Security
Security scanning and vulnerability detection
AI Writing Avoidance
by fabioc-aloha
Skill Version: 1.0.0 Created: 2026-03-05 Category: Writing Quality
factory-review
by jwilger
Structures the human review experience for factory-mode builds. Audit trail summaries, PR digests, retrospective synthesis, quality trend tracking, and autonomy tuning interface. Activate during Phase 3 human review.
agent-creator
by basher83
This skill should be used when the user asks to "create an agent", "write a subagent", "generate agent definition", "add agent to plugin", "write agent frontmatter", "create autonomous agent", "build subagent", needs agent structure guidance, YAML frontmatter configuration, invocation criteria with examples, or wants to add specialized subagents to Claude Code plugins with proper capabilities lists and tool access definitions.
comprehensive-review
by troykelly
Use after implementing features - 7-criteria code review with MANDATORY artifact posting to GitHub issue; blocks PR creation until complete
ac-security-sandbox
by adaptationio
Security sandbox for autonomous coding. Use when validating commands, configuring permissions, managing allowlists, or ensuring safe execution.
postgres-rls
by troykelly
MANDATORY when touching auth tables, tenant isolation, RLS policies, or multi-tenant database code - enforces Row Level Security best practices and catches common bypass vulnerabilities
ac-code-validator
by adaptationio
Validate code quality and standards. Use when running linting, checking types, validating code style, or performing static analysis.
ac-qa-reviewer
by adaptationio
Quality assurance review for implementations. Use when reviewing code quality, checking implementation standards, performing QA cycles, or validating feature quality.
AWS Cloud Infrastructure Skill
by FortiumPartners
AWS Provider: â¥5.0.0
intershop-icm-best-practices
by bartundmett
Intershop Commerce Management (ICM) backend development best practices. This skill should be used when writing, reviewing, or refactoring ICM Java code to ensure optimal patterns for customization, performance, B2B features, security, testing, and maintainability. Triggers on tasks involving ICM cartridge development, REST API creation, business objects, pipelines, database operations, jobs, events, or search.
review-gate
by troykelly
HARD GATE before PR creation - verifies review artifact exists in issue comments, all findings addressed or tracked, blocks PR creation if requirements not met
security-review
by troykelly
MANDATORY for security-sensitive code changes - OWASP-based security review with dedicated checklist, required before PR for auth, input handling, API, database, or credential code
postgres-rls
by troykelly
MANDATORY when touching auth tables, tenant isolation, RLS policies, or multi-tenant database code - enforces Row Level Security best practices and catches common bypass vulnerabilities
security-reviewer
by troykelly
Use when explicitly asked to run the security-reviewer subagent or when another skill requires the security-reviewer agent card.
issue-driven-development
by troykelly
Use for any development work - the master 13-step coding process that orchestrates all other skills, ensuring GitHub issue tracking, proper branching, TDD, code review, and CI verification
review-gate
by troykelly
HARD GATE before PR creation - verifies review artifact exists in issue comments, all findings addressed or tracked, blocks PR creation if requirements not met
comprehensive-review
by troykelly
Use after implementing features - 7-criteria code review with MANDATORY artifact posting to GitHub issue; blocks PR creation until complete
security-review
by troykelly
MANDATORY for security-sensitive code changes - OWASP-based security review with dedicated checklist, required before PR for auth, input handling, API, database, or credential code
electrobun-distribution
by rajavijayach
Packaging, code signing, notarization, and distribution for Electrobun desktop applications. This skill covers building production bundles, creating installers and distributable packages, code signing for Windows and macOS, Apple notarization for Gatekeeper, auto-updater implementation, delta updates, update servers, cross-platform build processes, CI/CD integration, app icons and resources, version management, release workflows, Windows SmartScreen requirements, macOS DMG creation, Linux package formats (deb, rpm, AppImage), and distribution best practices. Use when preparing app for production, implementing auto-updates, setting up code signing certificates, troubleshooting distribution issues, creating installers, configuring update servers, building for multiple platforms, or releasing new versions. Triggers include "build", "package", "distribute", "code sign", "notarize", "installer", "auto-update", "release", "production build", "DMG", "updater", "delta update", or "certificate".
backend-development
by samhvw8
"Production backend systems development. Stack: Node.js/TypeScript, Python, Go, Rust NestJS, FastAPI, Django, Express PostgreSQL, MongoDB, Redis. Capabilities: REST/GraphQL/gRPC APIs, OAuth 2.1/JWT auth, OWASP security, microservices, caching, load balancing, Docker/K8s deployment. Actions: design, build, implement, secure, optimize, deploy, test APIs and services. Keywords: API design, REST, GraphQL, gRPC, authentication, OAuth, JWT, RBAC, database, PostgreSQL, MongoDB, Redis, caching, microservices, Docker, Kubernetes, CI/CD, OWASP, security, performance, scalability, NestJS, FastAPI, Express, middleware, rate limiting. Use when: designing APIs, implementing auth/authz, optimizing queries, building microservices, securing endpoints, deploying containers, setting up CI/CD."
data-governance
by dtsong
"Use this skill when implementing data governance as part of engineering work. Covers data cataloging (dbt docs, external tools), lineage documentation, data classification (PII/PHI taxonomy), access control patterns (RBAC, row-level security), and compliance frameworks (GDPR, HIPAA, SOX, CCPA). Common phrases: \"data catalog\", \"data lineage\", \"PII classification\", \"access control\", \"RBAC\", \"data governance\", \"compliance requirements\". Do NOT use for writing dbt models (use dbt-transforms), pipeline orchestration (use data-pipelines), or data quality testing (use data-testing)."
check-lightning
by phrazzld
Audit Lightning Network integration. Checks node health, channel balances, peer connectivity, invoice handling, and routing. Use when: reviewing Lightning setup, diagnosing payment failures, or capacity planning. Keywords: lightning, lnd, cln, channels, invoices, bolt11.
check-stripe
by phrazzld
Audit Stripe integration: configuration, webhooks, subscription logic, security. Outputs structured findings. Use log-stripe-issues to create issues. Invoke for: Stripe audit, payment review, subscription analysis.
design-audit
by devanshuDesai
UI/UX design audit with Steve Jobs and Jony Ive design philosophy