, CVSS scores, exploit scenarios, and remediation guidance. Use when reviewing code security, performing security audits, checking for vulnerabilities, validating security controls, assessing security risks, or when users mention "security review", "vulnerability scan", "security audit", "penetration test", "OWASP", "security assessment", "secure coding", or "security compliance".
aws-cloud
by DauQuangThanh
Provides comprehensive AWS (Amazon Web Services) guidance including EC2, S3, RDS, Lambda, ECS/EKS, CloudFormation, API Gateway, CloudFront, cloud migration from on-premise/GCP/Azure, security configuration (IAM, KMS, Security Hub), cost optimization (Savings Plans, Reserved Instances), and multi-region deployment. Produces infrastructure as code (Terraform/CloudFormation/CDK), deployment scripts, security configurations, and architecture designs. Use when deploying to AWS, designing AWS infrastructure, migrating to AWS, configuring EC2 instances, setting up S3 buckets, managing RDS databases, deploying containers on ECS/EKS, building serverless applications, or when users mention AWS, Amazon Cloud, EC2, S3, Lambda, EKS, CloudFormation, CDK, or AWS services.
oracle-cloud
by DauQuangThanh
Provides comprehensive Oracle Cloud Infrastructure (OCI) guidance including compute instances, networking (VCN, load balancers, VPN), storage (block, object, file), database services (Autonomous Database, MySQL, NoSQL), container orchestration (OKE), identity and access management (IAM), resource management, cost optimization, and infrastructure as code (Terraform OCI provider, Resource Manager). Produces infrastructure code, deployment scripts, configuration guides, and architectural diagrams. Use when designing OCI architecture, provisioning cloud resources, migrating to Oracle Cloud, implementing OCI security, setting up OCI databases, deploying containerized applications on OKE, managing OCI resources, or when users mention "Oracle Cloud", "OCI", "Autonomous Database", "VCN", "OKE", "OCI Terraform", "Resource Manager", "Oracle Cloud Infrastructure", or "OCI migration".
azure-cloud
by DauQuangThanh
Provides comprehensive Microsoft Azure guidance including Azure Virtual Machines, Azure Storage (Blob, Files, Disks), Azure SQL Database, Azure App Service, Azure Functions, AKS (Azure Kubernetes Service), Azure DevOps, ARM templates, Bicep, Terraform for Azure, Azure Active Directory, Azure Key Vault, Azure Monitor, cost optimization, and multi-region deployment. Produces infrastructure as code (Terraform/Bicep/ARM), deployment scripts, security configurations, and architecture designs. Use when deploying to Azure, designing Azure infrastructure, migrating to Microsoft Azure, configuring VMs, setting up Azure Storage, managing Azure SQL, working with AKS, or when users mention Azure, Microsoft Cloud, Azure Portal, ARM templates, Bicep, Azure Functions, App Service, or Azure DevOps.
ibm-cloud
by DauQuangThanh
Provides comprehensive IBM Cloud platform guidance including compute services (VPC, Virtual Servers, IKS, OpenShift, Code Engine, Cloud Functions), storage (Object Storage, Block Storage, File Storage), databases (Db2, Cloudant, PostgreSQL, MySQL, MongoDB, Redis), IAM security (access groups, service IDs, Key Protect, Secrets Manager), networking (VPC, load balancers, Direct Link), CLI automation, Terraform/Schematics infrastructure as code, monitoring, and cost optimization. Covers infrastructure provisioning, application deployment, security configuration, multi-zone high availability, and operational best practices. Use when working with IBM Cloud services, deploying cloud infrastructure, managing cloud resources, configuring security and networking, or when users mention "IBM Cloud", "IKS", "Code Engine", "Db2", "Cloudant", "VPC", "cloud provisioning", "IBM Kubernetes", "OpenShift", "Terraform IBM", "Schematics", or "IBM cloud platform".
keycloak-administration
by DauQuangThanh
Provides comprehensive KeyCloak administration guidance including realm management, user/group administration, client configuration, authentication flows, identity brokering, authorization policies, security hardening, and troubleshooting. Covers SSO configuration, SAML/OIDC setup, role-based access control (RBAC), user federation (LDAP/AD), social login integration, multi-factor authentication (MFA), and high availability deployments. Use when configuring KeyCloak, setting up SSO, managing realms and clients, troubleshooting authentication issues, implementing RBAC, or when users mention "KeyCloak", "SSO", "OIDC", "SAML", "identity provider", "IAM", "authentication flow", "user federation", "realm configuration", or "access management".
aws-architecture-design
by stakpak
Purpose: Standardize how stakpak designs and optimizes AWS architectures. Scope: Greenfield: design new infrastructure. Brownfield: analyze existing architectures and propose improvements.
code-reviewer
by beshkenadze
Review code for quality, security, and best practices. Use when asked to review code, find bugs, or suggest improvements.
dockerization
by stakpak
Official Stakpak application containerization standard operating procedure, a step-by-step guidline to properly dockerize applications. This is a rule book curated by the Stakpak Team.
Have I Been Clawned?
by wadim
The known-malicious skills list and CVE version checks are updated regularly. To suggest additions, open an issue with the source reference.
simple-deployment-on-vm
by stakpak
How to do simple but secure deployments using virtual machines on different cloud providers
compliance
by luisschmitzheadline
Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance.
audit-support
by luisschmitzheadline
Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.