安全
安全扫描与漏洞检测
helm-chart-review
meriley
Conduct comprehensive Helm chart security and quality audits with automated checks for security contexts, resource limits, and production readiness. Use when reviewing pull requests with Helm chart changes, conducting pre-release chart audits, security scanning Helm manifests, validating chart structure and best practices, or preparing charts for production deployment.
backend-dev
dy9759
Comprehensive backend development workflow that orchestrates expert analysis, architecture design, implementation, and deployment using the integrated toolset. Handles everything from API design and database architecture to security implementation and DevOps automation.
hm-coding-philosophy
humanmade
Human Made engineering principles and code quality standards. Apply when writing code, reviewing code, planning implementations, or discussing architecture. Covers code quality priorities, simplicity over complexity, and avoiding over-engineering.
setup-node
meriley
Sets up Node.js/TypeScript development environment with npm/yarn, dependencies, ESLint, Prettier, testing (Jest/Vitest), and TypeScript type checking. Ensures consistent tooling configuration. Use when starting work on Node.js/TypeScript projects, after cloning repositories, setting up CI/CD, or troubleshooting environment issues.
Code Review Checklist
LKB-99
50 skills para Manus com acionamento automático - IA, Marketing, Finanças, Saúde, Produtividade, Desenvolvimento e mais
security-scan
meriley
⚠️ MANDATORY - Automatically invoked by safe-commit. Performs comprehensive security scanning before commits. Checks for secrets (API keys, passwords, tokens), dependency vulnerabilities, code injection risks, and authentication issues. MUST pass before any commit. NEVER run security scans manually.
Security Audit
LKB-99
"Performs a comprehensive security audit on applications based on OWASP ASVS. Use this skill when users want to perform a security check, audit, or review of their application. Triggers: security audit, security check, vulnerability scan, penetration test, OWASP, ASVS, application security, code review, secure coding, pentest, auditoria de segurança, verificação de segurança, análise de vulnerabilidade, teste de invasão."
architecture
dy9759
Comprehensive system architecture design and implementation workflow that orchestrates expert analysis, technical decision-making, and architectural pattern selection using the integrated toolset. Handles everything from initial system analysis to implementation-ready technical specifications.
remediation
SherifEldeeb
Security incident remediation playbooks for removing threats, restoring systems, and recovering from incidents. Use for post-containment cleanup, system recovery, and returning to normal operations.
vulnerability-management
SherifEldeeb
Vulnerability assessment, tracking, and remediation management. Process scan results, prioritize findings, and track remediation progress. Use for vulnerability management programs and security assessments.
Healthsafety
robdtaylor
UK health and safety management for manufacturing operations. Covers risk assessments, COSHH, PPE, incident reporting, LOTO, manual handling, and emergency procedures. Aligned with UK HSE regulations and IATF 16949 clause 7.1.4. USE WHEN user says 'health and safety', 'risk assessment', 'COSHH', 'PPE', 'accident', 'incident', 'LOTO', 'lockout tagout', 'manual handling', 'emergency procedure', or needs safety compliance guidance.
code-test-review-expert
dy9759
Advanced code testing and review expert system that provides comprehensive code quality analysis, security vulnerability assessment, test strategy design, and quality assurance through multi-expert collaboration and intelligent tool integration.
code-test-review-expert
dy9759
Advanced code testing and review expert system that provides comprehensive code quality analysis, security vulnerability assessment, test strategy design, and quality assurance through multi-expert collaboration and intelligent tool integration.
aws-well-architected-framework
rameshvr
Use when reviewing AWS architecture, designing cloud systems, addressing operational issues, security concerns, reliability problems, performance bottlenecks, cost overruns, or sustainability goals
incident-response
SherifEldeeb
Incident response documentation, timeline analysis, containment procedures, and IR reporting. Support the full incident lifecycle from detection to lessons learned. Use for security incidents, breach response, and IR planning.
pptx
SherifEldeeb
Read, modify, and create Microsoft PowerPoint presentations (.pptx). Generate slides from content, apply templates, and build executive presentations. Use when creating presentations or converting content to slides.
Internalaudit
robdtaylor
Support IATF 16949 internal audit programme - QMS audits, process audits, product audits, and layered process audits. Covers audit planning, checklists, findings, and corrective actions. USE WHEN user says 'internal audit', 'audit checklist', 'process audit', 'product audit', 'QMS audit', 'audit finding', 'nonconformance', or 'LPA'. Integrates with AutomotiveManufacturing and A3criticalthinking skills.
architecture
dy9759
Comprehensive system architecture design and implementation workflow that orchestrates expert analysis, technical decision-making, and architectural pattern selection using the integrated toolset. Handles everything from initial system analysis to implementation-ready technical specifications.
backend-dev
dy9759
Comprehensive backend development workflow that orchestrates expert analysis, architecture design, implementation, and deployment using the integrated toolset. Handles everything from API design and database architecture to security implementation and DevOps automation.
ai-lingo
sunnypatneedi
Meta-skill that maps cognitive mode-switch words to appropriate thinking behaviors and skills. AUTO-INVOKE when user uses these trigger patterns: - Depth: "rigorous", "first-principles", "mechanistic", "axiomatic", "falsifiable", "steelman", "non-trivial", "exhaustive", "load-bearing", "dispositive", "ultra think hard" - Reframe: "reimagine", "orthogonal", "contrarian", "subversive", "invert", "counterfactual", "zero-based", "provocative", "transmute", "reframe" - Precision: "probabilities", "bounded", "monotonic", "asymptotic", "invariant", "order of magnitude", "sensitivity analysis", "convex", "distribution", "marginal", "dimensionality" - Tradeoff: "sacrifice", "irreversible", "binding constraint", "pareto", "second-order", "opportunity cost", "regret minimization", "non-negotiable", "asymmetric" - Quality: "elegant", "idiomatic", "canonical", "production-grade", "battle-tested", "minimalist", "composable", "tasteful", "crisp" - Systems: "emergent", "cascading", "equilibrium", "phase transition", "feedback loop", "attractor", "entropy" - Epistemic: "Bayesian", "calibrated", "crux", "pre-mortem", "adversarial", "sparse", "steel-thread", "epistemic humility", "signal-to-noise"
validate-implementation-plan
b-mendoza
Audit and annotate an AI-generated implementation plan for requirements traceability, YAGNI compliance, and assumption risks. Use when reviewing, validating, or auditing an implementation plan or design proposal produced by an AI agent.
database-specialist
samChang72
優化資料庫查詢，消除慢查詢，設計高效索引與 Schema。
@tank/auth-patterns
tankpkg
Authentication and authorization patterns for any language or framework. Covers JWT internals (structure, algorithms, attacks, validation), OAuth2 grant types (Authorization Code, PKCE, Client Credentials, Device Code), session management (cookies, expiry, fixation, distributed), RBAC/ABAC/ReBAC (role modeling, authorization policies, Zanzibar), OpenID Connect and social login (ID tokens, account linking, provider patterns), MFA (TOTP, WebAuthn/passkeys, backup codes, step-up auth), and authentication security (XSS/CSRF, token storage, credential stuffing, rate limiting). Synthesizes RFC 6749, RFC 7519, RFC 6238, W3C WebAuthn Level 2, NIST SP 800-63B, and OWASP Authentication/CSRF cheat sheets. Trigger phrases: "JWT", "OAuth2", "OAuth 2.0", "session management", "RBAC", "ABAC", "role-based access", "authorization model", "OpenID Connect", "OIDC", "social login", "MFA", "multi-factor authentication", "TOTP", "WebAuthn", "passkeys", "refresh token", "access token", "PKCE", "auth flow", "implement authentication", "implement auth", "sign in with", "cookie security", "HttpOnly", "SameSite", "token storage", "XSS auth", "CSRF protection", "credential stuffing", "account linking", "backup codes", "permission system", "login security", "password hashing"
ask-code-reviewer
NavanithanS
Start code reviews, PR checks, or bug analysis. Triggers: "review my code", "check this PR", "analyze for bugs", "code review". Do NOT use for: - Automating fixes (use ask-python-refactor). - Generating new features. Capabilities: - Static analysis: Correctness, Security, Performance, Style. - Feedback priority: Critical > Performance > Style.