Security

velimirmueller Bundle

Use when page copy must pass brand, legal, or regulatory rules before going live — checks the visible copy of a public page against a rules file (the project's .claude/rubrics/copy-compliance.md if present, else the bundled template covering prohibited claims, required disclaimers, tone and address, terminology, locale formatting, substantiation) and reports every violation with the quoted text, the rule it breaks, and a compliant rewrite. A cheap pre-publish gate.

the-notorious-avengers Bundle

SaaS legal document generation and maintenance specialist. Covers Terms of Service, Privacy Policy, DPA, MSA, and Cookie Notice using the template+lawyer-review path. Anchored in Termly/Iubenda generators and GDPR/CCPA/Quebec Law 25/LGPD compliance postures. Use when the user says "generate a privacy policy", "draft a DPA", "set up our Terms of Service", "review a customer DPA redline", "which legal doc generator should I use", "GDPR compliance for SaaS", or when legal-docs-guardian is invoked. Do NOT use for technical data-protection controls (security-guardian), database schema for personal-data fields (db-guardian), or contract negotiation strategy beyond the DPA (legal team).

the-notorious-avengers Bundle

Architecture Decision Records specialist — Nygard format (Context / Decision / Consequences), MADR extended template, Y-statement framing, supersession and deprecation lifecycle, Log4brains and adr-tools CLI integration, and the "decisions, not docs" philosophy. Use when authoring a new ADR, superseding an existing decision, auditing the ADR log, setting up Log4brains, or onboarding a team to ADR practice. Do NOT use for general knowledge-base authoring (library-guardian), code entity extraction (wiki-guardian), or security review of the decisions themselves (security-guardian).

the-notorious-avengers Bundle

Writing docs well -- the Diataxis framework (tutorial / how-to / reference / explanation), inverted-pyramid prose structure, scannable headings, code-example discipline, the "what does the reader already know?" reader-lens, ghostwriting vs voice consistency, and the docs-as-code review workflow. Distinct from docs-site-guardian (which owns the platform); this weapon owns the craft of writing. Use when the user says "review this document", "is this doc well-written", "audit this page", "write a tutorial for X", "apply Diataxis", "ghostwrite this guide", "my docs PR needs a writing review", or any request about documentation quality rather than documentation tooling.

the-notorious-avengers Bundle

Operational runbook authorship specialist — canonical templates (break-fix, scheduled operation, diagnostic), the no-implied-context audit protocol, exact-command discipline, escalation path architecture, rollback procedure standards, runbook-as-test (game day) methodology, and postmortem-to-runbook linkage. Activate when the user says "write a runbook", "audit this runbook", "our runbooks are out of date", "we need a runbook for this alert", "turn this postmortem into a runbook", "schedule a game day", "our on-call docs are weak", or when `runbook-writing-guardian` is invoked. Do NOT activate for incident management tooling setup (PagerDuty/OpsGenie — route to devops-guardian), infrastructure provisioning decisions (route to devops-guardian), or documentation culture/process design beyond the runbook format (route to library-guardian).

the-notorious-avengers Bundle

Support stack specialist for SaaS products — selects the right tool from Plain, Pylon, Front, Help Scout, and Intercom; configures shared inboxes; designs AI-deflection flows (Fin 2.0, Ari, Crisp Bot); sets SLA tiers; wires integrations to Slack, Linear, and Notion; and provides a founder-as-support playbook for teams of 1-3. Invoke when choosing a support tool, auditing an existing stack, configuring AI deflection, designing SLA policy, or setting up escalation to Linear. Do NOT invoke for chat widget installation code (live-chat-support-guardian), auth SSO (auth-guardian), or GDPR/retention audits (security-guardian).

the-notorious-avengers Bundle

Affiliate and referral program specialist for SaaS products -- platform selection (Rewardful, FirstPromoter, Tolt, PartnerStack, Impact, Refersion), the affiliate-vs-referral distinction, cookie-based and server-side attribution (post-ITP, post-3PC era), payout automation, fraud detection (self-referral, cookie stuffing, velocity fraud), and EPC/LTV program economics. Invoke when the user says "set up an affiliate program", "which affiliate platform should I use", "Rewardful vs FirstPromoter", "my attribution is broken in Safari", "referral program fraud", "EPC or LTV for our program", "20% recurring commission", "postback tracking setup", or "PartnerStack vs FirstPromoter". Do NOT invoke for Stripe subscription billing mechanics (payments-guardian), API key secret management (security-guardian), custom attribution DB schema (db-guardian), or outbound partner recruitment campaigns (cold-outreach-guardian).

the-notorious-avengers Bundle

Customer support surface specialist — Intercom, Crisp, Plain, Pylon, Help Scout — widget integration, HMAC/JWT identity verification, conversation routing, AI deflection (Fin 2.0, Ari, Crisp Bot), and the data-export discipline. Use when the user says "integrate live chat", "set up Intercom", "add a support widget", "wire HMAC identity verification", "configure AI deflection", "design conversation routing", or "set up customer support for our SaaS". DO NOT use for managing deployments (devops-guardian), application authentication (auth-guardian), or security audits of the resulting integration (security-guardian).

arcdodo Bundle

审查已有或正在编写的 Codex/Claude Code Skill 的设计质量、问题边界和可复用性，并提出可执行修订建议。当用户要求审查、评估、改进、精简、拆分或合并 Skill、SKILL.md、Skill 文件夹、Skill 触发描述或工作流时使用；尤其适用于判断 Skill 是否过宽、过窄、职责混杂、触发不准、缺少 Gotchas、验证不足或渐进披露不合理。不要用它代替领域产出质量审查，也不要在用户仅要求从案例创建新 Skill 时单独使用。

tyler-r-kendrick Bundle

Use when designing authentication and authorization systems — OAuth 2.0 flows, JWT handling, session management, RBAC/ABAC models, multi-tenancy patterns, and security header configuration. USE FOR: authentication design, authorization models, OAuth 2.0 flows, JWT implementation, session management, RBAC, ABAC, multi-tenancy patterns, identity provider selection, security headers, CORS configuration DO NOT USE FOR: API endpoint design (use api-design), security scanning/SAST (use testing/static-analysis), infrastructure security (use iac)

mamamou Bundle

PostgreSQL best practices, query optimization, schema design, security, operations, and performance tuning. Load when working with Postgres databases.

mamamou Bundle

Graphene-Django best practices, N+1 prevention, query optimization, schema design, security, caching, and testing. Load when working with graphene-django GraphQL APIs.

mamamou Bundle

Strawberry-Django best practices — DjangoOptimizerExtension, DataLoader, type-hint-first schemas, CRUD mutations, filters/pagination/Relay, permission extensions, security hardening, async/subscriptions, and testing. Load when working with strawberry-graphql-django.

mamamou Skill

Proactive secure coding companion that embeds security controls while writing code — not after. Trigger when user says "write secure", "build with security", "implement authentication", "add authorization", "handle user input", "create API endpoint", "set up session management", "encrypt", "hash password", "secure this endpoint", "add rate limiting", "implement RBAC", "handle file upload", "store secrets", "set up CORS", "add CSRF protection", "validate input", "sanitize output", "secure defaults", "harden this", "zero trust", or when writing any code that touches authentication, authorization, user input, cryptography, sessions, file I/O, external calls, or sensitive data. Do NOT replace security-auditor (post-hoc vulnerability hunting) — this skill builds security in from the start. Do NOT replace code-reviewer security pillar — this skill is for writing, not reviewing. (updated 2026-03-28)

hzhijun0724 Bundle

Research AI industry trends and stock opportunities through a Leopold Aschenbrenner / Situational Awareness lens. Use when analyzing AGI timelines, AI infrastructure bottlenecks, power and data-center demand, semiconductors, optical networking, lab security, US-China AI competition, public 13F holdings, interviews, essays, and qualitatively driven idea generation.

nikoxkx Skill

Reviews a web application against the OWASP Top 10 vulnerabilities. Use when performing a security review or preparing a security assessment report.

nikoxkx Skill

Detects hardcoded secrets, API keys, and credentials in codebases and git history. Use when auditing code for leaked secrets or setting up pre-commit secret detection.

nikoxkx Skill

Checks application and infrastructure compliance against SOC 2, GDPR, HIPAA, or PCI-DSS requirements. Use when preparing for compliance audits or implementing regulatory requirements.

nikoxkx Skill

Audits third-party dependencies for known vulnerabilities, license issues, and supply chain risks. Use when reviewing dependencies before merging or deploying.

nikoxkx Skill

Overview

nikoxkx Skill

Audits REST or GraphQL APIs for OWASP API Top 10 vulnerabilities. Use when reviewing or testing the security of an API before launch or after changes.

nikoxkx Skill

Audits JWT implementation for common security vulnerabilities. Use when reviewing authentication systems that use JSON Web Tokens.

nikoxkx Skill

Runs automated vulnerability scans on codebases, dependencies, and containers. Use when auditing security before deployment or after adding new dependencies.

nikoxkx Skill

Creates a structured penetration testing plan for web applications and APIs. Use when planning a security assessment, red team exercise, or bug bounty program.

bassonrichard Skill

Use when reviewing a DVT REST or GraphQL API against the company security baseline before release. Walks authn/authz, input validation, rate limiting, secrets, and logging.

dafenxz0 Bundle

Review pull requests like an open-source maintainer. Use when Codex is asked to inspect PR diffs, branches, patches, or proposed changes and report behavioral regressions, API compatibility risks, security concerns, missing tests, release impact, documentation gaps, and merge readiness.

debashis2007 Bundle

Rigorous, severity-ranked review of a diff, PR, or file. Use when you want a thorough check of correctness, security, performance, design, readability, and test coverage with actionable feedback.

leinatorx Bundle

Audit short-video publishing materials through the Anxin Gemini-compatible API for WeChat Channels and Douyin compliance. Use this skill whenever the user asks to 审核短视频, 视频合规审核, 判断视频是否违规, 审核文稿, 审核口播稿, 审核字幕稿, 审核分镜图, 审核封面图, 微信视频号审核, 抖音审核, 短视频运营规则检查, 内容安全评估, 视频发布前检查, or wants to send local videos/images as base64 plus scripts to gemini-3.1-flash-lite-preview-thinking-high and receive violation risks plus revision advice.

yangyuchen-work Skill

API 安全测试器

miguelpecegueiro Skill

Review pull requests thoroughly, then deliver a short GitHub-ready comment (2-4 lines) plus optional detailed notes only when asked. Use when the user asks for a PR review, code review on a pull request link, or review feedback to post on GitHub. Also handles security-focused PR reviews when the user asks to "check for bad practices", "security review this PR", or "scan the diff for vulnerabilities" — in that case follow the Security lens section.

miguelpecegueiro Skill

Run a full security audit of the current codebase and produce a dated findings report saved to docs/. Use when the user says "security scan", "run security-scan", "audit this codebase for security issues", or "I need ISO 27001 evidence for this repo". Also triggers before a major release or after a significant feature is merged. Output is a markdown report saved to docs/security-scan-YYYY-MM-DD.md.

miguelpecegueiro Skill

Analyse a codebase and produce a Vibe-Code Confidence Score (0–100) plus a classification of authorship style. Use as a pre-step before any code review, intake, or audit when the origin of the code is unknown or suspected to be AI-generated without engineering oversight. The score and classification determine the review posture for subsequent analysis. Trigger whenever someone shares a codebase, repo, or set of source files and asks about code quality, authorship, or whether it was AI-generated. Also triggers on "run vibe-code-intake", "score this codebase", or "is this vibe-coded".

datasiteai Skill

Data Room Gap Analysis skill for Datasite deal rooms. Use this skill whenever a sell-side deal team wants to audit what is missing, sparse, or incomplete in their data room before going live to buyers. Triggers include: "run a gap analysis", "what's missing from the data room", "check the data room coverage", "flag empty folders", "what haven't we uploaded yet", "data room readiness check", "find gaps before we go live", "are all the contracts in there", "check we have everything", or any request to assess completeness of the data room by section. Use this skill proactively whenever a deal team is preparing to launch a data room and wants to know what still needs to be uploaded or organised. Do not use for document quality issues such as PII or redaction (use document-quality-check), or for drafting Q&A responses (use bulk-qa-answers).

yangyuchen-work Skill

安全 CTF 课程

shreyas70773 Bundle

USE THIS SKILL WHENEVER the user mentions database users / accounts, schemas, roles, privileges / grants / revokes, system or object privileges, profiles, password policy or a password verify / complexity function, account lock/unlock, expired / locked-out accounts, password reset/expire, default-password accounts, access requests / access provisioning or de-provisioning, periodic access review / recertification / dormant accounts, least privilege, proxy authentication (CONNECT THROUGH), Centrally Managed Users (CMU) / LDAP / Active Directory integration, or Enterprise User Security (EUS / OID / OUD) — EVEN IF they do not name the specific task — or the errors ORA-01017 (invalid login), ORA-28000 (account locked), ORA-28001 (password expired), ORA-01918 (user not exists), ORA-01031 (insufficient privileges), ORA-01919 (role not granted). Covers user/account lifecycle, schema & role creation/assignment, system/object grants (idempotent + reversible), profiles & password verify functions, standard access-reques

datasiteai Skill

Risk Analysis Audit skill for Datasite deal rooms. Use this skill whenever a sell-side deal team wants to audit, review, or flag risks across a data room before going live. Triggers include: "run a risk audit", "flag risks in the data room", "risk review", "what are the risks in this deal", "audit the data room", "risk analysis", "flag issues before we go live", "what should we fix before launch", or any request to analyse deal risk by workstream (Tax, Finance, Legal, HR, IP, Commercial, Regulatory, ESG). Use this skill proactively whenever the user is preparing a data room for launch and wants a structured view of what might concern a buyer. Do not use for document quality issues like PII or redaction (use document-quality-check), or for identifying missing sections (use gap-analysis).