Security

roanbrasil Skill

Use when working with MQTT for IoT, mobile, or real-time applications — topic design, QoS levels, broker selection, device shadows, security, or MQTT 5.0 features

persimmon-automation-labs Skill

Security — Index

iceman1001 Bundle

Run the ilspycmd CLI on .NET assemblies to decompile them to readable C# BEFORE reading or analyzing them. Use this skill any time the user provides a `.dll`, `.exe`, `.netmodule`, `.winmd`, or `.nupkg` file and wants Claude to read, analyze, explain, audit, reverse-engineer, debug, extract secrets/keys/URLs from, or understand it — especially if the file is a compiled managed binary rather than source. Trigger this skill even when the user does NOT explicitly say "decompile" — the goal is that Claude is always reasoning about C# source rather than IL or opaque bytes. Also trigger when the user points at a directory of assemblies (e.g. a `bin/Release/` dump, a plugin folder, or an extracted NuGet package) and asks about its behavior. Do NOT trigger for source files (`.cs`, `.fs`, `.vb`), for native unmanaged PE binaries, or when the user explicitly asks about raw IL, metadata tables, or byte-level questions.

iceman1001 Bundle

Run the webcrack CLI on JavaScript files to deobfuscate, unminify, and unbundle them BEFORE reading or analyzing them. Use this skill any time the user provides a `.js`, `.mjs`, or `.cjs` file and wants Claude to read, analyze, explain, audit, modify, reverse-engineer, debug, or understand it — especially if the file appears minified, bundled (webpack/browserify/rollup/parcel), or obfuscated (obfuscator.io, string arrays, control-flow flattening, hex identifiers like `_0xabc123`). Trigger this skill even when the user does NOT explicitly say "deobfuscate" — the goal is that Claude is always reasoning about readable code rather than mangled output. Also trigger when the user pastes a long single-line JavaScript blob into chat. Do NOT trigger for clearly hand-written, well-formatted source files.

leo4135 Skill

Creates STRIDE-based threat models for JavaScript/TypeScript web applications. Use when the user asks for threat modeling, attack surface analysis, trust boundary mapping, or security architecture review.

leo4135 Skill

Audits npm/yarn/pnpm dependencies for known vulnerabilities, outdated packages, license risks, and suspicious packages. Use when the user asks for dependency audit, npm audit, CVE check, or supply chain review of packages.

leo4135 Skill

Maps JavaScript/TypeScript vulnerabilities to OWASP Top 10 (2021) with detection patterns, code examples, and remediation. Use during security audits, when the user mentions OWASP, or when categorizing security findings.

leo4135 Skill

Manages versioning and releases for cursor-javascript-security-skills and projects using these security skills. Use when creating a GitHub release, updating CHANGELOG, tagging versions, or when the user asks about release process for security skills.

leo4135 Skill

Formats security vulnerability findings and guides responsible disclosure workflows. Use when writing security bug reports, CVE submissions, creating SECURITY.md, or when the user asks how to report a security vulnerability.

leo4135 Skill

Orchestrates end-to-end security audits of JavaScript/TypeScript web applications. Use when the user asks for a security audit, vulnerability assessment, security review, penetration test preparation, or wants to find security bugs in a JS/TS project.

rahulrachhoya Skill

Conduct systematic code reviews with clear quality gates, security checks, and actionable feedback.

rahulrachhoya Skill

Perform systematic security audits covering OWASP Top 10, dependency vulnerabilities, and data protection.

roanbrasil Skill

Production security hardening — OWASP Top 10, secret management, JWT security, input validation, security headers, threat modeling, SAST, and container hardening.

persimmon-automation-labs Skill

NextAuth v5 Credentials — Persimmon Patterns

persimmon-automation-labs Skill

Security Hardening — Persimmon Patterns

rahulrachhoya Skill

Store, rotate, and audit secrets securely — never hardcode, never commit, never share.

rahulrachhoya Skill

Manage third-party dependencies intentionally — minimize, pin versions, audit regularly.

persimmon-automation-labs Skill

Audit, scaffold, or update project documentation for any Persimmon client project. Use when setting up docs for a new project, auditing existing docs, updating CLAUDE.md after architecture changes, or adding ADRs. Enforces Persimmon lean documentation conventions — CLAUDE.md + README.md + scope-of-work + ADRs, no more. Triggers — "audit docs", "update README", "update CLAUDE.md", "scaffold docs", "add ADR".

roanbrasil Skill

Expert Spring Boot 3.x guidance — auto-configuration, Spring Data, Security, WebFlux, Actuator, testing, performance, and production pitfalls

roanbrasil Skill

Design production-quality API contracts — REST, gRPC, GraphQL — covering OpenAPI 3.1, versioning, breaking changes, error handling, pagination, security, and contract testing

roanbrasil Skill

Apply CQRS and Event Sourcing when designing systems with complex write/read separation, audit requirements, or event-driven workflows — invoked when discussing command/query separation, event stores, projections, sagas, or eventual consistency.

persimmon-automation-labs Skill

The lean, tiered provenance system for Persimmon projects — every requirement, screen, flow, and decision resolves upward to a source (the SOW, an ADR, or the standing constitution), with rigor scaled by project-type × project-stage. Defines the ID namespace, the spine, the tiering matrix, the docs/ homes, and the traceability-audit (detection, not enforcement). Invoke when speccing/planning a non-trivial feature, when asked 'is this traceable / are all flows covered', or at a demo/handoff gate. Trigger keywords: traceability, RTM, requirements matrix, orphan, are all flows covered, REQ ID, provenance.

roanbrasil Skill

Design production-quality GraphQL schemas — type system, mutation patterns, pagination, N+1 DataLoader, federation, security, and schema evolution

jakelabate Bundle

Audit a website for soft 404s — pages that return HTTP 200 but are really "not found", empty, or error pages. Crawls pages and sends a missing-page probe to find error pages served with a 200 status, a server that returns 200 for every unknown URL instead of a real 404/410, thin pages matching the site's error template, and empty/near-empty pages. Use when the user asks to audit, check, or fix soft 404s, soft 404 errors in Search Console, pages that should be 404 but return 200, fake/empty pages, or missing pages that don't return the right status code.

yalishevant Bundle

Design and generate layered Kotlin + Spring tests that balance speed, realism, and regression value across unit, slice, and integration levels. Use when adding coverage for business logic, controllers, repositories, security, serialization, or end-to-end workflows, and when generic AI output would otherwise overuse `@SpringBootTest`, misuse mocks, or ignore MockK and coroutine testing idioms.

yalishevant Bundle

Review Kotlin + Spring changes for behavioral regressions, transaction and proxy bugs, API and serialization mistakes, persistence risks, security issues, configuration drift, and missing tests. Use when reviewing a PR, diff, patch, or design change where generic style-focused review would miss Spring-specific correctness and operational risks.

jakelabate Bundle

Open Graph / Social Metadata Audit

jakelabate Bundle

Robots.txt Audit

jakelabate Bundle

Audit an HTTPS website for mixed content and insecure resources. Crawls pages and inspects every subresource to find active mixed content (http scripts, stylesheets, iframes, objects browsers block on https pages), insecure form actions that submit over http, passive mixed content (http images, audio, video), legacy protocol-relative (//) resource URLs, and pages still served over http. Use when the user asks to audit, check, or fix mixed content, insecure resources, the padlock / not-secure warning, an incomplete HTTPS migration, or http resources on an https site.

nisar999 Skill

Designs consistent REST, GraphQL, and gRPC APIs with versioning, documentation, and security. Use when defining API contracts, pagination, rate limiting, OpenAPI specs, or API gateways.

nisar999 Skill

Implements defense-in-depth security: OWASP Top 10, auth, encryption, zero trust, and secure coding. Use when hardening applications, APIs, infrastructure, or responding to security requirements.

nisar999 Skill

Develops secure Solidity smart contracts, DeFi patterns, wallet integration, and gas optimization. Use when writing smart contracts, Hardhat/Foundry tests, Web3 frontends, or audit preparation.

yalishevant Bundle

Diagnose and prevent Kotlin plus Spring proxy failures around `@Transactional`, `@Cacheable`, `@Async`, method security, retry, configuration proxies, and JPA entity requirements. Use when AOP annotations appear to do nothing, transactional or cache behavior is inconsistent, compiler plugins may be missing, self-invocation is suspected, or Kotlin final-by-default semantics may break Spring behavior.

yalishevant Bundle

Plan and execute risky Spring Boot, Spring Framework, Kotlin, Gradle, JDK, and major dependency upgrades with explicit compatibility checkpoints and rollback thinking. Use when preparing or diagnosing a major version jump, navigating `javax` to `jakarta`, K2 adoption, plugin compatibility, auto-configuration drift, behavior changes in Hibernate or Security, or project-specific upgrade sequencing.

yalishevant Bundle

Design and audit Spring Security configurations for Kotlin plus Spring services, including filter chains, JWT or OAuth2 resource server setup, method security, CORS, CSRF rationale, and public endpoint exposure. Use when adding or reviewing authentication and authorization, narrowing access rules, validating token handling, or checking for insecure defaults and accidental exposure.

jakelabate Bundle

Audit a website for keyword cannibalization — multiple pages competing for the same search query. Crawls pages and compares titles, H1s, and body keywords to find pages with duplicate title targets, clusters of pages whose keyword signatures overlap, and pages sharing the same primary keyword phrase. Use when the user asks to audit, check, or fix keyword cannibalization, pages competing for the same keyword, overlapping/competing content, keyword overlap, or which page should rank for a query on a website.