认证鉴权
认证与授权
non-repudiation-privacy
florianbuetow
This skill should be used when the user asks to "check for non-repudiation privacy risks", "analyze excessive audit logging", "find privacy issues related to accountability", "check for forced identity linking", or mentions "non-repudiation" in a privacy context. Maps to LINDDUN category N. This is the INVERSE of STRIDE repudiation -- here too much proof is the threat.
learn
florianbuetow
This skill should be used when the user asks to "learn about security", "teach me OWASP", "security tutorial", "learn threat modeling", or invokes /appsec:learn. Interactive guided walkthrough using your codebase as teaching material.
strava
eddmann
Query Strava fitness data including activities, athlete stats, segments, routes, clubs, and gear. Use when the user asks about cycling, running, swimming, workouts, training, or Strava data.
pasta-vulns
florianbuetow
This skill should be used when the user asks to "analyze vulnerabilities", "find security weaknesses", "map CWEs", "run vulnerability analysis", or is running PASTA stage 5. Also triggers when the user asks about SAST, DAST, dependency scanning, or CWE mapping in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 5 of 7).
api
florianbuetow
This skill should be used when the user asks to "check API security", "audit REST API", "find BOLA vulnerabilities", "check for mass assignment", "analyze API rate limiting", "detect excessive data exposure", or mentions "API security", "BOLA", "IDOR", "mass assignment", "rate limiting", "broken function-level authorization", "excessive data exposure", or "OWASP API Top 10" in a security context.
auth
florianbuetow
This skill should be used when the user asks to "check for authentication issues", "analyze auth", "find credential vulnerabilities", "review login security", "check session management", or mentions "authentication", "passwords", "MFA", "sessions", or "brute force" in a security context. Maps to OWASP Top 10 2021 A07: Identification and Authentication Failures.
postkit
varunchopra
PostgreSQL-native identity, configuration, metering, and job queues. SQL functions that work with any language or driver. Use when working with user management, sessions, permissions, access control, login/logout, MFA, password resets, relationship-based access, versioned configuration, prompts, usage tracking, quotas, billing periods, or background jobs in PostgreSQL. Covers authn (user/session management), authz (ReBAC permissions), config (versioned key-value storage), meter (usage tracking with reservations), and queue (job scheduling with retries and dead letters).
attack-surface
florianbuetow
This skill should be used when the user asks to "map attack surface", "list entry points", "inventory API endpoints", "find all inputs", "enumerate routes", "discover exposed endpoints", or "map external interfaces". Also triggers when the user asks about exposed APIs, form handlers, file upload endpoints, WebSocket handlers, CLI argument parsers, or wants to understand where external data enters the system.
access-control
florianbuetow
This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDOR vulnerabilities", "audit CORS configuration", "check for privilege escalation", or mentions "access control", "authorization", "IDOR", "CORS", "JWT tampering", or "directory traversal" in a security context. Maps to OWASP Top 10 2021 A01: Broken Access Control.
review-plan
florianbuetow
This skill should be used when the user asks to "review plan for security", "check plan for security issues", "security review of implementation plan", "audit the plan for vulnerabilities", or "check my plan before coding". Also triggers when the user mentions security in the context of an implementation plan, architecture proposal, or design document before code has been written. This is the FLAGSHIP pre-code security skill -- no other tool reviews plans at design time.
tmux
sebnow
"Teaches agents to control tmux sessions for interactive CLIs and long-running processes via the Bash tool. Use when running REPLs, debuggers, database shells, long-running servers, or any tool requiring a persistent TTY. Triggers: 'start a REPL', 'run interactively', 'interactive session', 'long-running process', 'background server', 'keep running'. Do NOT use for simple one-shot commands or non-interactive background tasks that the Bash tool handles natively."
adr-writing
sebnow
"Use when documenting significant architectural decisions. Creates focused ADRs explaining context, decision, and alternatives. Prevents vague documentation and implementation detail bloat. Triggers: 'create ADR', 'document decision', making technology/framework/persistence/auth choices, cross-cutting concerns."
form-security
Bbeierle12
Security patterns for web forms including autocomplete attributes for password managers, CSRF protection, XSS prevention, and input sanitization. Use when implementing authentication forms, payment forms, or any form handling sensitive data.
commit
nweii
"Create well-formatted commits with conventional commit messages. Use when user asks to commit, wants to commit changes, or needs help with commit messages."
archive-conversation
nweii
"Create analytical archival summaries of AI conversations, capturing intellectual journeys, key insights, and technical logs. Use when archiving, saving, or documenting a chat session."
reppo
diegosouzapw
Publish content to Moltbook (a social network for AI agents) and mint it on Reppo.ai's AgentMind subnet. Use when an agent wants to post poems, ideas about Moltbook's future, or creative content. Covers the full flow: generate content, post to Moltbook, mint pod on-chain (Base), submit metadata. Can also buy REPPO tokens via Uniswap. Earns $REPPO emissions through human voting.
go-backend-clean-architecture
rebyteai-template
Go backend with Gin, MongoDB, JWT auth, and Clean Architecture.
clawvault
Versatly
Agent memory system with checkpoint/recover, structured storage, semantic search, session transcript repair, and optional cloud sync. Use when: storing/searching memories, preventing context death, repairing broken sessions. Don't use when: general file I/O.
flow-note
benkruger
"Invoke automatically whenever the user corrects Claude, disagrees with a response, or says something was wrong. Also invoke explicitly with /flow:flow-note to capture any learning mid-session. Fast — captures and continues without interrupting flow."
flow-continue
benkruger
"Resume the current FLOW feature. Mid-session: re-asks the last phase transition question. New session: reads state file, shows status, then asks."
detect-product
parhumm
Product reality extraction with evidence-backed features, monetization, and metrics. Use when analyzing product capabilities.
springboot-security
x-cmd
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
iterative-retrieval
x-cmd
Pattern for progressively refining context retrieval to solve the subagent context problem
eval-harness
x-cmd
Formal evaluation framework for Claude Code sessions implementing eval-driven development (EDD) principles