Security

metinduraktr-44 Bundle

Secure change management and CAB security gates.

metinduraktr-44 Bundle

Use when running the monthly security EXPERTS knowledge loop — reading, diffing, and updating the security expert digest without fabrication.

kcenon Bundle

Comprehensive security audit covering OWASP Top 10, input validation, authentication, authorization, secret management, dependency vulnerabilities, and injection attack prevention. Use when reviewing security posture, implementing auth flows, handling user input, auditing dependencies, conducting penetration test prep, or before production deployment.

j0kz Skill

Universal security checklist and fixes for ANY project type or language

bybren-llc Bundle

Plan and run programs using the SAFe x AI-DLC fusion. Use when turning an audit, epic, or initiative into tracker structure (initiative, projects, milestones, issues, sub-issues), organizing work as Units of Work and Bolts, wiring a dependency DAG, or running a Bolt swarm with a human-in-the-loop gate. Applies when work spans multiple issues and needs cadence.

bybren-llc Bundle

Row Level Security patterns for database operations. Use when writing any database query, creating API routes that access data, implementing webhooks that write to the database, or working with user data. Enforces withUserContext, withAdminContext, or withSystemContext helpers. NEVER use direct ORM/DB calls without RLS context wrappers.

wtthornton Bundle

Code reviewer providing objective quality metrics, security analysis, and actionable feedback. Use for code reviews with scoring, linting, type checking, and duplication detection.

bybren-llc Bundle

RLS validation, security audits, OWASP compliance, and vulnerability scanning. Use when validating RLS policies, auditing API routes for auth, scanning for vulnerabilities, reviewing for exposed credentials, or performing pre-deployment security review. Do NOT use for routine feature development.

thkt Skill

発見した問題が本物か、提案したアイデアが使えるかを 2 フェーズで判定する。Phase 1 は OUTCOME.md と並列 subagent の証拠に対し、subagent 検証と advisor 判断をループで回して設計の分岐を自力で解決する。残る分岐のうち不可逆なものだけをユーザーへ確認し、他は仮定を明記して進める。Phase 2 は critic-design の subagent 2 体 (内部攻撃 / OUTCOME.md 攻撃) を devil's advocate として起動する。判定は GO / NO-GO を最上段に出す。コードレビューの findings には使わない (audit workflow を使う)。outcome の assertion にも使わない (/assert に adversarial testing が組み込まれている)。

thkt Bundle

サイレント失敗の検出。セキュリティ (use-context-reviewer-security)、可読性 (use-context-reviewer-readability) には使わない。

thkt Bundle

OWASP Top 10 のセキュリティ レビュー。可読性 (use-context-reviewer-readability)、テスト設計 (use-context-reviewer-testability) には使わない。

kmshdev Bundle

Review Apple app code read-only for architecture, code quality, security, test coverage, and performance.

thkt Bundle

コードの可読性レビュー。セキュリティ (use-context-reviewer-security)、エラーハンドリング (use-context-reviewer-silence)、テスト設計 (use-context-reviewer-testability) には使わない。

thkt Bundle

テスト可能なコード設計のレビュー。セキュリティ (use-context-reviewer-security)、可読性 (use-context-reviewer-readability) には使わない。

ninthspace Skill

Structured audit of the codebase across the project's dimensions of code health. Findings are rows carrying a citation, a dimension and a severity as typed references; the audit is pinned to the commit it was taken at, and its results can be piped into the library, a spec or a quick change. Triggers on "/dpm:audit".

kynetic-ai Skill

Translate approved plans into specs and tasks. Import structured documents or create incrementally. Plans persist as durable artifacts with audit trail.

kynetic-ai Bundle

Triage inbox items systematically. Records decisions with audit trail, then executes actions. Supports inbox, observations, and automation eligibility triage.

kynetic-ai Skill

Process inbox items using the record-act pattern. Categorize, promote to spec/task, merge duplicates, defer, or delete stale items with full audit trail.

kbanc85 Skill

Memory Audit

inspirai-store Skill

查看当前 skill 启用状态、禁用列表和上次扫描摘要

matrixx0070 Skill

Audit project dependencies for known CVEs and produce a prioritized remediation plan.

matrixx0070 Skill

Drive a security incident through contain, eradicate, recover, and postmortem phases.

ndhananj Skill

Java Spring Boot 服务中关于身份验证/授权、验证、CSRF、密钥、标头、速率限制和依赖安全的 Spring Security 最佳实践。

talont-org Skill

Audit codebase for adherence to architectural standards, practices, and rules. Use when user says "audit arch", "audit architecture", "check architecture", or "architectural review". Spawns parallel subagents to examine multiple architectural aspects and generates a structured report.

talont-org Skill

Audit the test suite for useless tests, consolidation opportunities, over-mocking, weak assertions, placement/organization issues, xdist safety violations, test path filter integrity, and other test quality issues. Use when user says "audit tests", "audit test suite", "review tests", or "test quality check". Generates an improvement plan in {{AUTOSKILLIT_TEMP}}/ with explanations for each proposed change.

talont-org Skill

Audit codebase for internal cohesion - how well components fit together and maintain consistent patterns. Distinct from audit-arch (which checks rule violations); this checks integration fitness and convergence. Use when user says "audit cohesion", "check cohesion", "cohesion audit", or "alignment check".

talont-org Skill

Validate audit findings from audit-arch, audit-tests, audit-cohesion, audit-feature-gates, audit-docs, or audit-review-decisions against actual code, git history, and design intent using 9–10 parallel subagents. Removes contested findings, documents exceptions, adjusts severities. Use when user says "validate audit", "validate findings", "validate report", or "check audit results".

avav25 Skill

Security scan workflow — dependency audit, OWASP checklist, secrets scan, vulnerability report. Applies software-engineer role with security focus. Use standalone or as part of code review.

netdata Bundle

Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized. Not for CodeQL query authoring, CI configuration, Dependabot, or secret scanning.

netdata Bundle

Inspect, review, or apply authorized triage decisions to SonarCloud issues and security hotspots; also review the Sonar helpers. Use for SonarQube/SonarCloud findings, code smells, vulnerabilities, and quality-gate evidence. Supplied evidence needs no live query; per-finding writes and project-wide policy changes have distinct scopes.

kanevry Skill

Use when creating, modifying, or debugging Claude Code hooks — PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification. Covers the plugin `hooks/hooks.json` wrapper format vs. the user `settings.json` direct format, matchers, security patterns, `$CLAUDE_PLUGIN_ROOT` portability, lifecycle limitations, and debugging. Trigger on "add a hook", "validate tool use", "block dangerous commands", "enforce completion", "hook-based automation".

dsifry Skill

Automatic review gate that runs after brainstorming completes - spawns PM, Architect, Designer, Security, and CTO agents in parallel, iterates until all approve

peterbamuhigire Bundle

Use when creating or upgrading a portable Linux operations skill in this engine; distinguishes authoring contracts from executing `linux-sysadmin` workflows and from the read-only `skill-safety-audit` review gate.

peterbamuhigire Skill

Use when reviewing a new or changed skill package for unsafe installers, credential collection, hidden execution, unjustified privilege, or policy bypass; this read-only gate does not replace domain code review or `skill-writing` conformance work.

peterbamuhigire Bundle

Use when auditing or improving the Linux operations engine, linux-sysadmin skills, or any server, network, security, observability, automation, backup, database, or recovery product it produces.

fabioc-aloha Skill

Step-back protocol — restate, generalise, specialise, invert, ask why, pre-mortem, check stakeholders, and audit framings before solving