安全
安全扫描与漏洞检测
aws-security-architecture
Hack23
AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment
compliance-checklist
Hack23
Unified compliance verification across ISO 27001, NIST CSF, CIS Controls, NIS2, EU CRA, GDPR, SOC 2, PCI DSS, and HIPAA for cybersecurity consulting
data-protection
Hack23
Data classification (CIA triad), GDPR privacy by design, encryption standards, data lifecycle management
mcp-gateway-security
Hack23
MCP gateway security patterns, token management, request validation, and audit logging for MCP communications
github-actions-workflows
Hack23
Create secure CI/CD workflows with GitHub Actions for Java 26/Maven/PostgreSQL builds, security scans, and deployments
information-security-strategy
Hack23
AI-enabled security excellence through transparent ISMS implementation, defense-in-depth, and strategic planning aligned with Hack23 business model
secure-development-policy
Hack23
Hack23 secure development policy enforcement, SAST/DAST integration, dependency scanning, and code signing practices
security-architecture-validation
Hack23
Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform
ai-governance
Hack23
AI governance, EU AI Act compliance, OWASP LLM security, responsible AI practices for GitHub Copilot agents
incident-response
Hack23
Security incident detection, analysis, containment, eradication, recovery, and lessons learned per NIST SP 800-61r2 and ISO 27035
vulnerability-management
Hack23
Systematic vulnerability lifecycle management with SLAs: Critical 7d, High 30d, Medium 90d, Low 180d aligned with OWASP, NIST, CIS Controls
secure-code-review
Hack23
Conduct comprehensive security code reviews using OWASP Top 10, SAST/DAST patterns, and Hack23 ISMS secure development policy
managing-imposter-syndrome
RefoundAI
Help users work through feelings of inadequacy and self-doubt. Use when someone feels like a fraud, doubts their qualifications, is anxious about being "found out," or struggling with confidence in a new or challenging role.
architecture-paradigm-cqrs-es
athola
'CQRS and Event Sourcing for auditability, read/write separation, and
threat-model-generation
Factory-AI
Generate a STRIDE-based security threat model for a repository. Use when setting up security monitoring, after architecture changes, or for security audits.
vulnerability-validation
Factory-AI
Validate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running commit-security-scan to confirm vulnerabilities.
pentest-mobile-app
jd-opensource
OWASP Mobile Top 10 security testing for Android and iOS — local storage, certificate pinning bypass, IPC abuse, and binary protections.
scv-scan
trailofbits
"Audits Solidity codebases for smart contract vulnerabilities using a four-phase workflow (cheatsheet loading, codebase sweep, deep validation, reporting) covering 36 vulnerability classes. Use when auditing Solidity contracts for security issues, performing smart contract vulnerability scans, or reviewing Solidity code for common exploit patterns."
vendor-evaluation
proflead
Evaluate third-party vendors for engineering fit. Use when a senior developer needs a structured vendor assessment.
solana-security
tenequm
Audit Solana programs (Anchor or native Rust) for security vulnerabilities. Use when reviewing smart contract security, finding exploits, analyzing attack vectors, performing security assessments, or when explicitly asked to audit, review security, check for bugs, or find vulnerabilities in Solana programs.
data-governance-check
proflead
Review data handling for privacy and retention. Use when a senior developer needs governance validation.
v4-security-foundations
Uniswap
Security-first Uniswap v4 hook development. Use when user mentions "v4 hooks", "hook security", "PoolManager", "beforeSwap", "afterSwap", or asks about V4 hook best practices, vulnerabilities, or audit requirements.
understanding-tauri-lifecycle-security
dchuk
Assists developers with understanding Tauri application lifecycle security threats spanning development, build, distribution, and runtime phases, including threat mitigation strategies and security best practices.
risk-cycle
jmagly
Escalation procedures: docs/risk-escalation.md