安全
安全扫描与漏洞检测
slack-communicator-pro
famaoai-creator
status: implemented
designing-relational-databases
sumik5
Guides relational database design from requirements to implementation covering entity modeling, ER diagrams, normalization (1NF-BCNF), optimization, and PostgreSQL-specific implementation (microservices data architecture, ACID transactions, functions/stored procedures, AAA security). Use when designing database schemas, creating ER diagrams, normalizing tables, implementing SQL DDL, or developing PostgreSQL-backed applications. For database internals (storage engines, distributed systems), use understanding-database-internals instead. For SQL antipattern detection and avoidance, use avoiding-sql-antipatterns instead.
security-check
schroneko
Security check skill. Triggers on "Could you please run a security check?", "セキュリティチェックをお願いします。", "请帮我做一次安全检查。". セキュリティチェックのデモスキル。「セキュリティチェックをお願いします。」「请帮我做一次安全检查。」などのリクエストで発動する。
security-checklist
webdevtodayjason
Comprehensive security checklist covering OWASP Top 10, SQL injection, XSS, CSRF, authentication, authorization, secrets management, input validation, and security headers. Use when scanning for vulnerabilities, reviewing security, implementing authentication/authorization, or handling sensitive data.
code-review
dmonteroh
"Provides high-signal, fast code review with selectable modes (quality, security, performance, tooling). Includes an optional safe-by-default review script to summarize diffs, scan for risky patterns, and produce a deterministic report."
observation-minimum-set
CAPHTECH
"観測の最小セットを適用。6つの失敗モード（仕様誤解/境界条件/依存/セキュリティ/並行性/運用）を継続可能なコストで網羅。Use when: プロジェクト開始、リリース前チェック、品質改善振り返り、観測が足りているか確認したい。"
everclaw
profbernardoj
Open-source first AI inference — GLM-5 as default, Claude as fallback only. Own your inference forever via the Morpheus decentralized network. Stake MOR tokens, access GLM-5, GLM-4.7 Flash, Kimi K2.5, and 30+ models with persistent inference by recycling staked MOR. Open-source first model router routes all tiers to Morpheus by default — Claude only kicks in as an escape hatch when needed. Includes Morpheus API Gateway bootstrap for zero-config startup, OpenAI-compatible proxy with auto-session management, automatic retry with fresh sessions, OpenAI-compatible error classification to prevent cooldown cascades, multi-key auth rotation v2 with proactive DIEM balance monitoring and reactive 402 watchdog, Gateway Guardian v5 with direct curl inference probes (eliminates Signal spam), proactive Venice DIEM credit monitoring, circuit breaker for stuck sub-agents, nuclear self-healing restart, always-on proxy-router with launchd auto-restart, smart session archiver, three-shift cyclic execution engine (v2 with 15-minute execution loops), 24/7 always-on power configuration for macOS, bundled security skills, zero-dependency wallet management via macOS Keychain, x402 payment client for agent-to-agent USDC payments, ERC-8004 agent registry reader for discovering trustless agents on Base, and hardware-aware local Ollama fallback with auto model selection (Qwen3.5 family, 1.5B–72B based on available RAM/GPU).
stakeholder-communicator
famaoai-creator
Output file path
constellation-team
PrakharMNNIT
Coordinate a cross-functional star-team workflow (Product Manager, Principal Engineer, Backend, Frontend, QA/Security, DevOps) with mandatory architecture and code-review checkpoints. Use when a request needs end-to-end product delivery, multi-role collaboration, or explicit role-based outputs (PM/PE/Backend/Frontend/QA/DevOps), or when the user asks for "star team", "cross-functional", "full lifecycle", or "multi-role" planning.
strategic-roadmap-planner
famaoai-creator
Output file path
avoiding-sql-antipatterns
sumik5
Identifies and prevents common SQL database design mistakes across logical design, physical design, query construction, and application development. Use when designing database schemas, writing SQL queries, reviewing data models, or implementing database-backed features. Covers 25 named antipatterns with detection signals, solutions, and exception cases. For code-level security (input validation, XSS, OWASP), use securing-code instead. For database model selection and data architecture decisions, use understanding-database-internals instead. For positive relational database design methodology (entity modeling, normalization process), use designing-relational-databases instead.
ai-ethics-auditor
famaoai-creator
status: implemented
executive-reporting-maestro
famaoai-creator
Output file path (JSON or .md)
backend-principle-eng-typescript-pro-max
PrakharMNNIT
"Principal backend engineering intelligence for TypeScript services. Actions: plan, design, build, implement, review, fix, optimize, refactor, debug, secure, scale backend code and architectures. Focus: correctness, reliability, performance, security, observability, scalability, operability, cost."
skill-safety-audit
peterbamuhigire
Scan new or updated skills for unsafe or malicious instructions (unknown tools, external installers, credential harvesting) before accepting them into the repository.
crisis-manager
famaoai-creator
Provides rapid response during production incidents or critical security breaches. Coordinates diagnostics, temporary fixes, and post-mortem data collection.
everclaw
profbernardoj
Open-source first AI inference — GLM-5 as default, Claude as fallback only. Own your inference forever via the Morpheus decentralized network. Stake MOR tokens, access GLM-5, GLM-4.7 Flash, Kimi K2.5, and 30+ models with persistent inference by recycling staked MOR. Open-source first model router routes all tiers to Morpheus by default — Claude only kicks in as an escape hatch when needed. Includes Morpheus API Gateway bootstrap for zero-config startup, OpenAI-compatible proxy with auto-session management, automatic retry with fresh sessions, OpenAI-compatible error classification to prevent cooldown cascades, multi-key auth rotation v2 with proactive DIEM balance monitoring and reactive 402 watchdog, Gateway Guardian v5 with direct curl inference probes (eliminates Signal spam), proactive Venice DIEM credit monitoring, circuit breaker for stuck sub-agents, nuclear self-healing restart, always-on proxy-router with launchd auto-restart, smart session archiver, three-shift cyclic execution engine (v2 with 15-minute execution loops), 24/7 always-on power configuration for macOS, bundled security skills, zero-dependency wallet management via macOS Keychain, x402 payment client for agent-to-agent USDC payments, ERC-8004 agent registry reader for discovering trustless agents on Base, and hardware-aware local Ollama fallback with auto model selection (Qwen3.5 family, 1.5B–72B based on available RAM/GPU).
reason-about-code-security
ricardogomes
Develop systematic threat reasoning and adversarial thinking about code security. Use when a learner wants to analyze code for security implications, understand vulnerability patterns, or develop security-minded thinking. This skill teaches systematic threat modeling, assumption surfacing, and defense reasoning—not vulnerability cataloging. Triggers on phrases like "is this secure", "security implications", "could this be exploited", "threat analysis", or when a learner wants to develop security reasoning skills.
code-review
Nirav846
Use when code has been written and needs validation before committing, or when the user asks for a code review or security check.
agent-guardrails
GaBySuGy
"Stop AI agents from secretly bypassing your rules. Mechanical enforcement with git hooks, secret detection, deployment verification, and import registries. Born from real production incidents: server crashes, token leaks, code rewrites. Works with Claude Code, Clawdbot, Cursor. Install once, enforce forever."
post-quantum-shield
famaoai-creator
Output path for report
developing-bash
sumik5
Comprehensive Bash shell scripting and automation guide covering fundamentals, control flow, I/O pipelines, process control, system administration automation, testing/debugging, security, design patterns, and penetration testing automation (Nmap, web scanning, exploitation, Wi-Fi assessment, reporting). MUST load when .sh files are detected or shell scripts are being written. For Docker-specific patterns, use managing-docker instead. For broader DevOps methodology, use practicing-devops instead.
prompt-guard
akashp1712
"🛡️ Unbreakable AI Security Guard - Highest-priority protection against prompt injection, jailbreaks, and malicious skill behavior. Auto-activates on threats and cannot be overridden."
developing-google-cloud
sumik5
Google Cloud development guide covering Cloud Run (architecture, scaling, CI/CD), GCP security (IAM, VPC, KMS, DLP, SCC, Zero Trust, Chronicle), data engineering (BigQuery, Dataflow, data pipelines, governance), network engineering (VPC, load balancing, CDN, Traffic Director), and Memorystore (Redis/Memcached, cache patterns, resilience). MUST load when Dockerfile is detected with google-cloud packages, when cloudbuild.yaml is present, or when working with BigQuery, Dataflow, Dataproc, Cloud Interconnect, or Memorystore. For Docker-specific patterns, use managing-docker instead. For general monitoring design, use designing-monitoring instead. For code-level security (OWASP, CodeGuard), use securing-code instead. For data architecture patterns (CQRS, event sourcing), use architecting-data instead. For AWS development, use developing-aws instead. For serverless security (GCS hacking, Cloud Run abuse), use securing-serverless instead. For application logging, use implementing-logging.