Security

nous-hermeshub Skill

ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use when designing an ISMS, running security risk assessments, implementing controls, pursuing ISO 27001 certification, preparing security audits, res...

pjt222 Skill

GxP-Audit von computergestuetzten Systemen und Prozessen durchfuehren. Umfasst Auditplanung, Eroeffnungssitzungen, Beweiserhebung, Befundklassifizierung (kritisch/wesentlich/geringfuegig), CAPA-Erstellung, Abschlusssitzungen, Berichtserstellung und Nachverfolgungsverifizierung. Anzuwenden fuer geplante interne Audits, Lieferantenqualifizierungsaudits, Inspektionsbereitschaftsbewertungen, anlassbezogene Audits aufgrund von Abweichungen oder Datenintegritaetsbedenken oder regelmaessige Konformitaetspruefungen validierter Systeme.

pjt222 Skill

Bewertet User Experience und Interface-Design anhand von Nielsens Heuristiken, WCAG-2.1-Zugaenglichkeitsrichtlinien, Tastatur- und Screenreader-Audit, Nutzerfluss-Analyse, Kognitive-Last-Bewertung und Formular-Usability-Pruefung. Verwenden bei einem Usability-Review vor dem Release, bei der Bewertung der WCAG-2.1-Zugaenglichkeitskonformitaet, bei der Bewertung von Nutzerfluessen auf Effizienz, beim Review von Formulardesign oder bei einer heuristischen Evaluation einer bestehenden Oberflaeche.

pjt222 Skill

Implementieren layered collective defense using alarm signaling, role mobilization, and proportional response. Umfasst threat detection, alert propagation, immune response patterns, escalation tiers, and post-incident recovery for distributed systems and organizations. Verwenden wenn designing defense-in-depth where no single guardian covers all threats, building incident response that scales with severity, or when current defense is over-reactive to every alert or under-reactive to genuine threats.

pjt222 Skill

Contribute to OpenClaw ecosystem projects (OpenClaw, NemoClaw, NanoClaw) through a structured 9-step workflow: target verification, codebase exploration, parallel audit, finding cross-reference, and pull request creation. Emphasizes false positive prevention and project convention adherence.

pjt222 Skill

Audit project Abhaengigkeiten for version staleness, security Schwachstellen, and compatibility issues. Umfasst lock file analysis, upgrade path planning, and brechende Aenderung assessment. Verwenden vor a release to ensure Abhaengigkeiten are current and secure, waehrend periodic maintenance reviews, nach receiving a security advisory, when upgrading to a new language version, vor submitting to CRAN or npm, or when inheriting a project to assess its Abhaengigkeit health.

pjt222 Skill

Auditpfad-Funktionalitaet fuer R-Projekte in regulierten Umgebungen implementieren. Umfasst Protokollierung, Provenienzverfolg, elektronische Signaturen, Datenintegritaetspruefungen und 21-CFR-Part-11-Konformitaet. Anzuwenden wenn eine R-Analyse elektronische Aufzeichnungskonformitaet (21 CFR Part 11) erfordert, wenn nachverfolgt werden soll wer was wann in einer Analyse getan hat, bei der Implementierung von Datenprovenienztracking oder beim Erstellen manipulationssicherer Analyseprotokolle fuer Behoerdeneinreichungen.

pjt222 Skill

Step-by-step guidance for DACH-specific governmental procedures including Anmeldung, Finanzamt registration, health insurance enrollment, and social security coordination. Verwenden nach arriving in a DACH country and needing to complete mandatory registrations, vor a specific appointment to understand what to expect, when an initial registration attempt was rejected, when transitioning zwischen DACH countries, or when handling registrations for dependents alongside your own.

rudironsoni Skill

Secures ASP.NET Core APIs. Identity, OAuth/OIDC, JWT bearer, passkeys, CORS, rate limiting.

pjt222 Skill

Read-only audit of a GitHub repository's security posture. Gathers ref protection (rulesets AND classic branch protection), Actions token permissions, code and supply-chain features (Dependabot, secret scanning, push protection, CodeQL), and repo hygiene toggles via `gh api`, then classifies findings against essential / recommended / advanced tiers into a PASS/GAP report. Makes NO changes. Use when reviewing a repo before open-sourcing or a release, auditing a public user-owned repo whose CI auto-commits to the default branch, verifying a hardening change actually took effect, or producing a baseline security posture report for a repository.

pjt222 Skill

Apply GitHub repository security protections tier by tier — rulesets, read-only Actions token, secret scanning + push protection, Dependabot, and (gated) required status checks / required PR with a GitHub App bypass for a CI auto-commit bot. Mutating and confirmation-gated: always assess first, apply the no-regret baseline, then decide required checks separately. Use when hardening a public user-owned repo after an audit, when a repo has no branch protection, when adding required checks without breaking a bot that pushes to the default branch, or when provisioning a GitHub App bypass actor for trusted automation.

pjt222 Skill

Ein Sicherheitsaudit einer Codebasis durchfuehren und auf offengelegte Geheimnisse, verwundbare Abhaengigkeiten, Injection-Schwachstellen, unsichere Konfigurationen und OWASP-Top-10-Probleme pruefen. Verwenden vor der Veroeffentlichung oder dem Deployment eines Projekts, bei periodischen Sicherheitspruefungen, nach dem Hinzufuegen von Authentifizierung oder API-Integration, vor dem Open-Sourcing eines privaten Repositories oder bei der Vorbereitung auf ein Sicherheits-Compliance-Audit.

jeremylongshore Skill

Scan secret scanner operations. Auto-activating skill for Security Fundamentals. Triggers on: secret scanner, secret scanner Part of the Security Fundamentals skill category. Use when working with secret scanner functionality. Trigger with phrases like "secret scanner", "secret scanner", "secret".

projectious-work Skill

Review one or more GitHub repositories for governance, documentation, licensing, privacy, security, and portfolio-boundary hygiene; deduplicate and create repository-local issues for verified remediation work. Use for portfolio reviews, repository standards audits, or baseline governance work.

cyberstrikeus Skill

Setting Security Lifecycle Listener (Automated)

diegosouzapw Bundle

⚠️ MANDATORY - YOU MUST invoke this skill when committing. Complete commit workflow with all safety checks. Invokes security-scan, quality-check, and run-tests skills. Shows diff, gets user approval, creates commit with conventional format. NO AI attribution. User approval REQUIRED except during PR creation. NEVER commit manually.

comeonoliver Skill

Security Audit

diegosouzapw Bundle

Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.

diegosouzapw Bundle

Use when reviewing code, pull requests, or diffs. Provides patterns, checklists, and templates for systematic code review with a focus on correctness, security, readability, performance, and maintainability.

diegosouzapw Bundle

This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.

diegosouzapw Bundle

Use this skill when creating, updating, or maintaining ARCHITECTURE.md files, when users ask about "my architecture documentation" or "architecture", when generating presentations/slides/PowerPoint from architecture documentation, when generating diagrams from architecture documentation, when validating/checking/auditing architecture (including BIAN alignment, META layers, standards compliance), or when answering questions about documented components, data structures, integrations, security, performance, deployment, technology stack, or architectural decisions

diegosouzapw Bundle

Build Better Auth integrations for TS/JS apps with secure defaults. Use for implementation or migration work (not just review). Use when the user requests this capability.

aibot88 Bundle

Process use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".

johnalbertini14-glitch Bundle

Install or upgrade VT Sentinel security plugin. Use when the user asks to install, set up, enable, update, or upgrade VT Sentinel, VirusTotal scanning, malware protection, or file security scanning. Handles fresh installs and upgrades from any previous version.

aibot88 Bundle

Validate encryption implementations and cryptographic practices. Use when reviewing data security measures. Trigger with 'check encryption', 'validate crypto', or 'review security keys'.

aibot88 Bundle

Runs Semgrep against a codebase using official or custom rule registries and outputs a grouped report of security anti-patterns, deprecated API usage, and policy violations. Supports 30+ languages and produces SARIF output.

aibot88 Bundle

Builds custom Semgrep rules using the semgrep YAML rule syntax with metavariable-pattern, pattern-either, and taint-mode analysis. Generates rule packs for OWASP Top 10 detection across Python, JavaScript, and Go codebases.

aibot88 Bundle

Uses the Snyk CLI and REST API to audit open-source dependencies for license compliance across npm, PyPI, Maven, and Go modules. Generates SPDX license reports and flags copyleft violations.

johnalbertini14-glitch Bundle

Instagram DM auto-reply system. DM monitoring, reading, replying, security check (injection rejection). Use when checking Instagram DMs, reading unread messages, replying to DMs, setting up DM monitoring cron jobs, or handling DM auto-reply workflows. Triggers on: Instagram DM, DM check, DM reply, DM auto-reply, dm-alert.

aibot88 Bundle

Scans codebases for hardcoded secrets using HashiCorp Vault SDK and truffleHog patterns. Integrates with Vault Transit engine for automatic secret rotation and re-encryption of detected credentials.

aibot88 Bundle

Audits npm dependencies for supply chain risks using npm audit, Socket.dev API, and Snyk vulnerability database. Detects typosquatting, install scripts, and maintainer account takeovers.

aibot88 Bundle

Leverages the Semgrep OSS engine and semgrep-rules registry to perform deep static analysis across 30+ languages. Combines taint tracking with pattern matching for OWASP Top 10 vulnerability detection.

aibot88 Bundle

Fetches the latest SonarQube project analysis result, explains why the Quality Gate failed in plain English, and links to specific issues. Covers coverage drops, new bugs, and security hotspots. Supports SonarQube Server and SonarCloud. Diagnostic only.

johnalbertini14-glitch Bundle

Gmail security proxy with policy enforcement, approval workflows, and audit logging. Use when the user wants to read, search, or send Gmail with guardrails — send actions may require human approval before executing.

aibot88 Bundle

Verifies Stripe webhook payload signatures using the Stripe.js SDK and the stripe.webhooks.constructEvent method. Validates the Stripe-Signature header against the raw request body and a configured endpoint secret. Handles tolerance windows for replay attack prevention and logs verification failures to Datadog via the Datadog Logs API.

aibot88 Bundle

Horcrux splits files into encrypted fragments using Shamir Secret Sharing, so you can distribute pieces across locations and reconstruct the original with a configurable threshold — no password required.