认证鉴权
认证与授权
secure-coding
Logos-Liber
OWASP secure coding practices, language-specific security considerations, input validation and output encoding, authentication and authorization patterns, cryptography best practices, secure API design, and common security anti-patterns
standard-security-auth
salavender
Security & Authentication Specialist - Expert in JWT, cookie-based auth, MFA, and generic security patterns
session-resume
salavender
Resume context from previous session
commit
kriscard
"Git: Use for /commit or when committing changes with semantic messages. NOT for PR creation (use /pr) or branch management."
python-testing
peopleforrester
Comprehensive Python testing patterns using pytest. Covers fixtures, parametrize, async testing, mocking, property-based testing, and coverage analysis.
coderabbit
indrasvat
Local AI code reviews via CodeRabbit CLI. ONLY use when (1) user explicitly requests "coderabbit"/"cr review", OR (2) code changes are high-risk (security, concurrency, complex logic). Rate-limited to 1 review/hour—be highly selective.
create-nextjs-ddd-auth-db
micheleangioni
Create a new fullstack Next.js. Use this skill when the user asks to create a new Next.js project or application.
agent-browser
freekmurze
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
signup-flow-cro
freekmurze
When the user wants to optimize signup, registration, account creation, or trial activation flows. Also use when the user mentions "signup conversions," "registration friction," "signup form optimization," "free trial signup," "reduce signup dropoff," or "account creation flow." For post-signup onboarding, see onboarding-cro. For lead capture forms (not account creation), see form-cro.
analytics-tracking
freekmurze
When the user wants to set up, improve, or audit analytics tracking and measurement. Also use when the user mentions "set up tracking," "GA4," "Google Analytics," "conversion tracking," "event tracking," "UTM parameters," "tag manager," "GTM," "analytics implementation," or "tracking plan." For A/B test measurement, see ab-test-setup.
onboarding-cro
freekmurze
When the user wants to optimize post-signup onboarding, user activation, first-run experience, or time-to-value. Also use when the user mentions "onboarding flow," "activation rate," "user activation," "first-run experience," "empty states," "onboarding checklist," "aha moment," or "new user experience." For signup/registration optimization, see signup-flow-cro. For ongoing email sequences, see email-sequence.
discover-security
rand
Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management. Activates for application security, OWASP, and security hardening tasks.
insecure-defaults
runkids
"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling."
firebase-apk-scanner
runkids
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
codex-claude-cursor-loop
bear2u
Orchestrates a triple-AI engineering loop where Claude plans, Codex validates logic and reviews code, and Cursor implements, with continuous feedback for optimal code quality
Claude Code X - Autonomous Execution Subagent
ShunsukeHayashi
Execute Claude Code autonomously in the background for well-defined tasks, enabling parallel execution of up to 5 concurrent sessions while the user continues other work.
Agent Browser
am-will
A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured commands.
session-reflect
i9wa4
End-of-session retrospective skill. Collects today's commits and vault notes, analyzes friction patterns, and proposes improvements to CLAUDE.md and skills. Use when: - User says "session-reflect", "振り返り", or "今日の振り返り" - End of a work session - User asks for improvement proposals
session-summary-japanese
ryoppippi
Summarise the current session in Japanese. Use when finishing a session, handing off work, or wanting a recap of what was discussed and accomplished.
session-analytics
spences10
Query Claude Code session analytics from ccrecall database. Use when user asks about token usage, costs, session history, or wants to analyze their Claude Code usage patterns.
gathering-requirements
axiomantic
"Use when eliciting or clarifying feature requirements, defining scope, identifying constraints, or capturing user needs. Triggers: 'what are the requirements', 'define the requirements', 'scope this feature', 'user stories', 'acceptance criteria', 'what should this do', 'what problem are we solving', 'what are the constraints'. Also invoked by implementing-features during DISCOVER stage and by the Forged workflow."
fun-mode
axiomantic
"Use when starting a session and wanting creative engagement, or when user says '/fun' or asks for a persona"
analyzing-skill-usage
axiomantic
"Analyze session transcripts to extract skill invocation patterns, score invocations, and produce comparative metrics for skill improvement decisions."
openspec-bulk-archive-change
alibaba
Archive multiple completed changes at once. Use when archiving several parallel changes.