安全
安全扫描与漏洞检测
helmet-config-generator
ehtbanton
Generate Helmet.js security middleware configuration for Express applications. Triggers on "create helmet config", "generate helmet configuration", "express security headers", "helmet setup".
vulnerability-management
Hack23
Systematic vulnerability lifecycle management with SLAs: Critical 7d, High 30d, Medium 90d, Low 180d aligned with OWASP, NIST, CIS Controls
codex-autoresearch
luizgustavo22
"Autonomous long-running iteration for Codex CLI. Use when the user wants Codex to plan or run an unattended improve-verify loop toward a measurable or verifiable outcome, especially for overnight runs; it also covers repeated debugging, fixing, security auditing, and ship-readiness workflows. Do not use for ordinary one-shot coding help or casual Q&A."
lampson-system-design
copyleftdev
Design systems using Butler Lampson's principles of abstraction, interfaces, and practical wisdom. Emphasizes clean abstractions, security foundations, and time-tested design hints. Use when making architectural decisions, designing APIs, or building systems that must evolve over decades.
ogt-docs-audit
OpenDNDApps
Run audits on documentation and project health. Routes to specialized audit sub-skills for tasks, definitions, rules, and codebase consistency. Use when reviewing project health, validating documentation, or checking for drift.
scan
rozwer
Security scan SKILL.md files. Two-phase: static pattern matching + AI contextual review.
secure-code-review
Hack23
Conduct comprehensive security code reviews using OWASP Top 10, SAST/DAST patterns, and Hack23 ISMS secure development policy
deep-audit
shantoislamdev
Universal security and robustness scanner for any codebase. Use when auditing code for vulnerabilities, security issues, bugs, or robustness problems. Automatically detects tech stack, creates custom audit plans, and performs recursive deep analysis.
sharp-edges
aleister1102
"Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration."
security-review
pmco23
Use after build is complete to scan for OWASP Top 10 vulnerabilities. Checks injection, authentication, authorization, data exposure, and misconfiguration risks. Requires .pipeline/build.complete.
guard-audit
tonone-ai
Audit guardrail coverage — bypass vectors, false positive rates, policy gap analysis, red-team scenarios. Use when asked to "audit our AI guardrails", "can our filters be bypassed", or "check guardrail false positives".