安全
安全扫描与漏洞检测
threat-modeling
bdfinst
Structured STRIDE security analysis for identifying threats, attack surfaces, and mitigations. Use before implementing any new API, service, authentication change, or data flow crossing trust boundaries — security analysis belongs in the design phase, not after.
feedback-learning
bdfinst
Capture amend/learn/remember/forget keywords from the user and update agent or skill configurations. Invoke immediately when the user issues any of these trigger words — parse the change, preview a diff, apply it, and log it to the audit trail.
semgrep-analyze
bdfinst
Run Semgrep static analysis on target files and return structured findings. Use this when the user wants static analysis, SAST scanning, or security scanning — phrases like "run semgrep", "scan for vulnerabilities", "static analysis on this code", or as a pre-review gate when security findings are needed before AI agents run.
simpleaible
simpleble
Use the SimpleAIBLE MCP server to scan, connect, and interact with Bluetooth devices. This skill provides guidance on the recommended flow (scan -> connect -> services -> read/notify) and handles platform-specific differences like UUIDs on macOS vs MAC addresses on Linux. Use when the user wants to interact with BLE hardware or debug Bluetooth connections.
claude-setup-audit
codemie-ai
This skill should be used when the user asks to "audit my claude setup", "check my claude configuration", "assess my claude code setup", "audit claude", "review my .claude folder", "is my claude setup correct", "check repo health", "assess my skills quality", "review my agents", "check my CLAUDE.md", "validate my hooks", "audit claude configuration", "check my MCP config", "how good is my claude setup", "scan my .claude folder", or wants a comprehensive quality assessment of all Claude Code components in a repository. Evaluates skills, subagents, CLAUDE.md rules, commands, hooks, and MCP configuration against established best practices. Produces a graded health report (A–F per component) with good/bad example references and prioritized recommendations.
claw-release
prompt-security
Release automation for Claw skills and website. Guides through version bumping, tagging, and release verification.
clawtributor
prompt-security
Community incident reporting for AI agents. Contribute to collective security by reporting threats.
clawsec-suite
prompt-security
ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills.
soul-guardian
prompt-security
Drift detection + baseline integrity guard for agent workspace files with automatic alerting support
aif-security-checklist
lee-to
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".
humanizer
zed-industries
Remove signs of AI-generated writing from text. Use after drafting to make copy sound more natural and human-written. Based on Wikipedia's "Signs of AI writing" guide.
Android Security
HoangNguyen0403
Standards for Data Encryption, Network Security, and Permissions
code-review
vstorm-co
Review Python code for quality, security, and best practices
Android Legacy Security
HoangNguyen0403
Standards for Intents, WebViews, and FileProvider
azure-tenant-assessment
markus41
Deep expertise in running an initial Azure tenant assessment - subscription inventory, resource catalog, security posture snapshot, cost overview, and plugin setup recommendations via ARM REST API and microsoft-azure-mcp tools. Acts as the entry point for any new Azure engagement, surveying the tenant and mapping discovered resource types to the right plugins.
security-best-practices
tech-leads-club
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
parallel-code-review
dgalarza
This skill should be used when performing comprehensive code reviews using multiple specialized review agents in parallel. It provides patterns for concurrent execution, decision tracking to prevent redundancy, and consolidated reporting. Use when needing thorough review coverage from multiple perspectives (security, architecture, performance) or when reviewing large changesets.
best-practices
tech-leads-club
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
component-common-domain-detection
tech-leads-club
Identifies duplicate domain functionality across components and suggests consolidation opportunities. Use when finding common domain logic, detecting duplicate functionality, analyzing shared classes, planning component consolidation, or when the user asks about common components, duplicate code, or domain consolidation.
security-ownership-map
tech-leads-club
'Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.'
fivem-security
germanfndez
Best practices and rules for securing FiveM resources against cheaters and exploits. Use this skill when writing or reviewing server-side and client-side code to ensure malicious events, unauthorized entity creations, and client trust issues are prevented. Focuses on strict server authority and safe event handling.
auditing-python-security
wdm0006
Audits Python libraries for security vulnerabilities using Bandit, pip-audit, Semgrep, and detect-secrets. Identifies SQL injection, command injection, hardcoded credentials, weak cryptography, and insecure deserialization. Use when reviewing library security, setting up security scanning in CI, or implementing secure coding patterns.
scan-codebase
Agenta-AI
Perform a fresh-context scan of code and docs that turns verification observations and missing-test gaps into findings. Accept optional path and depth parameters and default to path=infer, depth=deep. Confirm effective variables before starting.
data-quality
JoelLewis
"Financial data quality management: golden source architecture, data lineage, validation rules, exception management, profiling, monitoring, and governance frameworks."