安全
安全扫描与漏洞检测
kubernetes-security-policies
NickCrew
Kubernetes security policies, RBAC, and Pod Security Standards for hardened cluster deployments. Use when implementing cluster security, defining network policies, or enforcing security compliance in Kubernetes environments.
security-review
joaquimscosta
Security-focused code review identifying high-confidence exploitable vulnerabilities with two-axis severity/confidence scoring, OWASP 2025 alignment, and false positive filtering. Use when user runs /security-review, /review:security-review, requests a "security review", "security audit", "vulnerability scan", or mentions "find vulnerabilities", "check for exploits".
spring-boot-testing
joaquimscosta
Spring Boot 4 testing strategies and patterns. Use when writing unit tests, slice tests (@WebMvcTest, @DataJpaTest), integration tests, Testcontainers with @ServiceConnection, security testing (@WithMockUser, JWT), or Modulith event testing with Scenario API. Covers the critical @MockitoBean migration from @MockBean.
spring-boot-scanner
joaquimscosta
Smart code scanner that detects Spring Boot patterns and routes to appropriate skills. Use when editing Java or Kotlin files in Spring Boot projects, working with pom.xml/build.gradle containing spring-boot-starter, or when context suggests Spring Boot development. Detects annotations (@RestController, @Entity, @EnableWebSecurity, @SpringBootTest) to determine relevant skills and provides contextual guidance. Uses progressive automation - auto-invokes for low-risk patterns (web-api, data, DDD), confirms before loading high-risk skills (security, testing, verify).
spring-boot-security
joaquimscosta
Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.
code-review
odyssey4me
Review PRs, MRs, and Gerrit changes with focus on security, maintainability, and architectural fit. Leverages github, gitlab, or gerrit skills based on repository context.
defectdojo
julianobarbosa
Guide for implementing DefectDojo - an open-source DevSecOps, ASPM, and vulnerability management platform. Use when querying vulnerabilities, managing findings, configuring CI/CD pipeline imports, or working with security scan data. Includes MCP tools for direct API interaction.
discover-infrastructure
rand
Automatically discover infrastructure and DevOps skills when working with Terraform, IaC, infrastructure as code, cloud platforms, Cloudflare Workers, or cost optimization. Activates for infrastructure development tasks.
ci-cd
ahmedasmar
CI/CD pipeline design, optimization, DevSecOps security scanning, and troubleshooting. Use for creating workflows, debugging pipeline failures, implementing SAST/DAST/SCA, optimizing build performance, implementing caching strategies, setting up deployments, securing pipelines with OIDC/secrets management, and troubleshooting common issues across GitHub Actions, GitLab CI, and other platforms.
discover-ebpf
rand
Automatically discover eBPF and kernel skills when working with eBPF, kernel tracing, XDP, kprobes, BPF, Linux kernel, or network filtering. Activates for eBPF development tasks.
discover-cryptography
rand
Automatically discover cryptography skills when working with encryption, TLS, certificates, PKI, and security
discover-containers
rand
Automatically discover container skills when working with Docker, Dockerfile optimization, docker-compose, container networking, container security, container registries, or Kubernetes. Activates for containerization and orchestration tasks.
discover-collaboration
rand
Automatically discover collaboration and teamwork skills when working with code review, pair programming, GitHub, pull requests, team workflows, or documentation. Activates for collaboration development tasks.
discover-cloud
rand
Automatically discover cloud computing and serverless skills when working with cloud. Activates for cloud development tasks.
quality-assurance
JochenYang
Comprehensive code quality assurance covering code review, testing strategies, and security auditing. Identifies bugs, vulnerabilities, performance issues, and maintainability problems. Implements unit/integration/E2E testing and provides actionable recommendations following OWASP and industry best practices.
skills-audit
JochenYang
List all installed skills with line counts and analyze for improvement opportunities. Use when user wants to review, optimize, or clean up their skill collection.
scv-scan
kadenzipfel
Systematically audit Solidity smart contract codebases for security vulnerabilities using a 4-phase approach - load a vulnerability cheatsheet, sweep code with grep and semantic analysis, deep-validate candidates against reference files, and output a severity-ranked findings
codebase-research
alchemiststudiosDOTai
This skill should be used when mapping or researching a codebase to understand its structure, patterns, and architecture. Use when the user asks to "map the codebase", "research how X works", "find all Y patterns", or needs to understand code organization. Produces factual structural maps in memory-bank/research/—no suggestions, no recommendations, just what exists. Uses ast-grep for structural pattern matching.
code-audit
3stoneBrother
Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning, penetration testing preparation, or code review for security issues. Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust. Includes 143 mandatory detection items across all languages with language-specific checklists. Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection, authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android). WooYun integration adds: statistical-driven parameter priority, bypass techniques library, logic vulnerability patterns, and real-case references. v1.0: Initial public release with Docker deployment verification framework.
secops-engineer
olehsvyrydov
Senior Security Engineer with 12+ years application security experience. Use when implementing authentication/authorization, configuring JWT/OAuth2, conducting security reviews, implementing rate limiting, ensuring GDPR compliance, or performing security scanning.
reviewer
olehsvyrydov
Rev - Senior Full-Stack Code Reviewer with 12+ years experience in Java/Kotlin and TypeScript/React. Use when reviewing code quality, checking security vulnerabilities, validating style compliance, running static analysis tools, or ensuring test coverage. Also responds to 'Rev' or /rev command.
Technology Assessment
zircote
This skill should be used when the user asks to "assess technology", "technology evaluation", "tech stack analysis", "technical feasibility", "technology trends", "build vs buy", "technology roadmap", "architecture assessment", or needs guidance on evaluating technologies, technical due diligence, or technology strategy decisions.
red-teaming
rfxlamia
Comprehensive red teaming methodology for both cybersecurity and AI/LLM systems. Use when conducting adversary emulation, vulnerability assessment, attack simulation, or security validation. Trigger on requests for penetration testing, threat modeling, security audits, MITRE ATT&CK operations, LLM safety testing, prompt injection attacks, or compliance validation (OWASP, NIST, TIBER, DORA, EU AI Act). Apply when users ask to "test like an attacker", "red team our system", "validate security posture", "assess LLM vulnerabilities", or "simulate cyber attacks". Includes planning frameworks, execution strategies, reporting templates, and progressive references to specialized attack techniques and tools.
auto-paper
u9401066
全自動論文撰寫 + 閉環自我改進系統。 LOAD THIS SKILL WHEN: 全自動寫論文、auto write、自動撰寫、幫我寫完整篇、autopilot、從頭到尾、一鍵寫論文 CAPABILITIES: 編排所有研究 Skills + 3 層 Audit Hooks + Meta-Learning 自我改進