安全
安全扫描与漏洞检测
plan
Terryc21
Epic decomposition into trackable, right-sized tasks. Audit-aware mode ingests codebase-audit/tech-reportcard reports. Standalone mode plans features, bugs, and refactors from scratch.
enhanced-commands
Terryc21
Enhanced list of custom Claude commands for iOS and macOS Swift projects with examples and output locations.
security-audit
Terryc21
'Automated security vulnerability scan for iOS/macOS apps. Covers secrets, storage, network, input validation, privacy manifest, and file protection. Triggers: "security audit", "check for secrets", "security scan".'
workflow-audit
Terryc21
Systematic UI workflow auditing for SwiftUI applications. Discovers entry points, traces user flows, detects dead ends and broken promises, evaluates from user perspective.
exhaustive-systems-analysis
petekp
Perform comprehensive, deep analysis of a system and its subsystems to identify bugs, race conditions, stale documentation, dead code, and correctness issues. Use when asked to "audit this system", "exhaustive analysis of X", "analyze for correctness", "root out issues in...", "deep dive into...", "verify this code is correct", "find bugs in...", or when reviewing agent-written code for production readiness. Automatically decomposes systems into subsystems, applies appropriate analysis checklists, and produces structured findings with severity classification.
managing-agents
mbruhler
Manages temporary and defined agents including creation, promotion, cleanup, and namespacing. Use when user creates custom agents, asks about agent lifecycle, temp agents, or agent management.
designing-syntax
mbruhler
Design custom syntax elements with reuse-first approach for workflow orchestration. Use when user needs custom operators, checkpoints, or syntax patterns not available in core syntax.
role-architect:threat-modeling
rnavarych
Threat modeling expertise including STRIDE methodology, attack trees, trust boundary identification, data flow analysis, risk assessment, mitigation prioritization, and security architecture review.
role-aqa:security-testing
rnavarych
Security test automation with OWASP ZAP (active/passive scanning), Burp Suite, SAST (SonarQube, CodeQL), DAST, dependency scanning (Snyk, Dependabot, npm audit), penetration test planning, vulnerability management, and threat modeling integration. Use when implementing security testing or evaluating application security posture.
role-architect:aws-architect
rnavarych
AWS architecture expertise including Well-Architected Framework, account strategy, VPC and networking design, compute and serverless patterns, data architecture, security architecture, and cost optimization strategies. Use proactively when designing systems on AWS, evaluating AWS services, planning AWS landing zones, or architecting for AWS-specific capabilities.
tool-ast-grep-rules
Heyvhuang
'Write AST-based code search and rewrite rules using ast-grep YAML. Create linting rules, code modernizations, and API migrations with auto-fix. Use when the user mentions ast-grep, tree-sitter patterns, code search rules, lint rules with YAML, AST matching, or code refactoring patterns.'
mcp-cloudflare
Heyvhuang
"Manage Workers/KV/R2/D1/Hyperdrive via Cloudflare MCP, perform observability/build troubleshooting/audit/container sandbox operations. Triggers: worker/KV/R2/D1/logs/build/deploy/screenshot/audit/sandbox. Three permission tiers: Diagnose (read-only), Change (write requires confirmation), Super Admin (isolated environment). Write operations must follow read-first, user confirmation, post-execution verification."
cloudflare
Heyvhuang
"Infrastructure operations for Cloudflare: Workers, KV, R2, D1, Hyperdrive, observability, builds, audit logs. Triggers: worker/KV/R2/D1/logs/build/deploy/audit. Three permission tiers: Diagnose (read-only), Change (write requires confirmation), Super Admin (isolated environment). Write operations follow read-first, confirm, execute, verify pattern. MCP is optional — works with Wrangler CLI/Dashboard too."
ljg-xray-book
lijigang
Deep structure extraction from books using the Epiplexity principle - maximizing computational investment to extract maximum learnable structure from any book.
react-doctor
brianlovin
Diagnose and fix React codebase health issues. Use when reviewing React code, fixing performance problems, auditing security, or improving code quality.
security-audit
89jobrien
Security auditing and vulnerability assessment specialist. Use when conducting
dependency-management
89jobrien
Dependency management specialist. Use when updating dependencies, scanning
cloud-infrastructure
89jobrien
Cloud infrastructure design and deployment patterns for AWS, Azure, and
agoragentic-buzz-signed-workspace-evidence
rhein1
Convert exported Block Buzz / Nostr workspace events into bounded Agoragentic evidence. Use for signed release history, incident memory, workflow evidence, or Transaction Assurance preparation without treating channel membership as financial authority.
safe-exec
OTTTTTO
Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agents need to execute shell commands that may be dangerous (rm -rf, dd, fork bombs, system directory modifications) or require human oversight. Provides multi-level risk assessment (CRITICAL/HIGH/MEDIUM/LOW), in-session notifications, pending request management, and non-interactive environment support for agent automation.
openclaw-security
AtlasPA
"Unified security suite for agent workspaces. Installs, configures, and orchestrates all 11 OpenClaw security tools in one command — integrity, secrets, permissions, network, audit trail, signing, supply chain, credentials, injection defense, compliance, and incident response."
what-not-to-do-as-product-manager
flpbalada
Anti-patterns and mistakes to avoid as a product manager. Use when evaluating
trust-psychology
flpbalada
Build trust signals that reduce perceived risk and enable user action. Use
structured-analysis
ilude
Apply structured analytical frameworks to any artifact (prompts, systems, documents, code). 12 frameworks in 3 tiers: Core (4 universal), Auto-Invoke (specialized), On-Demand (advanced). Includes adversarial-review for finding blind spots and post-plan validation workflow.