安全
安全扫描与漏洞检测
audit-support
luisschmitzheadline
Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.
strategic-planning
luisschmitzheadline
Analyzes the founder's business context to deliver the 3 highest-impact next moves for growth (marketing or sales). Asks up to 10 diagnostic questions when needed to uncover bottlenecks, struggles, and opportunities. Use when user needs strategic guidance, next steps, growth planning, or actionable business strategy.
belai-vuln-scout
Vulnetix
Specialist brief for the Belai vulnerability scout. Triage and prioritise findings from Vulnetix SCA, SAST, secrets, IaC and container scans in any customer repository: ground each finding in manifests, scope, reachability and exploitation evidence (KEV, EPSS), group by package and fix, then hand off at most five vuln cards with an exact fix. Use when a request asks for a vulnerability scan, advisory triage, CVE prioritisation or a fix plan.
quality-assurance
JochenYang
Comprehensive code quality assurance covering code review, testing strategies, and security auditing. Identifies bugs, vulnerabilities, performance issues, and maintainability problems. Implements unit/integration/E2E testing and provides actionable recommendations following OWASP and industry best practices.
self-serve-motion
SkeneTechnologies
When the user wants to reduce friction in the self-serve buying experience, optimize in-product checkout, remove "contact sales" gates, or design self-serve onboarding and support. Also use when the user says "frictionless," "self-service," "remove sales gates," "no-demo experience," or "friction audit." For signup flow optimization, see signup-flow-cro. For pricing page design, see pricing-strategy.
spring-boot-scanner
joaquimscosta
Smart code scanner that detects Spring Boot patterns and routes to appropriate skills. Use when editing Java or Kotlin files in Spring Boot projects, working with pom.xml/build.gradle containing spring-boot-starter, or when context suggests Spring Boot development. Detects annotations (@RestController, @Entity, @EnableWebSecurity, @SpringBootTest) to determine relevant skills and provides contextual guidance. Uses progressive automation - auto-invokes for low-risk patterns (web-api, data, DDD), confirms before loading high-risk skills (security, testing, verify).
skills-audit
JochenYang
List all installed skills with line counts and analyze for improvement opportunities. Use when user wants to review, optimize, or clean up their skill collection.
consensus-voting
rysweet
Multi-agent consensus voting with domain-weighted expertise for critical decisions requiring structured validation
computer-scientist-analyst
rysweet
Analyzes events through computer science lens using computational complexity, algorithms, data structures, systems architecture, information theory, and software engineering principles to evaluate feasibility, scalability, security. Provides insights on algorithmic efficiency, system design, computational limits, data management, and technical trade-offs. Use when: Technology evaluation, system architecture, algorithm design, scalability analysis, security assessment. Evaluates: Computational complexity, algorithmic efficiency, system architecture, scalability, data integrity, security.
n-version-workflow
rysweet
N-version programming for critical implementations - generates N independent solutions and selects the best through comparison
cybersecurity-analyst
rysweet
Analyzes events through cybersecurity lens using threat modeling, attack surface analysis, defense-in-depth, zero-trust architecture, and risk-based frameworks (CIA triad, STRIDE, MITRE ATT&CK). Provides insights on vulnerabilities, attack vectors, defense strategies, incident response, and security posture. Use when: Security incidents, vulnerability assessments, threat analysis, security architecture, compliance. Evaluates: Confidentiality, integrity, availability, threat actors, attack patterns, controls, residual risk.
salvo-cors
salvo-rs
Configure Cross-Origin Resource Sharing (CORS) and security headers. Use for APIs accessed from browsers on different domains.
malware-scan-yara
vchirrav
Run YARA rules for pattern-based malware identification. Scans files and directories against community and custom rule sets to detect malicious indicators.
sast-cargo-audit
vchirrav
Run cargo-audit and cargo-geiger on Rust code. Audits dependencies for known vulnerabilities and detects unsafe code usage for memory safety review.
sast-flawfinder
vchirrav
Run Flawfinder SAST scans on C/C++ code. Detects buffer overflows, format string vulnerabilities, race conditions, and other memory safety issues.
secret-scan-trufflehog
vchirrav
Run TruffleHog to detect secrets in git repos, filesystems, and S3 buckets. Uses verification to confirm if detected secrets are live/active.
api-security-spectral
vchirrav
Run Spectral to lint OpenAPI and AsyncAPI specs for security issues. Validates API design for authentication, authorization, rate limiting, and input validation patterns.
cloud-security-scoutsuite
vchirrav
Run ScoutSuite for multi-cloud security auditing. Collects configuration data from AWS, Azure, GCP, Oracle, and Alibaba Cloud and generates an interactive security report.
iac-scan-tfsec
vchirrav
Run tfsec (now part of Trivy) to scan Terraform code for security misconfigurations. Deep HCL analysis with support for Terraform modules, variables, and expressions.
sca-pip-audit
vchirrav
Run pip-audit for Python dependency vulnerability scanning. Checks installed packages and requirements files against the OSV and PyPI advisory databases.
dast-nuclei
vchirrav
Run Nuclei template-based vulnerability scanner. Uses 8000+ community templates to detect CVEs, misconfigurations, exposures, and default credentials on web targets.
license-scan-scancode
vchirrav
Run ScanCode Toolkit for comprehensive license and copyright detection. Identifies license types, copyright holders, and compliance obligations across codebases.
sast-brakeman
vchirrav
Run Brakeman SAST scans on Ruby on Rails applications. Detects SQL injection, XSS, mass assignment, CSRF, command injection, and other Rails-specific vulnerabilities.
tls-scan-testssl
vchirrav
Run testssl.sh to analyze TLS/SSL configurations. Checks cipher suites, protocols, certificate validity, known vulnerabilities (Heartbleed, POODLE, ROBOT), and compliance.