Security

harsh817 Bundle

Define or audit the exact scope of one feature, including included behavior, excluded behavior, dependencies, and layer impact. Use before designing or implementing a feature to keep the slice small and strategic.

harsh817 Bundle

Audit performance and capacity before production. Use when measuring latency, throughput, resource use, database queries, critical paths, expected load, and capacity risks with evidence rather than guesses.

harsh817 Bundle

Automatically invoke the Phase 4 Audit production-readiness skills one by one by exact skill name, compare evidence against the project, create or continuously update PRODUCTION_READINESS.md, and produce a final READY, READY WITH ACCEPTED RISKS, or NOT READY decision.

harsh817 Bundle

Write or audit acceptance criteria for one feature across success, validation, permissions, state changes, and visible results. Use when a feature needs clear done criteria before implementation or tests.

harsh817 Bundle

Audit architecture and complexity before production. Use when reviewing module boundaries, deep interfaces, information hiding, information leakage, pass-through layers, repetition, vague names, nonobvious code, and Ousterhout-style red flags.

harsh817 Bundle

Make the final production readiness decision from audit evidence. Use when combining requirements, architecture, code quality, tests, security, data, performance, reliability, deployment, observability, and adversarial findings into READY, READY WITH ACCEPTED RISKS, or NOT READY.

harsh817 Skill

Define or audit the project's architecture style, module shape, dependency direction, and layer boundaries. Use when establishing a modular monolith, reviewing cross-layer imports, deciding service boundaries, or simplifying architecture that has become shallow or tangled.

harsh817 Bundle

Run a full-system adversarial production review. Use when actively searching for hidden assumptions, unknown dependencies, missing errors, unsafe interactions, cross-area failures, and readiness blind spots after focused audits.

harsh817 Bundle

Audit observability and operations readiness before production. Use when checking logs, metrics, traces, dashboards, alerts, health checks, runbooks, ownership, on-call readiness, and operational evidence.

harsh817 Bundle

Audit production requirements completeness for a release, feature set, or system. Use when confirming every must-have user journey, acceptance condition, non-goal boundary, and documented requirement works before production readiness.

harsh817 Skill

Define or audit branch rules, commit scope, diff review, ignored files, push conditions, and change hygiene. Use before committing, opening a PR, reviewing local changes, or preventing unrelated tactical edits from accumulating.

harsh817 Bundle

Audit code quality and documentation before production. Use when checking consistency, readability, interface comments, design notes, stale comments, TODOs, debug code, naming, and nonobvious implementation choices.

harsh817 Bundle

Audit functional and regression test readiness before production. Use when confirming unit, integration, system, edge-case, smoke, and regression tests pass and adequately support safe refactoring.

harsh817 Skill

Define or audit which module owns each business rule, data concept, policy, and design decision. Use when assigning responsibility, removing duplicated rules, fixing information leakage, or deciding where new behavior belongs.

harsh817 Skill

Define or audit the approved language, framework, database, test tools, and libraries for a project. Use when creating project standards, choosing dependencies, reviewing new packages, or preventing stack drift that increases cognitive load and hidden coupling.

harsh817 Skill

Define or audit how modules, layers, services, and external clients communicate. Use when designing APIs, reviewing public interfaces, preventing implementation leakage, or simplifying contracts between modules.

harsh817 Skill

Define or audit schema ownership, constraints, transactions, data access boundaries, and safe migration practices. Use when adding tables, changing fields, writing migrations, or preventing persistence details from leaking through the system.

harsh817 Skill

Define or audit where features, shared code, tests, migrations, configuration, and documentation belong. Use when creating a repository layout, adding files, reorganizing folders, or reducing navigation complexity and misplaced ownership.

harsh817 Skill

Define or audit authentication, authorization, validation, secrets, sensitive data handling, and prohibited unsafe actions. Use when adding user access, handling private data, reviewing external inputs, or creating safety guardrails for agents and developers.

harsh817 Skill

Define or audit naming, formatting, comments, file patterns, and coding consistency rules. Use when creating conventions, reviewing unclear names, writing comments, choosing formats, or reducing obscurity in code.

jorcan Bundle

Repo coherence and correctness audit

wufufu770 Skill

XSS 挖掘：反射/存储/DOM 三型，危险 sink 定位、上下文逃逸与绕过，OOB 门禁。触发词：XSS、跨站脚本、存储型。

wufufu770 Skill

Perform hunt subdomain assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

安全响应头审计：CSP/HSTS/XFO/Referrer-Policy 缺陷评估与修复基线建议。触发词：安全头、CSP、响应头、headers。低危快速项，适合凑覆盖面。

wufufu770 Skill

JS 原型污染：客户端/服务端入口点识别、gadget 分析、向 XSS/RCE 的利用升华。触发词：原型污染、prototype pollution、__proto__。

wufufu770 Skill

Perform recon scope triage assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

JS 原型污染：客户端/服务端入口点识别、gadget 分析、向 XSS/RCE 的利用升华。触发词：原型污染、prototype pollution、__proto__。

steph-dove Skill

You are running a security audit of the current change. Scope is the diff against the base branch and the immediate context of what it touches — not the whole tree, and not style or architecture. Report findings only; do not edit code.

tomjiu Skill

Security Workflow (defensive / product design)

orcaqubits Skill

Turn an existing readiness audit (report/score.json) into a sequenced, stack-aware fix plan — each gap mapped to the marketplace skill that closes it, ordered by dependency and priority, with effort estimates. Use after readiness-audit when the user says "make me a plan", "what do we fix first", or wants issues for their tracker.

arjunprabhulal Skill

Finds, prioritizes, and closes out vulnerabilities across code, dependencies, images, and infrastructure without drowning the team in unactionable findings. Use this whenever the user is deciding what to patch first, has a scanner producing hundreds of CVEs, is setting patch SLAs, is asking whether a vulnerability is actually exploitable, or is building a remediation process. For the scanners that produce these findings use `security-scanning`; for trusting the artifacts you patch use `supply-chain-security`.

arjunprabhulal Bundle

Covers diagnosing connectivity failures methodically, layer by layer, with the right tool per symptom — dig/nslookup for DNS, curl/openssl for TLS and HTTP, traceroute/mtr for routing, tcpdump for packet capture, and ss/netstat for local socket state. Use this whenever the user reports a connection timing out, refused, or intermittently failing, cannot tell whether DNS, routing, a firewall, or the application is at fault, or needs to prove exactly where a request is failing. For fixing DNS records once diagnosed use `dns-management`, and for policy fixes once isolated use `network-security`.

hybridaione Bundle

Read Blink camera and video-doorbell state, list motion clips, and prepare guarded home-security control requests without exposing Blink credentials.

vtex Bundle

Apply when handling credit card data, implementing secureProxyUrl flows, or working with payment security and proxy code. Covers PCI DSS compliance, Secure Proxy card tokenization, sensitive data handling rules, X-PROVIDER-Forward-To header usage, custom token creation, and the constraint that Secure Proxy applies only to card authorization (not post-auth operations like cancel, capture, or refund). Use for any payment connector that processes credit, debit, or co-branded card payments to prevent data breaches and PCI violations.

vtex Bundle

Apply when reviewing or designing security-sensitive boundaries in VTEX IO apps. Covers public versus private exposure, trust assumptions at route and integration boundaries, sensitive data handling, validating what crosses the app boundary, and avoiding leakage across accounts, workspaces, users, or integrations. Use for route hardening, data exposure review, or evaluating whether a service boundary is too permissive.

vtex Bundle

Apply when deciding whether VTEX Master Data is the right storage for a given workload, designing JSON Schemas with v-indexed, v-cache, v-security, and v-triggers, planning entity capacity and lifecycle, or auditing existing Master Data usage. Covers when to use MD versus Catalog, OMS, VBase, or external databases, schema design best practices, indexing strategy, trigger patterns, and operational considerations. Use before creating any new Master Data entity.