Security
Security scanning and vulnerability detection
php-security
by peixotorms
Use when handling user input, database queries, file operations, authentication, sessions, or any security-sensitive PHP code. Covers SQL injection prevention with prepared statements, PDO parameterized queries, XSS with htmlspecialchars, CSRF tokens, input validation (filter_var, FILTER_VALIDATE_*, FILTER_SANITIZE_*), output escaping by context, password_hash, password_verify, bcrypt, Argon2, file upload security, session management, SameSite cookies, Content-Security-Policy headers, serialization security, process execution security, error exposure, php.ini hardening (open_basedir, disable_functions, allow_url_include), OWASP Top 10 for PHP, rate limiting, brute force protection, directory traversal, path traversal, and common vulnerability patterns.
pci-compliance
by peixotorms
Use when building payment processing, handling credit card data, PAN, CVV, cardholder data environment (CDE), implementing checkout flows, tokenization, Stripe, Braintree, or any code that touches cardholder information — PCI DSS v4.0 coding patterns, SAQ selection, data classification, AES-256 encryption, TLS 1.2, audit log, data masking, Luhn validation, payment gateway integration, 3-D Secure, scope reduction, network segmentation
code-reviewer
by gaebalai
Copilot agent that assists with comprehensive code review focusing on code quality, SOLID principles, security, performance, and best practices Trigger terms: code review, review code, code quality, best practices, SOLID principles, code smells, refactoring suggestions, code analysis, static analysis Use when: User requests involve code reviewer tasks.
security-review
by thoreinstein
Perform enterprise security review of the codebase
audit
by vxcozy
Productivity analyst that maps your workflow, scores tasks by time cost and energy drain, and builds a prioritized 4-week automation plan. Use when you want to audit your workflow, figure out what to automate, do a productivity review, identify high-leverage tasks, feel overwhelmed and need to prioritize, or after the compounder surfaces new friction. Part of the architect-system loop. Outputs to system/audit-report.md.
cve-audit
by Mearman
Scan project dependencies for known vulnerabilities. Automatically detect and parse package files (package.json, requirements.txt, Gemfile, go.mod, pom.xml) and check all dependencies against the CVE database. Use when you want to audit a project for security vulnerabilities, check if dependencies have known CVEs, or generate a vulnerability report for compliance.
release-readiness-checklist
by asteroid-belt
Interactive release readiness checklist with semantic versioning guidance. Use when preparing a software release, cutting a version, deploying to production, or when user asks about release preparation. Triggers on phrases like "prepare release", "release checklist", "ready to release", "cut a version", "version bump", or "/release-readiness-checklist".
review-simplicity
by doodledood
"Audit code for over-engineering, premature optimization, and cognitive complexity. Identifies unnecessary abstractions, YAGNI violations, and overly complex solutions. Read-only analysis. Triggers: review simplicity, over-engineering, complexity check, YAGNI."
design-audit
by devanshuDesai
UI/UX design audit with Steve Jobs and Jony Ive design philosophy
analyzing-response-quality
by C0ntr0lledCha0s
Expert at analyzing the quality of Claude's responses and outputs. Use when evaluating response completeness, accuracy, clarity, or effectiveness. Auto-invokes during self-reflection or when quality assessment is needed.
dependency-audit
by 1Mangesh1
Dependency auditing, updating, and vulnerability management for npm, pip, and other package managers. Use when user asks to "audit dependencies", "update packages", "fix vulnerabilities", "check outdated", "npm audit", "pip audit", "upgrade dependencies safely", or any dependency management tasks.
audit-skills
by Tharun-Balaji
"Review, audit, and harden AI skills for security risks including prompt injection, hidden instructions, tool misuse, data exfiltration, and malicious payloads; use when analyzing SKILL.md, scripts, references, or assets for vulnerabilities and when producing remediation guidance."
protocol
by michavie
Expert MultiversX Protocol Knowledge. Use for understanding sharding, consensus, token standards (ESDT), and network parameters.
architect-system
by vxcozy
Master orchestrator for the 5-step productivity loop. Runs audit, architect, analyst, refinery, and compounder in sequence or individually. Use when you want to run the full loop, start the system, check system status, resume from where you left off, or run a specific step. Manages state, sequencing, and skill chaining. Supports full loop, single step, resume, and status-only modes.
solodit
by BowTiedSwan
Search 50,000+ smart contract vulnerabilities from Cyfrin Solodit. 8 MCP tools with intelligent caching for searching, filtering, and analyzing blockchain security findings.
memory-scan
by dgriffin831
Safe to run frequently (minimal API cost with efficient chunking)
config-analyzer
by dgriffin831
Analyze configuration files for validation and best practices
scan
by designnotdrum
"On-demand trend scan for a topic. Search HN and GitHub for what's happening now."
researching-best-practices
by C0ntr0lledCha0s
Automatically activated when user asks "what's the best way to...", "how should I...", "what are best practices for...", or requests recommendations, industry standards, or proven approaches for implementing features
system-design
by pluginagentmarketplace
System design, software architecture, API design, cybersecurity, and threat modeling. Build secure, scalable systems.
input-guard
by dgriffin831
Scan untrusted external text (web pages, tweets, search results, API responses) for prompt injection attacks. Returns severity levels and alerts on dangerous content. Use BEFORE processing any text from untrusted sources.
authentication-patterns
by 1Mangesh1
Authentication and authorization patterns and best practices. Use when user asks to "implement authentication", "OAuth flow", "JWT tokens", "session management", "SSO setup", "API keys", "RBAC", "SAML", "passwordless auth", "multi-factor authentication", or mentions auth design patterns and security.
auth-implementation
by guptadeepak
Expert guidance for implementing secure authentication systems including OAuth 2.0, SAML, OIDC, JWT, passwordless authentication, passkeys, and biometrics. Covers protocol selection, security best practices, common pitfalls at scale, and enterprise patterns. Use when implementing login flows, SSO, API authentication, machine identity, or any identity management features.
hipaa-compliance
by peixotorms
Use when handling health data, patient records, medical systems, PHI, ePHI, healthcare APIs, EHR integrations, telehealth, health apps, or any code processing Protected Health Information — HIPAA Security Rule technical safeguards, 18 identifiers, Safe Harbor, Expert Determination, 164.312, access control, audit log, encryption at rest, encryption in transit, BAA, Business Associate Agreement, minimum necessary, breach notification, HHS, OCR, de-identification