安全
安全扫描与漏洞检测
owasp-top-10
NickCrew
OWASP Top 10 security vulnerabilities with detection and remediation patterns. Use when conducting security audits, implementing secure coding practices, or reviewing code for common security vulnerabilities.
kubernetes-security-policies
NickCrew
Kubernetes security policies, RBAC, and Pod Security Standards for hardened cluster deployments. Use when implementing cluster security, defining network policies, or enforcing security compliance in Kubernetes environments.
accessibility-audit
NickCrew
Fast, high-signal accessibility triage for pages, components, or PRs targeting WCAG 2.2 AA compliance.
constructive-dissent
NickCrew
Structured disagreement protocols to strengthen proposals through systematic challenge and alternative generation.
Canon
simota
ä¸çæ¨æºã»æ¥çæ¨æºã§ç©äºã解決ãã調æ»ã»åæã¨ã¼ã¸ã§ã³ããOWASP/WCAG/OpenAPI/ISO 25010çã®æ¨æºã¸ã®æºæ 度è©ä¾¡ãæ¨æºéåæ¤åºãæ¹åææ¡ãæ å½ãæ¨æºæºæ è©ä¾¡ãè¦æ ¼é©ç¨ãå¿ è¦ãªæã«ä½¿ç¨ã
audit-ux
doodledood
Audit UI/UX changes in a focus area against design guidelines for accessibility, consistency, and usability issues.
solidity-security
scaffold-eth
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
analyze-repo
miles990
Enterprise-grade repository analysis with arc42/C4 architecture documentation, technical debt quantification, security assessment, and multi-stakeholder reporting
security-practices
miles990
OWASP Top 10, authentication, and secure coding practices
code-review-medium
breaking-brake
Standard code review for medium PRs (100-500 lines). Includes code quality, security basics, and test coverage analysis.
review-security
ssiumha
Reviews code for security vulnerabilities. Use when implementing auth, handling user input, adding APIs, or before deployment. Checks OWASP Top 10, credentials, injection.
threat-modeling
bobmatnyc
"Threat modeling workflow for software systems: scope, data flow diagrams, STRIDE analysis, risk scoring, and turning mitigations into backlog and tests"
env-manager
bobmatnyc
"Environment variable validation, security scanning, and management for Next.js, Vite, React, and Node.js applications"
sunday-review
mycelium-hq
'Use when the user asks for the weekly meta-review or Sunday wrap-up of their week and vault: says /sunday, /sunday-review, ''let''s do the weekly review,'' ''Sunday review,'' ''review my week,'' ''weekly retro,'' ''week in review,'' ''end-of-week review,'' or wants journals, patterns, vault health, and stale decisions reviewed together at week''s end. Not for a journal-pattern read alone (use /weekly) or mid-week single checks.'
compliance-frameworks
Logos-Liber
SOC 2 compliance requirements, ISO 27001 standards, PCI DSS requirements, HIPAA security rules, GDPR data protection, NIST Cybersecurity Framework, and industry-specific compliance requirements
secret-warn
mycelium-hq
Use when adding or tuning edit-time secret and code-injection guardrails or security hooks in Claude Code, or on mentions of secret detection, API key safety, hardcoded or leaked keys (AWS, Stripe, GCP, OpenAI, Anthropic, GitHub, Slack, JWT, PEM, .env), gitleaks-style or pre-commit secret scanning, false positives or allowlists, unsafe pipe-to-shell or MCP server installs, or prompt injection in audited third-party content (README, AGENTS.md). Not for full security audits, pen testing, or DLP.
security-snapshot
mycelium-hq
'Use when the user says /security-snapshot, /snapshot <domain>, "run a security check on X", "generate a security report for [company]", or wants a security hygiene snapshot or free lead-magnet report on a prospect''s public domain: SSL/TLS grade, HTTP security headers, SPF/DMARC email authentication, server fingerprint leaks. Passive, unauthenticated scans only. NOT for penetration testing, internal infrastructure audits, or application-layer vulnerability assessment.'
network-scan
proficientlyjobs
Scan your LinkedIn contacts' companies for matching job openings
insecure-defaults
lv416e
"Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling."
kaizen:analyse-problem
NeoLabHQ
Comprehensive A3 one-page problem analysis with root cause and action plan
reflexion:reflect
NeoLabHQ
Reflect on previus response and output, based on Self-refinement framework for iterative improvement with complexity triage and verification
code-review:review-local-changes
NeoLabHQ
Comprehensive review of local uncommitted changes using specialized agents with code improvement suggestions
android-apk-audit
DragonJAR
Comprehensive Android APK security audit with static analysis, dynamic instrumentation, source-to-sink tracing, IPC/component abuse analysis, and CVSS 4.0 reporting. Covers decompilation, manifest analysis, deep links and intent injection, secrets detection, crypto analysis, Frida/Objection integration, and APK repackaging. Use when user says "audit APK", "analyze android app", "mobile pentest", "APK security", "decompile APK", "android vulnerability assessment", "reverse engineer android", "modify APK", "intent injection", "deep link abuse", "bypass SSL pinning", "bypass root detection", or provides an APK for security review, decompiled Android sources, or decoded resources.
data-quality
JoelLewis
"Financial data quality management: golden source architecture, data lineage, validation rules, exception management, profiling, monitoring, and governance frameworks."