Security
Security scanning and vulnerability detection
secure-development
by vineethsoma
Security best practices for production applications including PII protection, input validation, SQL injection prevention, XSS mitigation, and secure logging. Apply when handling user data, authentication, or external inputs.
tactic-rules
by soyyotedigo
Reglas y convenciones para el pipeline de TACTIC
mcp-server-development
by bradsjm
Develop, review, and refactor Model Context Protocol (MCP) servers in Python or TypeScript/Node.js. Use when designing MCP tool/resource/prompt contracts, implementing an MCP server (stdio/SSE/Streamable HTTP), tightening JSON Schema inputs, improving error handling, adding security guardrails (secret scrubbing, permissions, destructive confirmations), and creating tests for MCP tools.
saas-security
by hwatkins
When the user needs to implement or review security for a SaaS application. Covers authentication, authorization, API security, account takeover prevention, session management, and security headers. Also use when mentioning "auth security," "API protection," "account takeover," "session hijacking," "CSRF," "XSS," or "security headers." For spam-specific issues, see spam-prevention.
threat-modeler
by tmart234
Produce structured threat models for software, systems, networks, IoT/embedded devices, medical devices, or business processes. Walks Shostack's Four Question Framework, produces a Mermaid DFD with trust boundaries, runs STRIDE-Per-Element with prioritized mitigations and derived security requirements, and a Q4 self-assessment. Trigger on threat modeling, STRIDE, DFD / data flow diagram, attack surface, abuse / misuse cases, security architecture review, trust boundaries, "what can go wrong / what are the threats to X / how would someone attack X", or pasting architecture and asking about risks. Also trigger when the user names a methodology (LINDDUN, PASTA, DREAD, attack trees) or asks for a regulatory threat-model deliverable (FDA premarket cybersecurity, IEC 62443, IEC 81001-5-1). Greenfield and brownfield. Do NOT trigger for penetration testing planning, vulnerability scanning, or incident response.
backend-development
by brixtonpham
"Production backend systems development. Stack: Node.js/TypeScript, Python, Go, Rust NestJS, FastAPI, Django, Express PostgreSQL, MongoDB, Redis. Capabilities: REST/GraphQL/gRPC APIs, OAuth 2.1/JWT auth, OWASP security, microservices, caching, load balancing, Docker/K8s deployment. Actions: design, build, implement, secure, optimize, deploy, test APIs and services. Keywords: API design, REST, GraphQL, gRPC, authentication, OAuth, JWT, RBAC, database, PostgreSQL, MongoDB, Redis, caching, microservices, Docker, Kubernetes, CI/CD, OWASP, security, performance, scalability, NestJS, FastAPI, Express, middleware, rate limiting. Use when: designing APIs, implementing auth/authz, optimizing queries, building microservices, securing endpoints, deploying containers, setting up CI/CD."
security-review
by Protagonistss
代码安全审查与漏洞风险评估能力。
testing
by williaby
Automated test generation, review, and execution for pytest-based projects. Auto-activates on keywords test, coverage, pytest, unittest, integration test, e2e, performance, benchmark, security testing. Routes to specialized testing workflows based on user intent.
AWS Penetration Testing
by automindtechnologie-jpg
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
DevOps Automator
by anorbert-cmyk
DevOps / Platform Engineer focused on safe automation, repeatable environments, and fast delivery.
trivy
by lorenzogirardi
Security vulnerability scanning using Trivy for ecommerce project. Scans dependencies, container images, and IaC. Blocks CRITICAL and HIGH severity. Triggers on "trivy", "vulnerability scan", "security scan", "container scan", "cve", "dependency scan", "npm audit", "docker scan", "security check". PROACTIVE: MUST invoke before committing code with new dependencies.
skillcheck
by atbender
LLM-powered security auditor for Claude Code skills. Analyzes skills for security risks before installation.
code-review
by mishankov
Perform comprehensive software code reviews focused on correctness, regressions, security, reliability, performance, and test quality. Use when asked to review pull requests, commits, branches, patches, or source files and deliver prioritized findings with severity, concrete impact, and file/line references.
code-audit
by pietz
Structural health assessment for codebases. Use when the user asks to audit code quality, assess code health, review a codebase, find technical debt, clean up code structure, or identify refactoring opportunities. Also use when asked to do a "code audit", "codebase review", "quality assessment", or "tech debt analysis". Provides parallel multi-lens analysis via sub-agents with specialized checklists for code health, cross-module coherence, refactoring detection, and security.
code-review-checklist
by htooayelwinict
Review code changes for correctness, security, performance, and maintainability. Use for PR reviews, code audits, pre-merge checks, or quality validation of Laravel + React + Python code. EXCLUSIVE to reviewer agent.
Quality Engineer Agent
by gajakannan
Opinionated AI‑agent development framework with a reference Insurance CRM implementation.
securing-ai-generated-code
by chrbailey
Reviews AI-generated code for security vulnerabilities before commit. Checks for injection flaws, privilege escalation, hardcoded secrets, insecure defaults, and missing input validation. Use when reviewing code written by AI coding agents, after code generation, or before committing AI-assisted changes.
writing-meeting-notes
by danbars
Use when a meeting just occurred and notes need to be turned into a clear summary with decisions, action items, owners, and dates.
Solaudit - Smart Contract Security Scanner
by NguyenMinhGitHub
Solidity smart contract security auditor. Detect reentrancy, overflow, access control issues. 50+ vulnerability patterns. CI/CD ready. Free CLI tool.
information-security-manager-iso27001
by nimeshgurung
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
AWS Penetration Testing
by jcastillotx
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
security-scan
by IHKREDDY
Run security checks before PR including secrets, vulnerabilities, and best practices
supabase-postgres-best-practices
by kunhai-88
"Supabase 出品的 Postgres 性能优化与最佳实践。在编写、评审或优化 Postgres 查询、表结构设计或数据库配置时使用。"
asking-questions
by arielperez82
Guidance for asking clarifying questions when user requests are ambiguous, have multiple valid approaches, or require critical decisions. Use when implementation choices exist that could significantly affect outcomes.