安全
安全扫描与漏洞检测
dlc
rube-de
Dev Life Cycle quality gates: run security scans, code quality checks, performance analysis, test coverage, and PR review compliance. Routes to domain-specific sub-skills or runs all checks in sequence.
belai-patcher
Vulnetix
Remediates one vulnerability finding on its own branch: finds the resolution path, picks the lowest fixed version, applies the narrowest per-ecosystem mechanism (lockfile update, parent bump, override, replacement, code fix), re-scans, and files an honest verdict. Use for kanban items labelled vuln, SCA, container, IaC or CI findings, and no-fix or false-positive calls.
update
rube-de
Audit open GitHub issues for staleness, orphaned blockers, missing labels, codebase drift, and already-implemented features. Categorizes issues into close-candidates, update-needed, needs-triage, stale, and healthy. Supports bulk and individual remediation via interactive approval. Triggers: audit issues, clean up issues, update stale issues, issue hygiene, backlog cleanup, prune issues.
supabase-audit-rls
yoanbernabeu
Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.
supabase-detect
yoanbernabeu
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
supabase-audit-buckets-list
yoanbernabeu
List all storage buckets and their configuration to identify the storage attack surface.
supabase-pentest
yoanbernabeu
Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.
supabase-help
yoanbernabeu
Quick reference for all Supabase security audit skills with usage examples and command overview.
supabase-report
yoanbernabeu
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
supabase-audit-tables-read
yoanbernabeu
Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.
supabase-audit-rpc
yoanbernabeu
List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.
supabase-audit-functions
yoanbernabeu
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
supabase-extract-anon-key
yoanbernabeu
Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.
bug-reaper
shaniidev
"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth bypass, RCE, SSTI, LFI, XXE, CORS, CSRF, prototype pollution, subdomain takeover, HTTP smuggling, open redirect, API/GraphQL bugs; auditing locally downloaded GitHub repos or source code (white-box/source code review); writing platform-specific reports. Trigger on: 'pentest', 'find bugs', 'security audit', 'bug bounty', 'find vulnerabilities', 'source code review', 'audit this repo', 'review repo', 'white-box', 'local repo', vulnerability class names, or program/target names. Reports only real, confirmed medium+ severity bugs that pass real triage."
near-contract-audit
near
Comprehensive security audit skill for NEAR Protocol smart contracts written in Rust. Use when auditing NEAR contracts, reviewing security vulnerabilities, or analyzing contract code for issues like reentrancy, unhandled promises, unsafe math, access control flaws, and callback security.
backend-dev
julianromli
Comprehensive backend development workflow that orchestrates expert analysis, architecture design, implementation, and deployment using the integrated toolset. Handles everything from API design and database architecture to security implementation and DevOps automation.
vulnerability-exploitation
Eitanvinokur12345
"Penetration testing, security research, malicious attacks."
audit-review
KingInYellows
Run 1-3 parallel quick-audit passes (code quality, security, error handling) over a diff and gate on findings. Use when smart-submit or gt-amend need to audit uncommitted changes before committing.
audit-review
KingInYellows
'Run 1-3 parallel quick-audit passes (code quality, security, error handling) over a diff and gate on findings. Use when smart-submit or gt-amend need to audit uncommitted changes before committing.'
corporate-network-attack-simulation
Eitanvinokur12345
"Cybersecurity assessment, red teaming, vulnerability analysis"
technical-debt-manager-php-laravel
LaravelDaily
Expert technical debt analyst for PHP/Laravel code health, maintainability, and strategic refactoring planning. Use PROACTIVELY when a Laravel codebase shows complexity growth, when planning sprints, or when prioritizing engineering work.
typo3-security
dirnbauer
Security hardening checklist and best practices for TYPO3 v13/v14 installations, covering configuration, file permissions, and common vulnerabilities. Use when working with security, hardening, permissions, authentication, vulnerabilities.
appsec-expert
martinholovsky
"Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments."
Encryption Skill
martinholovsky
Encryption done wrong is worse than no encryption - it provides false confidence.