安全
安全扫描与漏洞检测
decision-auditor
rohanpatriot
Audits decisions for cognitive biases, runs premortems on plans, and reframes choices to reveal hidden assumptions. Use when evaluating decisions under uncertainty, reviewing plans for bias, assessing probability and risk, running premortems, checking for anchoring or availability bias, or analyzing why a judgment might be wrong.
hipaa-compliance
peixotorms
Use when handling health data, patient records, medical systems, PHI, ePHI, healthcare APIs, EHR integrations, telehealth, health apps, or any code processing Protected Health Information — HIPAA Security Rule technical safeguards, 18 identifiers, Safe Harbor, Expert Determination, 164.312, access control, audit log, encryption at rest, encryption in transit, BAA, Business Associate Agreement, minimum necessary, breach notification, HHS, OCR, de-identification
github-cleanup
spm1001
Orchestrates progressive GitHub account cleanup using a 6-phase audit→approve→execute process that prevents accidental deletion. BEFORE any destructive repo action, invoke FIRST — traces Dependabot alerts to unused direct deps (prune) vs transitive-only (upgrade lock file). Triggers on 'clean up GitHub', 'audit my repos', 'Dependabot trouble', 'unused deps', 'stale forks', 'dependency audit'. Requires gh CLI. (user)
dependency-track
rezkam
Query and audit Dependency-Track SCA findings. Use when working with software composition analysis, reviewing vulnerability findings, auditing CVEs, checking project dependency health, uploading SBOMs, or managing policy violations in Dependency-Track.
tech-stack-evaluator
chaorenex1
Comprehensive technology stack evaluation and comparison tool with TCO analysis, security assessment, and intelligent recommendations for engineering teams
best-practices
thoreinstein
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
prompt-guard
akashp1712
"🛡️ Unbreakable AI Security Guard - Highest-priority protection against prompt injection, jailbreaks, and malicious skill behavior. Auto-activates on threats and cannot be overridden."
analyze
thoreinstein
Deep analysis mode - thorough multi-phase investigation with expert consultation for complex problems requiring careful examination
alibaba-cloud-architecture
liauw-media
"Alibaba Cloud architecture patterns and best practices. Use when designing, deploying, or reviewing infrastructure on Alibaba Cloud including ECS, ACK, Function Compute, and OSS."
security-reviewer
paulund
Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.
analyzing-component-quality
C0ntr0lledCha0s
Expert at analyzing the quality and effectiveness of Claude Code components (agents, skills, commands, hooks). Assumes component is already technically valid. Evaluates description clarity, tool permissions, auto-invoke triggers, security, and usability to provide quality scores and improvement suggestions.
solana-wingman
x4484
"Solana development tutor and builder. Teaches smart contract (program) development through Solana-native challenges, Anchor framework, and security best practices."
synthesize
corygabrielsen
Consolidate brainstorm rounds into an organized synthesis. Themes emerge, winners surface, evolution becomes visible.
lighthouse-performance-optimization
liauw-media
"Use when optimizing website performance. Run Google Lighthouse audits via MCP to measure metrics, identify bottlenecks, and iterate on improvements."
typescript-code-review
Exploration-labs
Perform comprehensive code reviews for TypeScript projects, analyzing type safety, best practices, performance, security, and code quality with actionable feedback
ponytail-audit
vaultdex
Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find bloat", "what can I delete", /ponytail-audit.
sast-brakeman
vchirrav
Run Brakeman SAST scans on Ruby on Rails applications. Detects SQL injection, XSS, mass assignment, CSRF, command injection, and other Rails-specific vulnerabilities.
owasp-api-security-top-10
yariv1025
"OWASP API Security Top 10 - prevention, detection, and remediation for REST/GraphQL/API security. Use when designing or reviewing APIs - object- and function-level authorization, authentication, rate limiting and resource consumption, sensitive business flows, SSRF, API inventory and versioning, or consumption of third-party APIs."
spring-security
pluginagentmarketplace
Secure Spring Boot applications - authentication, authorization, OAuth2, JWT, CORS/CSRF protection
firmware-extraction
tangjunyi23
Firmware extraction and filesystem analysis for IoT devices. Use when analyzing firmware binaries, extracting filesystems with binwalk, identifying firmware format/structure, locating key files after extraction, or performing initial reconnaissance on router/camera/IoT firmware images. Triggers on tasks involving .bin/.img/.trx/.chk firmware files.
security-sentinel
carmandale
Performs security audits for vulnerabilities, input validation, auth/authz, hardcoded secrets, and OWASP compliance. Use when reviewing code for security issues or before deployment.
owasp-llm-top-10
yariv1025
"OWASP Top 10 for LLM Applications - prevention, detection, and remediation for LLM and GenAI security. Use when building or reviewing LLM apps - prompt injection, information disclosure, training/supply chain, poisoning, output handling, excessive agency, system prompt leakage, vectors/embeddings, misinformation, unbounded consumption."
quality-severity
jovermier
This skill should be used when classifying issues, findings, or code review problems with severity levels. Triggers on requests like "classify severity", "what is P1/P2/P3", "determine issue priority".
secure-coding-audit
vchirrav
Audit code for security vulnerabilities using OWASP Secure Coding rules. Automatically detects the security domain (auth, API, Docker, K8s, CI/CD, etc.) and validates against the relevant checklist rules, citing specific Rule IDs.