安全
安全扫描与漏洞检测
audit-settings
melodic-software
Audit Claude Code settings.json files for quality, compliance, and security. Use to validate configuration before deployment or check for exposed secrets.
audit-docs-delegation
melodic-software
Audit skills and memory files for docs-management delegation compliance. Detects hardcoded Claude Code data and verifies proper delegation patterns.
audit-skills
melodic-software
Audit Claude Code skills for quality, compliance, delegation pattern, and maintainability. Use after creating skills, before releases, or for periodic quality checks.
audit-mcp
melodic-software
Audit MCP server configurations for quality, compliance, and security. Use to validate .mcp.json files and server setups.
competitor-scan
WellApp-ai
Research best-in-class products using Browser MCP and WebSearch
code-review
breaking-brake
Analyze PR diffs and generate review comments from code quality, security, and performance perspectives. Use for code reviews, quality checks, and security analysis.
critical-interval-security-checker
ArabelaTso
Analyzes code to identify security-critical time intervals and timing vulnerabilities in authentication, authorization, and time-sensitive security operations. Use this skill when reviewing code for proper timeout enforcement, token expiration, session management, rate limiting, password reset validity, or any time-sensitive security mechanism. Detects missing expiration checks, excessive timeout values, lack of rate limiting, client-side only validation, hardcoded timeouts, and timing attack vulnerabilities. Triggers when users ask to check security timeouts, verify token expiration handling, audit session timeout implementation, review rate limiting, or analyze time-based security controls.
agent-skills-creator
theneoai
Agent Skills 全生命周期工程化创建与管理器。严格遵循 agentskills.io 开放标准。 核心能力：创建标准化 Skill、多轮评估、多轮训练与迭代优化、多 Agent 协作模式（并行、层次、辩论、Crew）、质量体系建设、CI/CD 流水线生成、OWASP AST10 安全审查、MCP 集成、团队 Skill 仓库治理与自迭代。 当用户要求"创建 Skill""评估/优化 Skill""多轮训练""多 Agent 协作""建立质量标准""生成 CI/CD""安全审查""管理 Skill 工程体系"时触发。 不用于具体业务任务、普通提示词工程或非 Skill 相关操作。
iac-reviewer
proflead
Review infrastructure-as-code changes for safety and correctness. Use when a mid-level developer needs a second look on IaC.
hooks-eval
athola
'Use this skill BEFORE deploying hooks to production. Use when auditing
bloat-detector
athola
'Detect codebase bloat through progressive analysis: dead code, duplication,
skills-eval
athola
Evaluate and improve Claude skill quality through auditing. Use when
input-validation
Hack23
Implement comprehensive input validation to prevent XSS, SQL injection, and command injection attacks with sanitization strategies
compliance-framework-alignment
Hack23
Cross-framework compliance alignment and control mapping between ISO 27001, NIST CSF, CIS Controls, and GDPR
compliance-frameworks
Hack23
Multi-framework compliance (ISO 27001, NIST CSF, CIS Controls, GDPR, NIS2, EU CRA, SOC 2), control mapping
security-by-design
Hack23
Threat modeling before coding, STRIDE methodology, defense in depth, security controls in SDLC
cis-controls
Hack23
Implement CIS Controls v8 critical security controls for effective cyber defense in CIA platform
hack23-information-security-policy
Hack23
Hack23 Information Security Policy integration for SDLC — developer-facing mapping of ISP requirements to daily engineering activities, tooling, and evidence
hack23-isms-compliance
Hack23
Hack23 ISMS organization-wide compliance requirements, policy enforcement, audit preparation
security-documentation
Hack23
Maintain comprehensive security documentation including SECURITY_ARCHITECTURE.md, THREAT_MODEL.md per Hack23 ISMS standards
nist-csf-mapping
Hack23
Map CIA platform security controls to NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover
iso-27001-controls
Hack23
Verify implementation of ISO 27001:2022 information security controls across CIA platform development and operations
threat-modeling
Hack23
Conduct systematic threat modeling using STRIDE framework, attack trees, and security architecture analysis for CIA platform
secure-development-lifecycle
Hack23
Secure SDLC phases, security requirements, secure coding practices, and security testing integration for the CIA platform