Security

myfintechpl Skill

Cross-language standards for generating or modifying code in this repo. Emphasizes security, consistency, and reuse (prefer lib/ helpers over ad-hoc code).

myfintechpl Bundle

Python scripting standards for safe, consistent, reusable code. Use when creating or editing Python scripts, CLIs, or automation. Emphasizes security, error handling, typing discipline, and reuse (prefer lib/ helpers).

freddy-chen-ux Skill

Security fundamentals and best practices

yasuaki-i Skill

Review code for bugs, security issues, and best practices. Use when checking PRs or analyzing code quality.

snakeo Skill

Debug Spring Boot issues systematically. Use when encountering bean errors like NoSuchBeanDefinitionException, circular dependency issues, application startup failures, JPA/Hibernate problems including LazyInitializationException and N+1 queries, security misconfigurations causing 403 Forbidden errors, property binding failures, CSRF token issues, or any Spring Boot application requiring diagnosis with Actuator endpoints and JVM debugging.

freddy-chen-ux Skill

Security review with blocking authority for critical vulnerabilities

freddy-chen-ux Skill

Docs as QA: audit doc coverage and freshness, validate runbooks, and maintain documentation quality gates for APIs, services, events, and operational workflows.

atomic-kanta-sasaki Skill

Webアプリケーションのセキュリティレビューを実施。 OWASP Top 10に基づく脆弱性チェック、認証・認可の検証、入力バリデーション確認。 セキュリティチェック、脆弱性診断、コードのセキュリティ評価時に使用。

onlyoneaman Skill

Reviews code for best practices, bugs, security issues, and provides improvement suggestions

gurdasnijor Bundle

Comprehensive code review skill for TypeScript, JavaScript, Python, Swift, Kotlin, Go. Includes automated code analysis, best practice checking, security scanning, and review checklist generation. Use when reviewing pull requests, providing code feedback, identifying issues, or ensuring code quality standards.

gurdasnijor Bundle

Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking, and security automation. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or ensuring compliance requirements.

lodetomasi Skill

Penetration testing workflows with ffuf, Metasploit, and security assessment tools

gurdasnijor Bundle

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.

dannymac180 Bundle

Codex-native risk-gated selective routing: default solo delivery, targeted native delegation or audit, and exceptional full review.

devantler-tech Skill

Maintain the data-product-controller control plane, portable descriptor contract, registry, chart, and deployment readiness.

lodetomasi Skill

Dynamic Application Security Testing for runtime vulnerability detection in web applications

getsentry Skill

Analyze and propose fixes for Dependabot security alerts

lodetomasi Skill

Automated code review with comprehensive checklist covering architecture, security, performance, and best practices

lodetomasi Skill

Static Application Security Testing with Semgrep, SonarQube, and AI-assisted vulnerability detection

lodetomasi Bundle

Automated security scanning for hardcoded secrets, insecure file permissions, vulnerable dependencies, and unsafe code patterns

graphistry Skill

Review a pull request or branch for spec fit, correctness, security, tests, and repository conventions. Use parallel, narrowly scoped analysis and isolated adversarial checks before reporting evidence-backed findings.

rcarmo Skill

Project conventions with module caching, linting, security checks, and tests via Make

wubing2023 Bundle

Build, rewrite, audit, submit, revise, or transfer scholarly papers end to end, producing verified LaTeX/PDF/Word and target-specific publication packages.

roin-orca Skill

test.

getsentry Bundle

Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.

hyhmrright Bundle

Compare two code versions for semantic equivalence via semi-formal tracing of both versions side-by-side. Trigger when the user shares a refactor, rewrite, migration, or A/B implementation and wants to confirm behavior is unchanged — "did I break anything", "is this equivalent", "are these equivalent", "semantically equivalent", "are these two implementations semantically equivalent", "check my refactor", "same behavior after the change?", "does my rewrite produce the same output", "switched from X to Y — same results?". SCOPE HARD RULE: requires two code versions (A and B). A single version for bug-finding uses logic-review; one version + a failing test uses logic-locate; explaining what one piece of code does uses logic-explain; codebase audit uses logic-health. Do NOT trigger for: single-version review, performance comparison, design-quality comparison, or "which is better-written" questions.

hyhmrright Bundle

Locate the root cause of a CONFIRMED failure via backward-then-forward semi-formal tracing. Trigger when the user provides a stack trace, failing assertion, error message, or specific wrong-value observation — "find the bug", "this test is failing", "track down this crash", "why is this test failing", "KeyError at line 89", "expected 70, got 100", "NoneType has no attribute X", "cart empties when second tab opens". SCOPE HARD RULE: requires a concrete failure (exception, failing test, or specific wrong output). Vague suspicion without evidence uses logic-review; behavior explanation uses logic-explain; refactor comparison uses logic-diff; codebase audit uses logic-health. Do NOT trigger for: vague "what's wrong" without a concrete symptom, style questions, or performance issues.

hyhmrright Bundle

Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Trigger when a user shares code and suspects something is wrong without naming a concrete failure — phrases like "review this", "does this look right", "check this function", "audit this code", "tests pass but prod fails". SCOPE HARD RULE: one file or one function only. For a directory or whole module use logic-health; for a confirmed failure (stack trace, failing test, specific wrong value) use logic-locate; for two versions use logic-diff; for repo-wide autonomous fixing use logic-fix-all. Do NOT trigger for: style/formatting, security scanning, performance, test generation, architecture or design questions.

hyhmrright Bundle

Explain what a specific piece of code actually does for a given input by producing a step-by-step execution trace (interprocedural, with name resolution and type transitions). Trigger when the user is confused about behavior or asks why code produces X instead of Y — "walk me through this", "trace through X with input Y", "why does this return X", "what does yield-from do here", "explain the execution path". SCOPE HARD RULE: a specific function + a specific input scenario. If the user wants to find bugs without a scenario in mind, use logic-review; two-version comparison uses logic-diff; concrete failures use logic-locate; codebase-wide audit uses logic-health. Do NOT trigger for: finding bugs without a behavioral question, style or design discussion, or concept explanations not tied to specific code.

pluginagentmarketplace Bundle

Master Kubernetes security, RBAC, network policies, pod security, and compliance. Learn to secure clusters and enforce access control.

get-convex Skill

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, and public queries leaking PII/financial data by a client-supplied id — the single largest real-defect cluster measured against generated Convex backends (44 of 214). Runs a deterministic scan for the 3 shapes, then applies the canonical requireIdentity/requireOwner pattern, then verifies with tsc. TRIGGER on 'secure my app', 'audit auth', 'add login', 'who can access this data', or an explicit 'audit my authz'. NOT always-on. SKIP when there is no convex/ directory.

get-convex Bundle

Audits and optimizes Convex application performance across hot-path reads, write contention, subscription cost, and function limits. Use this skill when a Convex feature is slow or expensive, npx convex insights shows high bytes or documents read, OCC conflict errors or mutation retries appear, subscriptions or UI updates are costly, functions hit execution or transaction limits, or the user mentions performance, latency, read amplification, or invalidation problems in a Convex app.

rainmanjam Skill

Reviewing existing code for unchecked inputs, unguarded dereferences, unhandled failure paths, swallowed exceptions, missing timeouts and absent limits: the places where an unexpected value becomes an unhandled failure.

contentstack Skill

PR review checklist for datasync-asset-store-filesystem — use when opening or reviewing pull requests.

microsoft Skill

Review SynapseML Python and Scala code changes. Use before finalizing PR reviews or implementation changes to check security, compatibility, style, generated code, and targeted tests.

openai Bundle

Audit or update authored English SDK documentation within a requested topic or diff using implementation evidence.