安全
安全扫描与漏洞检测
decision-support
jmagly
Trade-off catalog: docs/common-tradeoffs.md
security-assessment
jmagly
Security templates: templates/security/
django-expert
vintasoftware
Expert Django backend development guidance. Use when creating Django models, views, serializers, or APIs; debugging ORM queries or migrations; optimizing database performance; implementing authentication; writing tests; or working with Django REST Framework. Follows Django best practices and modern patterns.
don-norman-principles-audit
mastepanoski
Evaluate UX/UI using Don Norman's 7 fundamental design principles from The Design of Everyday Things. Audit discoverability, affordances, signifiers, feedback, mapping, constraints and conceptual models.
atomise
NeverSight
"Atom of Thoughts (AoT) reasoning - decompose complex problems into atomic units with confidence tracking and backtracking. For genuinely complex reasoning, not everyday questions. Triggers on: atomise, complex reasoning, decompose problem, structured thinking, verify hypothesis."
cleanup
go-to-k
Detect and delete leftover AWS resources from cdkd integration tests. Only targets resources matching known cdkd stack name patterns.
regula
kuzivaai
AI governance risk indication for Claude Code. Detects patterns that correlate with EU AI Act risk tiers, blocks prohibited practices, logs to hash-chained audit trail. Triggers on: AI/ML libraries, model files, LLM API calls, biometric processing, automated decisions. Also when the user mentions compliance, governance, AI Act, risk assessment, or audit.
sonarcloud-analysis
harshanandak
Pull issues, metrics, quality gates, and analysis data from SonarCloud. Use when checking code quality, security vulnerabilities, test coverage, technical debt, or CI/CD quality gates.
aws-cost-operations
zxkane
This skill provides AWS cost optimization, monitoring, and operational best practices with integrated MCP servers for billing analysis, cost estimation, observability, and security assessment.
static-analysis
mohitmishra786
Static analysis skill for C/C++ codebases. Use when hardening code quality, triaging noisy builds, running clang-tidy, cppcheck, or scan-build, interpreting check categories, suppressing false positives, or integrating static analysis into CI. Activates on queries about clang-tidy checks, cppcheck, scan-build, compile_commands.json, code hardening, or static analysis warnings.
llvm-learning
gmh5225
Comprehensive learning resources and tutorials for LLVM, Clang, and compiler development. Use this skill when helping users learn LLVM internals, find educational resources, or understand compiler concepts.
llvm-security
gmh5225
Expertise in LLVM security features including sanitizers, hardening techniques, exploit mitigations, and secure compilation. Use this skill when implementing security-focused compiler features, analyzing vulnerabilities, or hardening applications.
epic-security
epicweb-dev
Guide on security practices including CSP, rate limiting, and session security
DevSecOps Expert - Shift-Left Security
anton-abyzov
DevSecOps expert for shift-left security including container scanning, SAST/DAST, dependency scanning, secret detection, SBOM generation, supply chain security (SLSA/Sigstore), Kubernetes security policies, compliance-as-code, and secure CI/CD pipeline design.
Code Grill Expert
anton-abyzov
Critical code review and quality interrogation before increment completion. Use when finishing a feature, before /sw:done, or when saying "grill the code", "review my work", "critique implementation".
asking-questions
oaustegard
Guidance for asking clarifying questions when user requests are ambiguous, have multiple valid approaches, or require critical decisions. Use when implementation choices exist that could significantly affect outcomes.
wooyun-legacy
trailofbits
Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.
Security Principles
exceptionless
Security best practices for the Exceptionless codebase. Secrets management, input validation, secure defaults, and avoiding common vulnerabilities. Keywords: security, secrets, encryption, PII, logging, input validation, secure defaults, environment variables, OWASP, cryptography
security-audit
ils15
"Security audit and vulnerability detection - OWASP Top 10, input validation, injection attacks"
non-repudiation-privacy
florianbuetow
This skill should be used when the user asks to "check for non-repudiation privacy risks", "analyze excessive audit logging", "find privacy issues related to accountability", "check for forced identity linking", or mentions "non-repudiation" in a privacy context. Maps to LINDDUN category N. This is the INVERSE of STRIDE repudiation -- here too much proof is the threat.
harden
florianbuetow
This skill should be used when the user asks to "harden code", "security hardening", "improve security posture", "add security headers", "tighten security", "defensive coding suggestions", or "proactive security improvements". Also triggers when the user asks about CSP, CORS hardening, rate limiting, input validation improvements, security logging, or defense-in-depth measures.
pasta-attack-sim
florianbuetow
This skill should be used when the user asks to "simulate attacks", "build attack trees", "model exploit chains", "score exploitability", or is running PASTA stage 6. Also triggers when the user asks about attack scenarios, red team simulation, DREAD scoring, or detection gap analysis in a threat modeling context. Part of the PASTA threat modeling methodology (Stage 6 of 7).
learn
florianbuetow
This skill should be used when the user asks to "learn about security", "teach me OWASP", "security tutorial", "learn threat modeling", or invokes /appsec:learn. Interactive guided walkthrough using your codebase as teaching material.
outdated-deps
florianbuetow
This skill should be used when the user asks to "check for vulnerable dependencies", "audit dependencies", "find outdated packages", "scan for CVEs", "check for typosquatting", or mentions "vulnerable components", "outdated dependencies", or "supply chain" in a security context. Maps to OWASP Top 10 2021 A06: Vulnerable and Outdated Components.