安全
安全扫描与漏洞检测
kubernetes
bobmatnyc
"Kubernetes operations playbook for deploying services: core objects, probes, resource sizing, safe rollouts, and fast kubectl debugging"
security-headers
CuriousLearner
Validate and implement HTTP security headers to protect web applications.
dependency-auditor
CuriousLearner
Automated security auditing of project dependencies to identify known vulnerabilities.
meeting-notes
CuriousLearner
Convert meeting discussions into clear, actionable notes with tasks, decisions, and follow-ups fo...
accelint-ts-performance
gohypergiant
"Systematic JavaScript/TypeScript performance audit and optimization using V8 profiling and runtime patterns. Use when (1) Users say 'optimize performance', 'audit performance', 'this is slow', 'reduce allocations', 'improve speed', 'check performance', (2) Analyzing code for performance anti-patterns (O(n²) complexity, excessive allocations, I/O blocking, template literal waste), (3) Optimizing functions regardless of current usage context - utilities, formatters, parsers are often called in hot paths even when they appear simple, (4) Fixing V8 deoptimization (monomorphic/polymorphic issues, inline caching). Audits ALL code for anti-patterns and reports findings with expected gains. Covers loops, caching, batching, memory locality, algorithmic complexity fixes with ❌/✅ patterns."
accelint-security-best-practices
gohypergiant
"Comprehensive security audit and vulnerability detection for JavaScript/TypeScript applications following OWASP Top 10. Use when (1) Users say 'audit security', 'check for vulnerabilities', 'security review', 'implement authentication', 'secure this code', (2) Adding authentication, API endpoints, file uploads, or handling user input, (3) Working with secrets, credentials, or sensitive data, (4) Implementing payment features or blockchain integrations, (5) Conducting pre-deployment security checks. Audits for: hardcoded secrets, injection vulnerabilities, XSS/CSRF, broken access control, insecure authentication, rate limiting, dependency vulnerabilities, sensitive data exposure."
accelint-ts-audit-all
gohypergiant
Comprehensive TypeScript file audit system. Command-only skill (no natural triggers). Accepts file or directory path to systematically audit through accelint-ts-testing, accelint-ts-best-practices, accelint-ts-performance, and accelint-ts-documentation skills. Maintains progress tracking across sessions with interactive change approval. Uses isolated git worktrees to enable parallel audits without conflicts.
skill-security-analyzer
auldsyababua
Comprehensive security risk analysis for Claude skills. Use when asked to analyze security risks, review security stance, audit skills for vulnerabilities, check security before deployment, or evaluate safety of skill files. Triggers include "analyze security," "security risks," "security audit," "security review," "is this skill safe," or "check for vulnerabilities."
backend-development
vibery-studio
Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.
audit-content
TakaGoto
"Audit academy materials for outdated references, deprecated patterns, and stale content"
backend-development
duongductrong
Build robust backend systems with modern technologies (Node.js, Python, Go, Rust), frameworks (NestJS, FastAPI, Django), databases (PostgreSQL, MongoDB, Redis), APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), testing strategies, security best practices (OWASP Top 10), performance optimization, scalability patterns (microservices, caching, sharding), DevOps practices (Docker, Kubernetes, CI/CD), and monitoring. Use when designing APIs, implementing authentication, optimizing database queries, setting up CI/CD pipelines, handling security vulnerabilities, building microservices, or developing production-ready backend systems.
php-security
peixotorms
Use when handling user input, database queries, file operations, authentication, sessions, or any security-sensitive PHP code. Covers SQL injection prevention with prepared statements, PDO parameterized queries, XSS with htmlspecialchars, CSRF tokens, input validation (filter_var, FILTER_VALIDATE_*, FILTER_SANITIZE_*), output escaping by context, password_hash, password_verify, bcrypt, Argon2, file upload security, session management, SameSite cookies, Content-Security-Policy headers, serialization security, process execution security, error exposure, php.ini hardening (open_basedir, disable_functions, allow_url_include), OWASP Top 10 for PHP, rate limiting, brute force protection, directory traversal, path traversal, and common vulnerability patterns.
dev.can-make-public
kevinslin
Scan a repository and its git history for secrets, credentials, private keys, internal URLs, PII, and other sensitive artifacts before making it public. Use when a user asks if a repo is safe to open-source, requests a pre-publication audit, or wants to sanitize a repo for public release.
update-changelog
goncalossilva
"Update CHANGELOG.md following Keep a Changelog (https://keepachangelog.com/en/1.1.0/)"
jtbd-psychographic-research
mike-coulbourn
Provides Jobs-to-be-Done and psychographic research frameworks for brand identity work. Auto-activates during brand positioning, voice development, messaging, and strategy phases. Use when discussing target audience, customer research, JTBD, jobs to be done, four forces, push pull anxiety habit, emotional jobs, social jobs, functional jobs, limbic types, VALS segments, psychographics, or customer motivations.
Plan Audit
OmniNode-ai
Health check over plan files in docs/plans/ — verifies phase state, epic linkage, DoD completeness, ticket coverage, and staleness. Produces a PASS/WARN/FAIL report per plan.
electron-skills
llama-farm
Electron patterns for LlamaFarm Desktop. Covers main/renderer processes, IPC, security, and packaging.
opengrep
opengrep
Run Opengrep for pattern-based code search and security scanning. Use when grep is insufficient for finding code patterns that require structural understanding (function calls, data flow, nested structures). Also use for security vulnerability detection with custom YAML rules.
typescript-skills
llama-farm
Shared TypeScript best practices for Designer and Electron subsystems.
python-skills
llama-farm
Shared Python best practices for LlamaFarm. Covers patterns, async, typing, testing, error handling, and security.
aws-cloud
DauQuangThanh
Provides comprehensive AWS (Amazon Web Services) guidance including EC2, S3, RDS, Lambda, ECS/EKS, CloudFormation, API Gateway, CloudFront, cloud migration from on-premise/GCP/Azure, security configuration (IAM, KMS, Security Hub), cost optimization (Savings Plans, Reserved Instances), and multi-region deployment. Produces infrastructure as code (Terraform/CloudFormation/CDK), deployment scripts, security configurations, and architecture designs. Use when deploying to AWS, designing AWS infrastructure, migrating to AWS, configuring EC2 instances, setting up S3 buckets, managing RDS databases, deploying containers on ECS/EKS, building serverless applications, or when users mention AWS, Amazon Cloud, EC2, S3, Lambda, EKS, CloudFormation, CDK, or AWS services.
oracle-cloud
DauQuangThanh
Provides comprehensive Oracle Cloud Infrastructure (OCI) guidance including compute instances, networking (VCN, load balancers, VPN), storage (block, object, file), database services (Autonomous Database, MySQL, NoSQL), container orchestration (OKE), identity and access management (IAM), resource management, cost optimization, and infrastructure as code (Terraform OCI provider, Resource Manager). Produces infrastructure code, deployment scripts, configuration guides, and architectural diagrams. Use when designing OCI architecture, provisioning cloud resources, migrating to Oracle Cloud, implementing OCI security, setting up OCI databases, deploying containerized applications on OKE, managing OCI resources, or when users mention "Oracle Cloud", "OCI", "Autonomous Database", "VCN", "OKE", "OCI Terraform", "Resource Manager", "Oracle Cloud Infrastructure", or "OCI migration".
AutumnsGrove
"Comprehensive PDF manipulation, extraction, and generation with support for text extraction, form filling, merging, splitting, annotations, and creation. Use when working with .pdf files for: (1) Extracting text and tables, (2) Filling PDF forms, (3) Merging/splitting PDFs, (4) Creating PDFs programmatically, (5) Adding watermarks/annotations, (6) PDF metadata management"
azure-cloud
DauQuangThanh
Provides comprehensive Microsoft Azure guidance including Azure Virtual Machines, Azure Storage (Blob, Files, Disks), Azure SQL Database, Azure App Service, Azure Functions, AKS (Azure Kubernetes Service), Azure DevOps, ARM templates, Bicep, Terraform for Azure, Azure Active Directory, Azure Key Vault, Azure Monitor, cost optimization, and multi-region deployment. Produces infrastructure as code (Terraform/Bicep/ARM), deployment scripts, security configurations, and architecture designs. Use when deploying to Azure, designing Azure infrastructure, migrating to Microsoft Azure, configuring VMs, setting up Azure Storage, managing Azure SQL, working with AKS, or when users mention Azure, Microsoft Cloud, Azure Portal, ARM templates, Bicep, Azure Functions, App Service, or Azure DevOps.