安全

keyenv-scan

keyenv

Scan codebases for hardcoded secrets and credentials using KeyEnv's built-in scanner. Use when the user wants to find leaked API keys, passwords, tokens, or private keys in their code, or set up a pre-commit hook to prevent secret commits.

tidyfactor-next

TidyFactor

"Production multi-tenant SaaS engine on Next.js 16, React 19, TypeScript strict, and Supabase with Contextual Decision Layer (CDL). Features locked tenant isolation (tenant_id + Postgres RLS) and pluggable query layer. Trigger on commands 'brief', 'init', 'tenant', 'rls', 'auth', 'data', 'storage', 'api', 'app', 'test', 'observe', 'deploy', or requests to build a multi-tenant SaaS."

utils/gemini

codihaus

Large context processing using Gemini Flash for codebase scanning and summarization

security-audit

kilogrametz

Comprehensive security audit for web applications and APIs. Performs a full-stack security review covering authentication, authorization, rate limiting, input validation, secrets management, security headers, cost controls (AI/API spend), email abuse prevention, dependency vulnerabilities, and data exposure risks. Produces a severity-ranked report with specific fix recommendations and code examples. Use this skill whenever the user mentions: security audit, security review, penetration test, vulnerability assessment, hardening, "is my app secure", "check for vulnerabilities", "before going live", "production readiness", rate limiting, auth review, API security, or wants to assess the security posture of any web project — even if they just say something like "review my code for security issues" or "what could go wrong if I deploy this". Also trigger for pre-launch checklists that include security concerns.

elysia-core-backend

ahmed-lotfy-dev

Scaffold a Bun + Elysia backend with Better Auth, Drizzle ORM, Postgres, MCP endpoint, OpenAPI docs, CORS, and security defaults. Use when asked to create or regenerate this backend scaffold, or to add these components to a new or empty Elysia server project.

semgrep

aleister1102

Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases.

authentication

AtulSinghShorthillsAI

Implement secure, production-grade authentication systems with token-based session management. Use this skill when the user asks to build user authentication, login/registration systems, session management, user identity features, or secure access control for web applications.

Security Scanning Tools

jcastillotx

This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.

aave-security-foundations

0xWeakSheep

Security baseline for AAVE integration and execution scripts. Use when user asks for AAVE security review, pre-trade checks, liquidation safety, allowance minimization, or execution hardening.

yotta-chain

YottaMeta

元链 —— 跨智能体的供应链依赖校验技能：零依赖自研引擎本地解析 npm（package.json / package-lock v1-v3 / .npmrc）与 Python（requirements / pyproject.toml / poetry.lock / Pipfile）及 Maven pom.xml，检测依赖混淆（私有包名被公共仓库同名抢占 / 混合仓库 / 可疑仓库 URL / extra-index 回退）、lockfile 与清单不一致、缺失锁文件、未固定版本、typo-squat 仿冒命名，并生成 SBOM-lite（CycloneDX 1.5 子集）。触发：用户要在构建 / 发布 / CI 前检查项目依赖是否存在供应链风险、核对锁文件与清单是否一致、排查依赖混淆风险或生成 SBOM 时。边界：纯本地离线解析，不做在线 CVE 比对、不查询公共包仓库、不发送任何数据；结果只是「需人工复核的风险信号」，是否真实需人工核实；仅用于已获授权 / 自有资产 / 教学环境。

azure-app-service-best-practices

seligj95

Best practices for Azure App Service web app development, configuration, and operations. Use when reviewing/optimizing App Service configs, implementing security patterns (Managed Identity, Key Vault), optimizing performance (cold starts, scaling), setting up production deployments (slots, CI/CD, health checks), cost optimization, or troubleshooting. Triggers on "best practices", "recommendations", "patterns", "how should I configure".

semver

stuckinforloop

Semantic versioning guidelines for software releases. Use when assigning version numbers, deciding between major/minor/patch bumps, managing unstable (0.x.x) software versions, evaluating breaking changes, or reviewing changelogs and release notes for correct semver compliance.

fortify-fod

crance

"use this skill whenever the user wants to list and filter application security findings, run SAST/SCA/DAST scans, discover applications and releases, and manage security scanning using Fortify on Demand (FoD). Triggers include: any mention of 'FoD', 'Fortify on Demand', 'list vulnerabilities', 'run SAST scan', 'run SCA scan', 'run DAST scan', 'list applications', 'list releases', 'package source code', 'security scan', and similar requests indicating interaction with FoD for application security scanning and vulnerability management."

mechsuit

gravermistakes

write-technical-rfc

squirrel289

Create, revise, and maintain IETF-style Internet-Drafts and RFC-like technical specifications for protocols, APIs, interoperability contracts, and system behavior. Use when drafting a new spec, updating an existing draft, resolving review feedback, validating RFC 2119/8174 requirement language, or ensuring mandatory sections such as Security Considerations, IANA Considerations, and References are complete and consistent.

bezaleel-stack

christopheraaronhogg

Provides comprehensive technology stack auditing with LIVE RESEARCH capability. Analyzes version currency, code patterns, conventions, anti-patterns, and security advisories for ANY framework (Laravel, React, Vue, Symfony, etc.). Use this skill when the user needs technology stack audit, framework best practices review, or package analysis. Produces detailed consultant-style reports with findings and prioritized recommendations — does NOT write implementation code.

SKILL.md — Web Research

iamthetonyb

Never present speculation as fact

general-frontend-security

lenneTech

Framework-agnostic frontend security guide based on OWASP Secure Coding Practices. Covers XSS prevention, CSRF protection, Content Security Policy (CSP), secure cookie configuration, client-side authentication patterns, input validation, secure storage, and security headers. Activates for security audits, vulnerability reviews, or browser security questions in any web application. NOT for backend/NestJS security (use generating-nest-servers). NOT for Nuxt-specific implementation (use developing-lt-frontend).

SQL Injection Testing

jcastillotx

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.

blueagent-x402

madebyshun

Security OS for autonomous agents and builders on Base. 31 pay-per-use tools across Quantum Security, Agent Safety, Research, Data, and Earn. Built for AI agents, Zero-Human Companies (ZHC), and Base ecosystem builders. Pay USDC per call via x402 protocol — no subscription, no API key needed.

variant-analysis

aleister1102

Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.

External Research

MaizeCobra

"Comprehensive external research methodology using web search, URL fetching, and documentation APIs for authoritative, version-aware documentation gathering"

high-risk-review

janjaszczak

Apply enhanced verification (CoVe-like review, security/arch/perf checks, targeted web research) for high-risk tasks or uncertainty. Use for security, infra, data loss risk, major refactors, or when facts may be outdated.

dependency-update

IHKREDDY

Check for outdated packages and create update PRs