安全
安全扫描与漏洞检测
security-review
wcygan
Run a targeted security audit on specified files or modules. Uses OWASP-informed checks, dependency vulnerability scanning, and auth/input validation review. Use for security audits, vulnerability checks, or before deploying sensitive code. Keywords: security, audit, vulnerability, OWASP, CVE, secrets, injection, XSS, auth, authentication, authorization
arch-review
wcygan
RFC-style review of major technical decisions using a 5-agent debate team. Spawns tech-lead, security-auditor, performance-analyst, reliability-engineer, and devils-advocate for independent analysis followed by structured discussion. Produces decision document with pros/cons, dissenting opinions, and recommendation. Use for architecture decisions, technology selection, major refactors, design reviews. Keywords: architecture, RFC, design review, technical decision, architecture review, design decision, major change
review-security
nesnilnehc
"Review code for security: injection, sensitive data, authentication and authorization, dependencies and CVEs, configuration and secrets, and crypto. Cognitive-only atomic skill; output is a findings list."
00-andruia-consultant
ranbot-ai
Arquitecto de Soluciones Principal y Consultor Tecnológico de Andru.ia. Diagnostica y traza la hoja de ruta óptima para proyectos de IA en español.
20-andruia-niche-intelligence
ranbot-ai
Estratega de Inteligencia de Dominio de Andru.ia. Analiza el nicho específico de un proyecto para inyectar conocimientos, regulaciones y estándares únicos del sector. Actívalo tras definir el nich
read-doc
TokenRollAI
"Leverage the llmdoc documentation system to quickly understand the project architecture, code details, and key concepts without reading source code directly."
claude-cli-agent
richfrem
Claude CLI sub-agent system for persona-based analysis. Use when piping large contexts to Anthropic models for security audits, architecture reviews, QA analysis, or any specialized analysis requiring a fresh model context.
azure-pipelines-validator
akin-ozer
Comprehensive toolkit for validating, linting, and securing Azure DevOps Pipeline configurations.
Agent Security Audit
DmitrL-dev
Проверка безопасности AI-агентов по OWASP Agentic Top 10 2026
find-bugs
derKlinke
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
security-review
dstiliadis
Mandatory security review gate for all code and architecture plans. Triggers on ANY plan, implementation, code generation, architecture design, API design, infrastructure change, deployment configuration, or system modification. Before executing or finalizing ANY plan that produces code, configuration, or infrastructure, run the full security review workflow: threat model, review against security checklist, emulate attack paths agentically, mitigate findings, and pen-test again before delivery. This skill acts as a security-conscious intern with CompTIA Security+ knowledge who reviews every output for authentication, authorization, encryption, logging, input validation, segmentation, privacy, and common vulnerability anti-patterns. Also triggers when the user asks to "review security", "threat model", "harden", "pen test", or "check for vulnerabilities".
security-audit
digipulse-engineering
Detect security vulnerabilities and governance violations across delivered code, configurations, and deployed environments. Activate after implementation or periodically as a governance check.
delivery-readiness-audit
digipulse-engineering
Spot-check AC internal consistency and scan for pending revisions on delivery-ready stories. Activated by /gaai-status --audit as Section 5. Complements the standard status checks with depth checks that standard status skips for speed.
codebase-scan
digipulse-engineering
Create a high-level map of the project structure and identify architectural pillars, entry points, and module boundaries. Activate at Bootstrap initialization or before architecture extraction.
dockerfile-validator
akin-ozer
Comprehensive toolkit for validating, linting, and securing Dockerfiles. Use this skill when validating Dockerfile syntax, checking security best practices, optimizing image builds. Applies to all Dockerfile variants (Dockerfile, Dockerfile.prod, Dockerfile.dev, etc.).
terraform-validator
akin-ozer
Comprehensive toolkit for validating, linting, testing, and automating Terraform configurations and HCL files. Use this skill when working with Terraform files (.tf, .tfvars), validating infrastructure-as-code, debugging Terraform configurations, performing dry-run testing with terraform plan, or working with custom providers and modules.
hm-coding-philosophy
humanmade
Human Made engineering principles and code quality standards. Apply when writing code, reviewing code, planning implementations, or discussing architecture. Covers code quality priorities, simplicity over complexity, and avoiding over-engineering.
convex-security-audit
waynesutton
Deep security review patterns for authorization logic, data access boundaries, action isolation, rate limiting, and protecting sensitive operations
convex
waynesutton
Umbrella skill for all Convex development patterns. Routes to specific skills like convex-functions, convex-realtime, convex-agents, etc.
convex-security-check
waynesutton
Quick security audit checklist covering authentication, function exposure, argument validation, row-level access control, and environment variable handling
discover-ebpf
rand
Automatically discover eBPF and kernel skills when working with eBPF, kernel tracing, XDP, kprobes, BPF, Linux kernel, or network filtering. Activates for eBPF development tasks.
discover-collaboration
rand
Automatically discover collaboration and teamwork skills when working with code review, pair programming, GitHub, pull requests, team workflows, or documentation. Activates for collaboration development tasks.
discover-cloud
rand
Automatically discover cloud computing and serverless skills when working with cloud. Activates for cloud development tasks.
reins
pegasi-ai
Use this skill whenever security, policies, governance, guardrails, compliance, or safety are relevant — including blocked commands, audit trails, dangerous operations, deletions, file modifications, shell commands, MCP access, API calls, network requests, credentials, or any action that could be irreversible or destructive. Reins installs deterministic PreToolUse/PostToolUse hooks and connects to Watchtower (app.pegasi.ai) for centralized governance.