Secure Coding

github Bundle

Enforces output quality, intellectual honesty, and continuous improvement across security analysis agents with anti-rationalization guards, self-critique loops, retry protocols, and quality gates.

github Skill

Verify supply chain integrity for AI agent plugins, tools, and dependencies by generating SHA-256 manifests, detecting tampered files, auditing dependency pinning, and enforcing promotion gates.

github Skill

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks, scanning for controls and generating a compliance report.

github Skill

Enforce quality, security, and accessibility standards for Salesforce Lightning Web Components, Aura components, and Visualforce pages.

trailofbits Bundle

Coverage-guided fuzzing for Ruby code and C extensions using libFuzzer and sanitizers.

trailofbits Bundle

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, or formal models (ProVerif/Tamarin) and generates Mermaid sequence diagrams with cryptographic annotations.

trailofbits Bundle

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

trailofbits Bundle

Detect memory errors like buffer overflows and use-after-free bugs in C/C++ code during fuzzing and testing using AddressSanitizer.

trailofbits Bundle

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

trailofbits Bundle

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations, detecting attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

trailofbits Bundle

Scans Cairo/StarkNet smart contracts for 6 critical vulnerability patterns including arithmetic overflow, L1-L2 messaging issues, and signature replay. Use when auditing StarkNet projects.

trailofbits Bundle

Ports existing Semgrep rules to new target languages with applicability analysis and test-driven validation.

jeffallan Bundle

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level, covering the complete stack from database to UI.

zhaoxuya520 Bundle

Performs authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.

zhaoxuya520 Bundle

Reverse-engineers EDR, Defender, and AV hook tables, ETW providers, and AMSI implementations to build targeted bypasses including unhooking, indirect syscalls, ETW patching, and call stack spoofing for authorized red team operations.

zhaoxuya520 Bundle

Provides a structured workflow for reverse engineering .NET and C# binaries, including deobfuscation with de4dot, static analysis via dnSpyEx IL view, dynamic debugging, and reliable IL patching for red-team tools and malware.

zhaoxuya520 Bundle

Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.

zhaoxuya520 Skill

Reverse-engineers custom JavaScript-based WASM virtual machines and risk-control engines by identifying DSL VM patterns, extracting opcodes, analyzing constant tables, and tracing exported functions through static analysis and runtime injection.

iamcorey Bundle

Diagnose intermittent Wi-Fi issues like buffering, lag, packet loss, and weak coverage through read-only analysis, then safely optimize authorized router settings when evidence supports a change.

tinh2 Skill

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

sakamoto-family-smile Skill

Audits Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield, covering CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

sakamoto-family-smile Skill

Hardens Laravel applications against common vulnerabilities with guidance on authentication, authorization, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

sakamoto-family-smile Skill

Provides a security checklist and hardened Solidity patterns for auditing AMM contracts, liquidity pools, and swap flows, covering reentrancy, CEI ordering, donation attacks, oracle manipulation, slippage, admin controls, and integer math.

luokai0 Bundle

Implements secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities.

auto-skiller Skill

Reviews staged and unstaged code changes for security vulnerabilities, code quality issues, and adherence to project conventions, reporting findings by severity.

vikingokft Skill

Audits WordPress plugin or theme PHP code for internationalization (i18n) correctness, including text-domain consistency, escaped translation helpers, placeholder usage, plurals, context, and text-domain loading. Produces a severity-ranked report of issues to fix before release.

vikingokft Skill

Audits WordPress plugin and theme code for secret-handling issues: hardcoded credentials, weak randomness, insecure password storage, cookie flags, and secret leakage in logs.

johnalbertini14-glitch Bundle

Blocks dangerous shell commands and warns on risky ones, applying a safety protocol before executing any command.

paramchordiya Skill

Enforces a principal-engineer self-review checklist on every code block before output, covering correctness, performance, security, naming, and testability.

lucaspmarie-a11y Skill

Guides Firebase development with best practices for security rules, data modeling, and avoiding common pitfalls.

anantha-236 Skill

Prevents destructive operations when working on production systems or running agents autonomously by intercepting risky commands and restricting file edits to a specified directory.

adobe Bundle

Detects and triages explicitly-unbounded AEM queries (p.limit=-1 or setLimit(-1)) that cause OOMs, safely capping only where provably safe and escalating others for human pagination.

zhaoxuya520 Bundle

Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.

zhaoxuya520 Bundle

Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.

tinh2 Skill

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.

pranavnagrecha Bundle

Guides secure design and review of Lightning Web Components, covering DOM safety, Apex data exposure, and Lightning Web Security.