Security
Security scanning and vulnerability detection
audit-mcp
by melodic-software
Audit MCP server configurations for quality, compliance, and security. Use to validate .mcp.json files and server setups.
audit-skills
by melodic-software
Audit Claude Code skills for quality, compliance, delegation pattern, and maintainability. Use after creating skills, before releases, or for periodic quality checks.
reviewer
by scottymcandrew
Code review specialist. Use when code needs review, before merging changes, or to assess code quality. Provides structured feedback with severity levels.
backend-principle-eng-typescript-pro-max
by PrakharMNNIT
"Principal backend engineering intelligence for TypeScript services. Actions: plan, design, build, implement, review, fix, optimize, refactor, debug, secure, scale backend code and architectures. Focus: correctness, reliability, performance, security, observability, scalability, operability, cost."
crisis-manager
by famaoai-creator
Provides rapid response during production incidents or critical security breaches. Coordinates diagnostics, temporary fixes, and post-mortem data collection.
everclaw
by profbernardoj
Open-source first AI inference — GLM-5 as default, Claude as fallback only. Own your inference forever via the Morpheus decentralized network. Stake MOR tokens, access GLM-5, GLM-4.7 Flash, Kimi K2.5, and 30+ models with persistent inference by recycling staked MOR. Open-source first model router routes all tiers to Morpheus by default — Claude only kicks in as an escape hatch when needed. Includes Morpheus API Gateway bootstrap for zero-config startup, OpenAI-compatible proxy with auto-session management, automatic retry with fresh sessions, OpenAI-compatible error classification to prevent cooldown cascades, multi-key auth rotation v2 with proactive DIEM balance monitoring and reactive 402 watchdog, Gateway Guardian v5 with direct curl inference probes (eliminates Signal spam), proactive Venice DIEM credit monitoring, circuit breaker for stuck sub-agents, nuclear self-healing restart, always-on proxy-router with launchd auto-restart, smart session archiver, three-shift cyclic execution engine (v2 with 15-minute execution loops), 24/7 always-on power configuration for macOS, bundled security skills, zero-dependency wallet management via macOS Keychain, x402 payment client for agent-to-agent USDC payments, ERC-8004 agent registry reader for discovering trustless agents on Base, and hardware-aware local Ollama fallback with auto model selection (Qwen3.5 family, 1.5B–72B based on available RAM/GPU).
agent-guardrails
by GaBySuGy
"Stop AI agents from secretly bypassing your rules. Mechanical enforcement with git hooks, secret detection, deployment verification, and import registries. Born from real production incidents: server crashes, token leaks, code rewrites. Works with Claude Code, Clawdbot, Cursor. Install once, enforce forever."
pre-commit-review
by ichuan
"Comprehensive code review for uncommitted changes before git commit. Use when users want to: (1) Review code changes before committing, (2) Check for security vulnerabilities, bugs, or performance issues, (3) Get feedback on code quality and best practices, (4) Identify issues by severity level. Triggered by phrases like 'review my changes', 'check my code', 'review before commit', 'code review', or similar requests for pre-commit validation."
post-quantum-shield
by famaoai-creator
Output path for report
dependency-track
by rezkam
Query and audit Dependency-Track SCA findings. Use when working with software composition analysis, reviewing vulnerability findings, auditing CVEs, checking project dependency health, uploading SBOMs, or managing policy violations in Dependency-Track.
developing-bash
by sumik5
Comprehensive Bash shell scripting and automation guide covering fundamentals, control flow, I/O pipelines, process control, system administration automation, testing/debugging, security, design patterns, and penetration testing automation (Nmap, web scanning, exploitation, Wi-Fi assessment, reporting). MUST load when .sh files are detected or shell scripts are being written. For Docker-specific patterns, use managing-docker instead. For broader DevOps methodology, use practicing-devops instead.
developing-google-cloud
by sumik5
Google Cloud development guide covering Cloud Run (architecture, scaling, CI/CD), GCP security (IAM, VPC, KMS, DLP, SCC, Zero Trust, Chronicle), data engineering (BigQuery, Dataflow, data pipelines, governance), network engineering (VPC, load balancing, CDN, Traffic Director), and Memorystore (Redis/Memcached, cache patterns, resilience). MUST load when Dockerfile is detected with google-cloud packages, when cloudbuild.yaml is present, or when working with BigQuery, Dataflow, Dataproc, Cloud Interconnect, or Memorystore. For Docker-specific patterns, use managing-docker instead. For general monitoring design, use designing-monitoring instead. For code-level security (OWASP, CodeGuard), use securing-code instead. For data architecture patterns (CQRS, event sourcing), use architecting-data instead. For AWS development, use developing-aws instead. For serverless security (GCS hacking, Cloud Run abuse), use securing-serverless instead. For application logging, use implementing-logging.
dependency-audit
by manastalukdar
Comprehensive dependency security and license audit
backend-principle-eng-java-pro-max
by PrakharMNNIT
"Principal backend engineering intelligence for Java services and distributed systems. Actions: plan, design, build, implement, review, fix, optimize, refactor, debug, secure, scale backend code and architectures. Focus: correctness, reliability, performance, security, observability, scalability, operability, cost."
audit-statuslines
by melodic-software
Audit Claude Code status lines for quality and cross-platform compatibility. Use when creating or validating custom status line scripts, or troubleshooting terminal output issues.
audit-plugins
by melodic-software
Audit Claude Code plugins for quality, compliance, and distribution readiness. Use before releases or for periodic quality checks.
compliance-officer
by famaoai-creator
status: implemented
doctor
by ScarXparth
Audits any project for security, test coverage, and Claude Code automation. 46 checks across 6 layers: secrets, CLAUDE.md, hooks, skills, agents, rules, MCP, CI, memory. Adaptive scoring — auto-detects project maturity (Starter/Growing/Mature/Pro). Diagnoses gaps, prescribes project-specific fixes, applies them. Usage: /doctor — full audit (all 6 layers) /doctor quick — TOP-3 priorities + score (30 seconds) /doctor scan — diagnose only (no changes) /doctor fix — prescribe + apply fixes /doctor layer <N> — audit specific layer (0-5) /doctor verify — health check Triggers: "/doctor", "audit", "setup automation", "configure Claude Code", "project health", "what's missing", "security check", "аудит", "проверь проект"
factory-review
by jwilger
Structures the human review experience for factory-mode builds. Audit trail summaries, PR digests, retrospective synthesis, quality trend tracking, and autonomy tuning interface. Activate during Phase 3 human review.
Security Validation
by auldsyababua
Pre-merge security validation detecting secrets, user-specific paths, insecure SSH configurations, and security-weakening flags
typescript-code-review
by Exploration-labs
Perform comprehensive code reviews for TypeScript projects, analyzing type safety, best practices, performance, security, and code quality with actionable feedback
skill-security-analyzer
by auldsyababua
Comprehensive security risk analysis for Claude skills. Use when asked to analyze security risks, review security stance, audit skills for vulnerabilities, check security before deployment, or evaluate safety of skill files. Triggers include "analyze security," "security risks," "security audit," "security review," "is this skill safe," or "check for vulnerabilities."
secrets-guardian
by timequity
Protect repositories from accidental secret commits. Essential when working with AI agents. Use when: setting up new project, adding pre-commit hooks, scanning for secrets, fixing leaked credentials. Triggers: "настрой защиту секретов", "setup secrets", "check secrets", "scan secrets", "проверь секреты", "pre-commit", "gitleaks". PROACTIVELY suggest when creating new projects or when .pre-commit-config.yaml is missing.
security-validation
by auldsyababua
Pre-merge security validation detecting secrets, user-specific paths, insecure SSH configurations, and security-weakening flags. Use before committing code/documentation, before creating PRs, or during QA validation. Supports automated scanning with severity-based enforcement (CRITICAL blocks merge, HIGH requires fixes).