Security
Security scanning and vulnerability detection
backend-development
by zircote
Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.
runa-credentials
by runafreyjasdottir
"Kista — Runa's self-owned encrypted vault. 8 entry types: credentials, API keys, SSH keys, certificates, notes, TOTP, licenses, identities. Independent access, no external dependencies."
security-intel-brief
by pramseier-tenb
Build a leadership-ready security intelligence brief (PDF) for selected vendors and software products, down to specific versions. Collects CVEs, CISA KEV (known exploited vulnerabilities) status, latest/fixed versions, end-of-life dates, vendor advisories, and recent security news, then assigns per-product risk ratings. Use this skill whenever the user wants security research on a vendor or product, asks about CVEs/KEVs/vulnerabilities affecting software they run, wants a patch/version exposure check, or asks for a security report or briefing for leadership — even if they don't say "PDF" or "brief". Trigger on phrases like "what vulnerabilities affect X", "security posture of [vendor/product]", "CVE report", "vulnerability briefing", "is [software version] safe/exposed".
safe-commit
by meriley
⚠️ MANDATORY - YOU MUST invoke this skill when committing. Complete commit workflow with all safety checks. Invokes security-scan, quality-check, and run-tests skills. Shows diff, gets user approval, creates commit with conventional format. NO AI attribution. User approval REQUIRED except during PR creation. NEVER commit manually.
responsible-disclosure
by pluginagentmarketplace
Ethical vulnerability reporting, coordinated disclosure, and bug bounty participation for AI systems
helm-chart-review
by meriley
Conduct comprehensive Helm chart security and quality audits with automated checks for security contexts, resource limits, and production readiness. Use when reviewing pull requests with Helm chart changes, conducting pre-release chart audits, security scanning Helm manifests, validating chart structure and best practices, or preparing charts for production deployment.
backend-dev
by dy9759
Comprehensive backend development workflow that orchestrates expert analysis, architecture design, implementation, and deployment using the integrated toolset. Handles everything from API design and database architecture to security implementation and DevOps automation.
wfc-deepen
by sam-fakhreddine
Augments an existing /wfc-plan directory by researching codebase patterns, project documentation, and dependency constraints to add supporting evidence to tasks. Reads TASKS.md and PROPERTIES.md, simulates parallel analysis across 4 dimensions, and appends sourced findings as annotations. Does NOT modify task structure, add/remove tasks, or write implementation steps. Triggers: /wfc-deepen, /wfc-deepen <path>, "add research evidence to the plan", "validate plan against codebase patterns", "annotate plan with known pitfalls", "cross-reference plan with existing solutions". Not for: writing or expanding task implementation steps; decomposing tasks into subtasks; prioritizing or reordering tasks; adding or removing tasks; pre-planning research before a plan directory exists; targeted research on specific questions unrelated to plan validation; re-deepening plans with existing Research Findings sections (use --force to override); general research with no plan context.
setup-node
by meriley
Sets up Node.js/TypeScript development environment with npm/yarn, dependencies, ESLint, Prettier, testing (Jest/Vitest), and TypeScript type checking. Ensures consistent tooling configuration. Use when starting work on Node.js/TypeScript projects, after cloning repositories, setting up CI/CD, or troubleshooting environment issues.
code-security-audit
by chaigon
对代码项目进行全面安全审计，支持 Python、Node.js、Go、Java 四种语言。 包含依赖漏洞扫描（结合原生工具 + Claude 分析）、代码安全模式检查（OWASP Top 10、注入、反序列化、 敏感信息泄露、认证授权、加密问题等）、业务逻辑审计、攻击链构建、配置审计、以及结构化报告输出。 触发场景：(1) 用户要求对项目进行安全审计/安全检查/代码审计 (2) 用户要求检查代码中的安全漏洞 (3) 用户要求进行依赖漏洞扫描 (4) 用户提到 security audit、vulnerability scan、代码审计、安全扫描、渗透测试前的代码审查 (5) 用户要求检查 OWASP Top 10 相关问题
automated-testing
by pluginagentmarketplace
CI/CD integration and automation frameworks for continuous AI security testing
copilot-cli-agent
by richfrem
Copilot CLI sub-agent system for persona-based analysis. Use when piping large contexts to GitHub Copilot models for security audits, architecture reviews, QA analysis, or any specialized analysis requiring a fresh model context.
Code Review Checklist
by LKB-99
50 skills para Manus com acionamento automático - IA, Marketing, Finanças, Saúde, Produtividade, Desenvolvimento e mais
security-scan
by meriley
⚠️ MANDATORY - Automatically invoked by safe-commit. Performs comprehensive security scanning before commits. Checks for secrets (API keys, passwords, tokens), dependency vulnerabilities, code injection risks, and authentication issues. MUST pass before any commit. NEVER run security scans manually.
security-antipatterns-python
by subhashdasyam
Use when generating Python code for web applications, APIs, or handling user input - prevents OWASP Top 10 vulnerabilities in Django, Flask, FastAPI
Security Audit
by LKB-99
"Performs a comprehensive security audit on applications based on OWASP ASVS. Use this skill when users want to perform a security check, audit, or review of their application. Triggers: security audit, security check, vulnerability scan, penetration test, OWASP, ASVS, application security, code review, secure coding, pentest, auditoria de segurança, verificação de segurança, análise de vulnerabilidade, teste de invasão."
tech-blog-seo-draft-creator
by masayan1126
テックブログ記事の下書きをSEO最適化込みで一括作成するスキル。雑なメモから体裁を整え、タイトル・メタディスクリプション・ハッシュタグまで生成。「SEO込みで記事にして」「SEO最適化された下書きを作成して」「公開できる形にして」などのリクエストで利用。
audit-plugin
by richfrem
Audits a local plugin directory to ensure it perfectly matches the Agent Skills and Claude Plugin Open Standards.
secure-deployment
by pluginagentmarketplace
Security best practices for deploying AI/ML models to production environments
auditing-permission-ux
by clix-so
Audits notification permission request flows. Use when reviewing or improving permission prompts, settings paths, or denial handling.
benchmark-datasets
by pluginagentmarketplace
Standard datasets and benchmarks for evaluating AI security, robustness, and safety
wfc-security
by sam-fakhreddine
Architectural threat modeling (STRIDE) and design-level security analysis for software systems. Analyzes system descriptions, architecture diagrams, or explicitly pasted configuration files. Does NOT perform live CVE scanning, code logic review, or implementation patching. Use when: User requests threat modeling, attack surface mapping, or static dependency risk assessment. Do NOT use when: User requests live vulnerability scanning, code review, specific bug remediation (SQLi, XSS), or compliance auditing.
architect-system
by vxcozy
Master orchestrator for the 5-step productivity loop. Runs audit, architect, analyst, refinery, and compounder in sequence or individually. Use when you want to run the full loop, start the system, check system status, resume from where you left off, or run a specific step. Manages state, sequencing, and skill chaining. Supports full loop, single step, resume, and status-only modes.
Healthsafety
by robdtaylor
UK health and safety management for manufacturing operations. Covers risk assessments, COSHH, PPE, incident reporting, LOTO, manual handling, and emergency procedures. Aligned with UK HSE regulations and IATF 16949 clause 7.1.4. USE WHEN user says 'health and safety', 'risk assessment', 'COSHH', 'PPE', 'accident', 'incident', 'LOTO', 'lockout tagout', 'manual handling', 'emergency procedure', or needs safety compliance guidance.