安全

regula

kuzivaai

AI governance risk indication for Claude Code. Detects patterns that correlate with EU AI Act risk tiers, blocks prohibited practices, logs to hash-chained audit trail. Triggers on: AI/ML libraries, model files, LLM API calls, biometric processing, automated decisions. Also when the user mentions compliance, governance, AI Act, risk assessment, or audit.

sonarcloud-analysis

harshanandak

Pull issues, metrics, quality gates, and analysis data from SonarCloud. Use when checking code quality, security vulnerabilities, test coverage, technical debt, or CI/CD quality gates.

astro-security

Soborbo

Security patterns for Astro lead generation websites on Cloudflare. Forms, headers, bot protection, GDPR. Use for any production lead gen site.

supabase-report-compare

yoanbernabeu

Compare two security audit reports to track remediation progress and identify new vulnerabilities.

supabase-pentest

yoanbernabeu

Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.

supabase-report

yoanbernabeu

Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.

supabase-audit-functions

yoanbernabeu

Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.

vulnerability-scan

ymd38

Run an offensive security audit (OWASP-based) using Semgrep and produce a read-only vulnerability report. Use before committing code to detect Broken Access Control, Injection (SQL/NoSQL/OS/Template), Frontend Security issues (XSS/CSP/HSTS), SSRF, and hardcoded secrets or PII exposure. Triggers on requests like "security scan", "vulnerability check", "audit security", "find vulnerabilities", "/vulnerability-scan", or when asked for an offensive security review of the codebase. Does NOT modify any code — read-only inspection only.

Project Scanner Workflow

KhaiHuynhVN

production-ready

adamos486

Use when preparing any project for production deployment, performing security audits, or release preparation. Triggers on "make production ready", "security audit", "prepare for release", "hardening", "pre-deployment checklist".

security

Tyler-R-Kendrick

Use when addressing cross-cutting security concerns that apply to all languages, frameworks, and platforms. Covers OWASP standards, threat modeling, authentication, cryptography, supply chain security, and AI security. USE FOR: application security strategy, security architecture, choosing security controls, OWASP compliance, security tool selection, secure development lifecycle DO NOT USE FOR: specific language security implementations (use language-specific skills), infrastructure hardening (use iac skills), network security appliance configuration

supabase-audit-authenticated

yoanbernabeu

Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.

supabase-audit-realtime

yoanbernabeu

Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.

ideaverse-maintenance

mrfelton

Keep Ideaverse vaults healthy through audits, diagnostics, and maintenance workflows. Use when running vault diagnostics, detecting link rot, identifying orphan notes, finding MOC bloat, suggesting archival candidates, validating frontmatter, or generating vault health reports. Triggers on requests like "audit my vault", "find broken links", "check vault health", "what needs archiving", "find orphan notes", or "run maintenance".

solidity-security

0xlayerghost

"[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers private key handling, access control, reentrancy prevention, gas safety, and pre-audit checklists. Trigger: any task involving creating, editing, or reviewing .sol source files."

smart-contract-audit

greatpie

Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology. Use when asked to audit a smart contract repo from a URL or local path, auto-prepare the environment, find high-severity loss-of-funds vulnerabilities, validate exploitability, propose safe fixes, and deliver a structured report with exact code references.

Python Backend Architecture Review

rknall

"Comprehensive design architecture review for Python backend applications. Use this skill when users ask you to review, analyze, or provide feedback on backend architecture designs, system design documents, or Python application architecture. Covers scalability, security, performance, database design, API design, microservices patterns, deployment architecture, and best practices."

security

kcns008

Security Agent (Shield) — handles Pod Security Standards, RBAC audits, NetworkPolicy enforcement, secrets management (Vault), image scanning (Trivy), policy enforcement (Kyverno/OPA), CIS benchmarks, and compliance for Kubernetes and OpenShift clusters.

Security Specialist

udapy

Auditing for unsafe code and secrets.

artifacts

kcns008

Artifact Agent (Cache) — handles container registry management, artifact promotion between environments, vulnerability scanning (Trivy/Grype), SBOM generation (Syft), image signing (Cosign), retention policies, and CI/CD integration for Kubernetes and OpenShift supply chain security.

frontend-design-fix

matteocervelli

Fix generic frontend designs by applying aesthetic upgrades across the 5 design dimensions

Agent Router

udapy

Analyzing user intent and delegating tasks.

supabase-detect

yoanbernabeu

Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.

supabase-audit-buckets-list

yoanbernabeu

List all storage buckets and their configuration to identify the storage attack surface.