安全
安全扫描与漏洞检测
skill-security-audit
smartchainark
Detect malicious patterns in AI Agent skills — 13 detectors for backdoors, credential theft, data exfiltration, and supply-chain attacks. Based on SlowMist's ClawHub threat intelligence (472+ malicious skills). Pure Python, zero dependencies.
security-guardrails
CsHeng
Comprehensive security implementation standards. Use when security guardrails guidance is required.
data-governance
dtsong
"Use this skill when implementing data governance as part of engineering work. Covers data cataloging (dbt docs, external tools), lineage documentation, data classification (PII/PHI taxonomy), access control patterns (RBAC, row-level security), and compliance frameworks (GDPR, HIPAA, SOX, CCPA). Common phrases: \"data catalog\", \"data lineage\", \"PII classification\", \"access control\", \"RBAC\", \"data governance\", \"compliance requirements\". Do NOT use for writing dbt models (use dbt-transforms), pipeline orchestration (use data-pipelines), or data quality testing (use data-testing)."
analyze-risk
bdmorin
You are tasked with conducting a risk assessment of a third-party vendor, which involves analyzing their compliance with security and privacy standards.
check-lightning
phrazzld
Audit Lightning Network integration. Checks node health, channel balances, peer connectivity, invoice handling, and routing. Use when: reviewing Lightning setup, diagnosing payment failures, or capacity planning. Keywords: lightning, lnd, cln, channels, invoices, bolt11.
check-stripe
phrazzld
Audit Stripe integration: configuration, webhooks, subscription logic, security. Outputs structured findings. Use log-stripe-issues to create issues. Invoke for: Stripe audit, payment review, subscription analysis.
networking-controls
CsHeng
Network security and connectivity standards. Use when networking controls guidance is required.
c-framework
founderjourney
Universal contractual development mode enforcer. Reads project-specific rules from CLAUDE.md dynamically. Activate for any project requiring verified claims, security checks, evidence-based recommendations, or strict development standards. Triggers: /c-framework, /cf, "modo contractual", "verify code", "enforce rules", "contract mode". Works with any stack (Node, Python, Go, etc.) and any project type (API, SaaS, CLI, web-app).
analyze-discord-structure
bdmorin
You are an expert Discord server architect and community strategist.
oceanbase-sql-optimization
amber-moe
SQL optimization best practices for OceanBase database (MySQL & Oracle modes). Covers query optimization, index usage, execution plan analysis, slow query tuning, and performance optimization techniques. Activates for SQL optimization, query performance, index design, execution plan, slow query, database performance.
postgresql-performance-expert
founderjourney
Optimizacion de PostgreSQL para Senior Full-Stack Developer. Usar cuando el usuario necesite diagnosticar queries lentos, optimizar performance de base de datos, disenar indices, resolver N+1 queries, o defender experiencia en optimizacion. Activa con palabras como PostgreSQL, query lento, performance, EXPLAIN, indice, N+1, optimizar base de datos, latencia. Especializado en aplicaciones SaaS con Node.js.
saas-business-logic-analyst
founderjourney
Senior Business Logic Analyst (15+ years) specialized in SaaS systems (YC/SV standard). Activate when user needs: (1) Audit business logic in code, (2) Detect revenue leakage or billing bugs, (3) Review subscription/billing/multi-tenant logic, (4) Analyze edge cases with business impact, (5) Evaluate code for scaling/pivot readiness, (6) Due diligence on SaaS codebase, (7) Identify invariant violations, (8) Assess organizational/knowledge risks in code. Triggers: "audit business logic", "review billing code", "check subscription logic", "find revenue leakage", "SaaS code review", "multi-tenant security", "pricing logic", "analyze edge cases", "due diligence", "business logic analyst".
digitaliza-data-extractor
founderjourney
Extract and prepare client data for digitalizaweb.vercel.app LinkTree-style digital cards. Use when: (1) Processing restaurant/business client folders containing screenshots, scraped HTML, or LinkTree data, (2) Extracting brand colors from logos/images, (3) Generating Digitaliza-ready JSON with slug, name, links, colors, and theme configuration, (4) Batch processing multiple client folders for 100+ restaurants project, (5) User mentions "digitaliza", "tarjeta digital", "linktree", "extraer datos de cliente", or "procesar carpeta de restaurante".
code-reviewer
WomenDefiningAI
Research-backed code review skill with OWASP Top 10 security checks, SAST tool integration (SonarQube, CodeQL, Snyk), performance pattern detection, and automated quality standards enforcement. Auto-invoked for code review, security audit, PR analysis, and bug checking. Implements 2025 best practices with 92% faster vulnerability remediation.
deployment-docker
CsHeng
Docker and containerization guidelines. Use when deployment docker guidance is required.
technical-storytelling
founderjourney
Sistema para convertir logros tecnicos en narrativas que comunican senioridad e impacto. Usar cuando el usuario necesite escribir sobre sus proyectos, preparar presentaciones tecnicas, documentar decisiones de arquitectura, o comunicar complejidad a audiencias no-tecnicas. Activa con palabras como explicar proyecto, presentacion, documentar, caso de estudio, blog tecnico, conferencia. Especializado en developers senior que necesitan comunicar impacto business.
integration-patterns-mastery
founderjourney
Patrones de integracion robustas para Senior Full-Stack Developer. Usar cuando el usuario necesite disenar o explicar integraciones con APIs externas, webhooks, sincronizacion de datos, retry patterns, manejo de errores en integraciones, o defender experiencia con Stripe, OTAs, WhatsApp API. Activa con palabras como webhook, integracion, API externa, sync, retry, idempotencia, Stripe, iCal, OTA, dead letter queue, reconciliacion. Especializado en sistemas de produccion robustos.
quality-standards
CsHeng
Code quality metrics and continuous improvement. Use when quality standards guidance is required.
security-logging
CsHeng
Security controls and structured logging implementation. Use when security logging guidance is required.
dependabot-alert-issue
shoji9x9
Dependabot alerts または外部 audit findings（例 pnpm audit の正規化 JSON）を確認し、解消 Issue を gh で作成するスキル。対象を「すぐ着手できるか」で分類し、着手可能なものは severity 毎、ブロック中のものは脆弱パッケージ＋解決バージョン毎にまとめる。既存 Issue/PR はスキップし、特定 alert の ignore/dismiss も設定できる。pnpm.overrides 等の品質が保証されない回避策は採らない。「Dependabot alerts から Issue」「pnpm audit の結果から Issue」「脆弱性対応の Issue」「dependabot-alert-issue」で必ず発動する。
encoding-bypass-anti-pattern
igbuend
"Security anti-pattern for encoding bypass vulnerabilities (CWE-838). Use when generating or reviewing code that handles URL encoding, Unicode normalization, or character set conversions before security validation. Detects validation before normalization and double-encoding issues."
cryptography-as-a-service-pattern
igbuend
Security pattern for delegating cryptographic operations and key management to an external service. Use when designing systems that should not possess cryptographic keys directly. Implementation of Cryptographic Key Management pattern. Examples include Android Keystore, iOS KeyChain, AWS KMS, Azure Key Vault, Google Cloud KMS. Reduces risk of key leakage and cipher misconfiguration.
log-injection-anti-pattern
igbuend
"Security anti-pattern for log injection vulnerabilities (CWE-117). Use when generating or reviewing code that writes to log files, handles logging of user input, or processes log data. Detects unsanitized data in log messages enabling log forging and CRLF injection."
hardcoded-secrets-anti-pattern
igbuend
"Security anti-pattern for hardcoded credentials and secrets (CWE-798). Use when generating or reviewing code that handles API keys, passwords, database credentials, encryption keys, or any sensitive configuration. Detects embedded secrets and recommends environment variables or secret managers."