Security

iapro-community Bundle

Run defensive, explicitly authorized SaaS DAST and recon with scope controls. Use when asked to scan an owned local, staging, preview, or approved production URL, API endpoint, SaaS app, tenant boundary, public web surface, auth flow, exposed files, headers, TLS, or OWASP Top 10 behavior using tools such as ZAP, Nuclei, Katana, httpx, and Subfinder.

iapro-community Skill

Conduz threat modeling estruturado com STRIDE-A, fluxos de dados, fronteiras de confiança, riscos priorizados e comparação incremental.

iapro-community Bundle

Run defensive, authorized local security scans for owned SaaS repositories. Use when asked to scan local code, dependencies, secrets, containers, IaC, API handlers, Supabase projects, multi-tenant SaaS isolation, or release/security gates with maintained OSS tools such as Semgrep, Gitleaks, Trivy, OSV-Scanner, and OWASP Dependency-Check.

iapro-community Skill

Use for Google Workspace integrations with OAuth, Calendar, Meet, FreeBusy, Drive, Sheets, webhooks, least-privilege scopes, encrypted refresh tokens, idempotent writes, reconciliation jobs, consent revocation, validation, and sync audit trails.

williamzujkowski Bundle

Review identity and access management using NIST SP 800-63B guidelines with MFA enforcement, password policy, and least privilege validation.

williamzujkowski Bundle

Verify operating system hardening using CIS benchmarks with patch management, kernel hardening, and host-based firewall validation.

williamzujkowski Bundle

Create optimized Dockerfiles with multi-stage builds, security hardening, and vulnerability scanning for minimal, secure container images.

williamzujkowski Bundle

Validate application security using OWASP Top 10 2021 and API Security Top 10 guidelines with injection prevention and access control checks.

williamzujkowski Bundle

Validate cryptographic implementations using NIST standards with TLS configuration, cipher suite analysis, and certificate lifecycle checks.

williamzujkowski Bundle

Validates OSCAL System Security Plan documents against schemas, profiles, and cross-reference requirements with tiered validation depth.

williamzujkowski Bundle

Validate network security architecture with firewall rule analysis, segmentation verification, and defense-in-depth assessment.

williamzujkowski Bundle

Evaluate zero-trust architecture maturity using CISA ZTMM with identity verification, device trust, micro-segmentation, and continuous monitoring.

williamzujkowski Bundle

Design zero-trust architectures with identity-centric security, micro-segmentation, continuous verification, and CISA ZTMM maturity assessment.

williamzujkowski Bundle

Generate incident response playbooks for security incidents, outages, and disaster recovery with NIST SP 800-61 compliance and escalation paths.

williamzujkowski Bundle

Validate software supply chain security with SBOM generation, dependency scanning, provenance verification, and SLSA attestation.

tomevault-io Bundle

Web server scanner for dangerous files and misconfigurations Use when this capability is needed.

tomevault-io Bundle

セキュリティレビュー

felvieira Skill

Skill de auditoria inicial e continua do repositorio. Use quando precisar mapear stack real, convencoes, assets, testes, docs, riscos e pontos de integracao antes de executar outras skills. O resultado deve ser persistido em markdown reutilizavel para reduzir releitura e economizar tokens. Trigger em: "repo audit", "auditar repositorio", "mapear stack do projeto", "harnessability score", "repo-audit", "auditoria de repo", "fotografia do repo", "current.md", "mapear convencoes do projeto", "inventariar o codebase".

lyndonkl Bundle

Scores designs on cognitive checklists with ranked fixes.

plurigrid Bundle

This skill should be used when the user asks to "scan for TODOs", "find placeholders", "clean up stubs", "remove temporary code", "audit for incomplete code", or "erase substitutions from codebase". Scans existing files for placeholder tokens and generates remediation plan.

iapro-community Skill

Use for WhatsApp automation with Evolution API, including instance lifecycle, QR pairing, inbound and outbound messages, webhooks, consent, tenant isolation, queues, idempotency, rate limits, retries, audit logs, and reliable delivery.

iapro-community Skill

Use for Google Workspace integrations with OAuth, Calendar, Meet, FreeBusy, Drive, Sheets, webhooks, least-privilege scopes, encrypted refresh tokens, idempotent writes, reconciliation jobs, consent revocation, validation, and sync audit trails.

bkjohn2018 Skill

Writes governance-ready standard operating procedures with precise scope, role accountability, step controls, and audit-ready evidence requirements. Use when users ask to draft, improve, or standardize SOPs for operational, finance, or data governance processes.

bkjohn2018 Skill

Defines and maintains enterprise data standards for classification, access, quality, metadata, lineage, retention, integration, reference/master data, metrics, and analytical models. Use when creating a data standards catalog, mapping standards to DAMA-DMBOK capabilities and NIST SP 800-53 control considerations, or deciding what baseline requirements data products must satisfy. Use data-security-and-privacy-controls for asset-level security/privacy control design, policy-and-standard-writing for final mandatory language, and domain skills for implementation.

bkjohn2018 Skill

Applies DAMA-DMBOK aligned data management foundations across strategy, architecture, governance, quality, metadata, security, and lifecycle controls. Use when users ask for enterprise data management frameworks, operating models, role design, or maturity roadmaps. Use data-standards-management for detailed standards catalogs and data control requirements.

bkjohn2018 Skill

Structures governance presentation decks with clear decision narrative, control status, risk signals, and action tracking. Use when preparing steering committee, risk committee, audit, or executive governance slide decks.

bkjohn2018 Skill

Maps finance and accounting AI risks to governance, security, privacy, data, and internal control requirements using NIST AI RMF, NIST SP 800-53 concepts, DAMA-DMBOK, and finance control practices. Use when assessing AI use cases, agents, models, assistants, vendor AI, or automation for control objectives, owners, evidence, residual risk, and approval conditions.

felvieira Skill

Skill do Security Reviewer para auditoria de segurança e boas práticas. Use quando precisar revisar código para vulnerabilidades, validar implementação de auth, checar OWASP Top 10, revisar CORS/CSRF/XSS, garantir DRY e clean code, ou qualquer review de segurança. Trigger em: "segurança", "security review", "vulnerabilidade", "OWASP", "XSS", "CSRF", "CORS", "injection", "HttpOnly", "cookie seguro", "DRY", "code review", "boas práticas", "audit", "pentest", "sanitização".

felvieira Skill

Skill de auditoria em massa via personas simuladas: infere proto-personas do repositorio, confirma com o humano sem bloquear, e roda ate PR — encontra bugs, abre issues com dedup, analista comenta solucao, frota paralela abre PR onde a confianca e alta ou comenta wontfix, reviewer decide. Termina em issues residuais, nunca merge automatico. Trigger em: "simulando usuarios reais diferentes", "fazer a IA impersonar persona e testar o app", "encontrar bugs de usabilidade em massa antes do lancamento", "numa auditoria, como triar tudo isso", "frota de agentes paralelos abrindo PR", "regras de dedup de issue quando varios agentes reportam", "abrir PR automatica ou comentar wontfix", "escalar QA exploratorio com IA sem virar gargalo", "simular usuario nao tecnico testando o produto", "PRs deveriam ser aprovadas automaticamente", "nao tenho personas escritas, da pra gerar a partir do repo", "auditoria automatica do produto sem preparar nada antes", "inferir persona a partir do codigo do projeto".

dirtytrii Bundle

Codex adapter for Garry Tan's full gstack methodology across CEO/product pressure, CTO architecture, design, engineering, QA, security, shipping, documentation, and retrospectives. Use when the 总控/CEO or 架构/CTO role needs gstack method routing, implementation-plan hardening, or the user says gstack should help a role.

dirtytrii Bundle

GStack CSO method for broad infrastructure-first security posture review, threat areas, severity calibration, and safe remediation scope.

aidas-dev Skill

Use when configuring Cilium CNI networking, writing network policies, debugging pod connectivity issues, setting up LB IPAM or L2 announcements for Service LoadBalancer IPs, enabling BGP route advertisement, configuring transparent encryption or Hubble observability, or managing Cilium security features (host firewall, Local Redirect Policy, CiliumCIDRGroup). Not for Gateway API (use cilium-gateway).

pedroiff0 Bundle

How to pass server-side runtime config (API prefix, feature flags, user id, CSRF token) from an Express/EJS app to client JS when a strict Content-Security-Policy is in force (helmet default scriptSrc self, with no unsafe-inline). Use this whenever you need to inject a value the browser JS must read at runtime, but adding a script tag triggers a silent CSP block.

fworks-tech Skill

Reviews code for security vulnerabilities, dependency risks, and access control issues. Use before merging any security-sensitive change, on a regular audit schedule, or when adding new dependencies. The Auditor assumes breach and reads code the way an attacker would.

fworks-tech Skill

Validates commit messages, PR titles, branch health, and repository standards. Use to enforce conventions locally and in CI, run health checks, and audit repository hygiene. Nothing gets in without proper credentials.

fworks-tech Skill

Generates comprehensive pull request descriptions and conducts structured code reviews with security, performance, testing, and documentation focus areas. Use when opening a PR or reviewing one before merge.