安全
安全扫描与漏洞检测
hardcoded-secrets-anti-pattern
igbuend
"Security anti-pattern for hardcoded credentials and secrets (CWE-798). Use when generating or reviewing code that handles API keys, passwords, database credentials, encryption keys, or any sensitive configuration. Detects embedded secrets and recommends environment variables or secret managers."
nightshift
adriannutiu
Scriptless overnight repository and code-quality audit for Codex that runs deterministic checks first (code correctness gates, dead code or orphan hints, test gaps, refactor and DRY opportunities, doc drift, dependency or security posture, tech debt, optional infra drift) and then synthesizes prioritized actions with structured artifacts in .nightshift/runs/timestamp. Use after large implementation sessions, before releases, before handoff, or when asking "what did we miss?"
encryption-pattern
igbuend
Security pattern for implementing encryption and decryption operations. Use when encrypting data for confidentiality, selecting encryption algorithms (AES, RSA), configuring cipher modes (GCM, CBC), choosing key lengths, or implementing symmetric/asymmetric encryption. Specialization of Cryptographic action pattern addressing confidentiality requirements.
ethical-hacking-ethics
igbuend
Legal and ethical guidelines for bug bounties, pentesting, and security research. Use when conducting authorized security testing.
find-your-margin
cdeistopened
Help a knowledge worker find where their attention earns the fattest margin when combined with AI. Maps their skill stack against AI capabilities to identify high-surplus opportunities vs. commodity traps. Use when someone asks where to focus their AI efforts, how to avoid the allocation economy race-to-zero, or how to build a defensible position as an individual operator.
missing-security-headers-anti-pattern
igbuend
"Security anti-pattern for missing security headers (CWE-16). Use when generating or reviewing web application code, server configuration, or HTTP response handling. Detects missing CSP, HSTS, X-Frame-Options, and other protective headers."
attack-tree-construction
xfstudio
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
kics
igbuend
Run Checkmarx KICS for Infrastructure as Code security scanning. Use when analyzing Terraform, CloudFormation, Kubernetes, Ansible, Dockerfile, or other IaC for misconfigurations and security issues.
debug-mode-production-anti-pattern
igbuend
"Security anti-pattern for debug mode in production (CWE-215). Use when generating or reviewing code that configures application settings, deployment configurations, or error handling. Detects hardcoded debug flags and development-only features in production."
jwt-misuse-anti-pattern
igbuend
"Security anti-pattern for JWT misuse vulnerabilities (CWE-287). Use when generating or reviewing code that creates, validates, or uses JSON Web Tokens. Detects 'none' algorithm attacks, weak secrets, sensitive data in payloads, and missing expiration."
code-review
thechandanbhagat
Perform automated code reviews with best practices, security checks, and refactoring suggestions. Use when reviewing code, checking for vulnerabilities, or analyzing code quality.
encrypted-tunnel-pattern
igbuend
Security pattern for channel-level encryption (TLS/SSH). Use when implementing HTTPS, securing all communication between endpoints, setting up TLS connections, or when infrastructure should handle encryption transparently. Addresses "Leak action request or data in transit" problem.
authentication-pattern
igbuend
Security pattern for implementing authentication in software systems. Use when designing or reviewing authentication mechanisms, implementing login systems, verifying user identity, protecting system access, or addressing OWASP authentication flaws. Provides guidance on enforcers, verifiers, evidence providers, subject registration, credential management, and security considerations.
digital-signature-pattern
igbuend
Security pattern for implementing digital signatures. Use when implementing document signing, code signing, certificate signing, non-repudiation, or verifying authenticity and integrity of messages using asymmetric cryptography (RSA, ECDSA, Ed25519).
codeql
igbuend
Run CodeQL static analysis for security vulnerability detection, taint tracking, and data flow analysis. Use when asked to scan code with CodeQL, write QL queries, perform deep interprocedural analysis, or integrate with GitHub Advanced Security.
data-validation-pattern
igbuend
Security pattern for input validation and sanitization. Use when implementing input handling, preventing injection attacks (SQL, XSS, command), ensuring data integrity, or processing data from untrusted sources. Addresses "Entity provides unexpected data" problem.
command-injection-anti-pattern
igbuend
"Security anti-pattern for OS Command Injection vulnerabilities (CWE-78). Use when generating or reviewing code that executes shell commands, runs system processes, or handles user input in command-line operations. Detects shell string concatenation and recommends argument arrays."
codebase-discovery
igbuend
Generate security-focused DISCOVERY.md for code review and threat modeling. Use when assessing unfamiliar codebases.
attack-surface-xss
igbuend
Reconnaissance skill for XSS attack surface — analyzes headers, frameworks, JS libraries, and DOM patterns at a URL to map what makes XSS possible or harder. For ethical hackers preparing for XSS testing.
insecure-temp-files-anti-pattern
igbuend
"Security anti-pattern for insecure temporary files (CWE-377). Use when generating or reviewing code that creates temporary files, handles file caching, or processes uploads through temp storage. Detects predictable paths, insecure permissions, and missing cleanup."
insecure-defaults-anti-pattern
igbuend
Security anti-pattern for fail-open defaults (CWE-1188). Use when reviewing code that uses fallback values for secrets, credentials, or security settings. Detects applications that run with weak defaults when configuration is missing.
missing-authentication-anti-pattern
igbuend
"Security anti-pattern for missing or broken authentication (CWE-287). Use when generating or reviewing code for login systems, API endpoints, protected routes, or access control. Detects unprotected endpoints, weak password policies, and missing rate limiting on authentication."
mutation-xss-anti-pattern
igbuend
"Security anti-pattern for mutation XSS (mXSS) vulnerabilities (CWE-79 variant). Use when generating or reviewing code that sanitizes HTML content, handles user-provided markup, or processes rich text. Detects sanitizer bypass through browser parsing mutations."
missing-input-validation-anti-pattern
igbuend
"Security anti-pattern for missing input validation (CWE-20). Use when generating or reviewing code that processes user input, form data, API parameters, or external data. Detects client-only validation, missing type checks, and absent length limits. Foundation vulnerability enabling most attack classes."