Security

majiayu000 Bundle

Build production REST APIs with Go - handlers, middleware, security

majiayu000 Bundle

Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).

majiayu000 Bundle

Detect and resolve incoherence in documentation, code, specs vs implementation. Includes reconciliation phase for applying user-provided resolutions.

majiayu000 Bundle

Expert guidance for deep security investigations. Use this when the user asks to "investigate" a case, entity, or incident.

majiayu000 Bundle

Audit logs in project against fractary-logs best practices and generate actionable remediation specification

majiayu000 Bundle

Audit conversation alignment. Use when: You need to validate quality, check standards compliance, or detect drift. Not for: Creating content, executing tasks, or simple status checks.

majiayu000 Bundle

Configure Nginx and Nginx Proxy Manager for reverse proxying, load balancing, SSL/TLS termination, caching, and web serving. Use when setting up web servers, reverse proxies, SSL certificates, or load balancers. Includes Nginx Proxy Manager GUI, Traefik alternative patterns, and security hardening. (project)

majiayu000 Bundle

Review workscript node implementations for alignment with NODE_DEVELOPMENT_BLUEPRINT.md and consistency with the new-node skill. Use when reviewing node code, auditing node implementations, checking for compliance with single-edge return pattern, validating ai_hints metadata consistency, or ensuring thorough documentation of state interactions. Triggers on requests like "review this node", "check node compliance", "audit node implementation", or "validate node metadata".

majiayu000 Bundle

Audit infrastructure for cost, security, and compliance - analyze current spending patterns, identify cost optimization opportunities, scan for security vulnerabilities, check compliance with best practices, generate audit reports with prioritized recommendations, track audit history.

majiayu000 Bundle

TOS-compliant Discord notification monitor. Watches YOUR Discord server for security content forwarded by researchers, matches keywords, and pushes to create-paper/dogpile via webhooks. Persists to graph-memory for semantic search.

majiayu000 Bundle

> MANDATORY READING PROTOCOL: Before implementing credential storage, read references/advanced-patterns.md for cross-platform patterns and references/security-examples.md for platform-specific impleme

majiayu000 Bundle

Security incident remediation playbooks for removing threats, restoring systems, and recovering from incidents. Use for post-containment cleanup, system recovery, and returning to normal operations.

majiayu000 Bundle

Use when requirements are fuzzy, multiple technical approaches exist, or change affects architecture, API, data, or security

majiayu000 Bundle

Comprehensive skill for professional Solidity smart contract development using the Foundry framework. Provides security-first development practices, testing patterns, static analysis integration (Slither, solhint), and deployment workflows for EVM-compatible blockchains.

majiayu000 Bundle

Runs Static Application Security Testing (SAST) using Semgrep. Scans source code for vulnerabilities, security anti-patterns, and OWASP Top 10 issues. Use when user asks to "run SAST", "scan for vulnerabilities", "static analysis", "code security scan", "静的解析", "脆弱性スキャン".

majiayu000 Bundle

A comprehensive security skill that integrates with Secure Flow to help AI coding agents write secure code, perform security reviews, and implement security best practices. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.

majiayu000 Bundle

Audits skills for discoverability and triggering effectiveness. Use when reviewing skill descriptions, checking trigger coverage, validating progressive disclosure, fixing invocation issues, or learning skill best practices.

majiayu000 Bundle

Evaluate and improve Claude skill quality through auditing. Triggers: quality-assurance, skills, optimization, tool-use, performance-metrics, skill audit, quality review, compliance check, improvement suggestions, token usage analysis, skill evaluation, skill assessment, skill optimization, skill standards, skill metrics, skill performance. Use when reviewing skill quality, preparing skills for production, or auditing existing skills. Do not use when creating new skills (use modular-skills) or writing prose (use writing-clearly-and-concisely). Use this skill before shipping any skill to production.

majiayu000 Bundle

Implement soft delete pattern for data recovery and audit trails. Covers filtering, restoration, and permanent deletion workflows.

majiayu000 Bundle

Provides comprehensive guidance for Spring Boot development including project creation, auto-configuration, dependency injection, web development, data access, security, testing, and deployment. Use when the user asks about Spring Boot, needs to create Spring Boot applications, configure Spring Boot, or implement Spring Boot features.

majiayu000 Bundle

Use when writing tests, creating test strategies, or building automation frameworks. Invoke for unit tests, integration tests, E2E, coverage analysis, performance testing, security testing.

majiayu000 Bundle

Audits the codebase for security vulnerabilities and regulatory compliance (LGPD, GDPR, DORA, MiCA, HIPAA, SOC II, ISO 27001, PCI-DSS).

majiayu000 Bundle

Verify dark earthquake claims against fault databases. Use when checking if a candidate earthquake is truly "dark" (unmapped fault) or just pre-historical (known fault). Triggers on "verify dark", "check fault database", "is this dark", "audit earthquake claim".

majiayu000 Bundle

WordPress security best practices and vulnerability prevention for plugin development. Use when reviewing code for security issues or implementing security-sensitive features.

majiayu000 Bundle

Vision audit and sprint execution for org run elon and org run elon sprint requests. Use when asked to scan the repo for vision alignment, inefficiencies, or to push a fast sprint that may bend rules for speed.

majiayu000 Bundle

Comprehensive best practices, design patterns, and common pitfalls for ROS2 (Robot Operating System 2) development. Use this skill when building ROS2 nodes, packages, launch files, components, or debugging ROS2 systems. Trigger whenever the user mentions ROS2, colcon, rclpy, rclcpp, DDS, QoS, lifecycle nodes, managed nodes, ROS2 launch, ROS2 parameters, ROS2 actions, nav2, MoveIt2, micro-ROS, or any ROS2-era robotics middleware. Also trigger for ROS2 workspace setup, DDS tuning, intra-process communication, ROS2 security, or deploying ROS2 in production. Also trigger for colcon build issues, ament_cmake, ament_python, CMakeLists.txt for ROS2, package.xml dependencies, rosdep, workspace overlays, custom message generation, or ROS2 build troubleshooting. Covers Humble, Iron, Jazzy, and Rolling distributions.

majiayu000 Bundle

Use when committing changes: governed commit workflow with staging, lint, secret scan, conventional commit message, and push.

majiayu000 Bundle

· Audit AI-generated code slop: hallucinated APIs, over-abstraction, duplicate code, test theater, noisy comments. Triggers: 'slop', 'AI-generated code', 'cleanup', 'overengineered'. Not for prose (use anti-ai-prose).

majiayu000 Bundle

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.

majiayu000 Bundle

Zero-onboarding, read-only dry-run of the reviewer fleet against the current uncommitted diff. Predicts reviewers, runs the state-free secret scan, writes nothing.

majiayu000 Bundle

Testing Craft CMS 5 plugins and modules with Pest — test isolation, database safety, and the markhuot/craft-pest-core harness. ALWAYS load when writing, running, fixing, or reviewing tests for a Craft plugin or module, and whenever a suite touches a real Craft install. Covers why rollback is opt-in, tests/Pest.php + tests/bootstrap.php wiring, phpunit.xml.dist <env> pins (force the DB name and table prefix, default the connection coordinates so CI still connects), why --configuration= defeats DB isolation, installing the plugin under test, pinning the process timezone after app creation, per-test site fixtures, idempotent Install migrations, stale service caches when components get swapped, muting audit sinks, queue stubs, factories, HTTP/DB assertions, CI test jobs. Triggers on: Pest, pestphp, craft-pest-core, markhuot, RefreshesDatabase, InstallsCraft, tests/Pest.php, phpunit.xml.dist, vendor/bin/pest, composer test, ddev craft pest, db_test, CRAFT_DB_DATABASE, CRAFT_DB_TABLE_PREFIX, Entry::factory(), asser

majiayu000 Bundle

Deep consistency audit of the entire repository infrastructure. Launches 4 parallel specialist agents to find factual errors, code bugs, count mismatches, and cross-document inconsistencies. Then fixes all issues and loops until clean. Use when: after making broad changes, before releases, or when user says "audit", "find inconsistencies", "check everything".

majiayu000 Bundle

Read a Data Processing Agreement before you sign it — sub-processors, transfer mechanism, breach-notice window, deletion, audit rights — in plain language with 🔴🟡🟢 risk. Use when asked to review a DPA, check a data processing agreement, is this DPA safe to sign, or what am I agreeing to on data. Produces the plain-English summary, the risk-ranked findings, the missing-clause checklist, and the questions to send back before signature.

majiayu000 Bundle

Audit manuscript and replication package against FAIR open-science principles.

majiayu000 Bundle

Inspect LiveView socket assigns for memory bloat — missing temporary_assigns, unused assigns, unbounded lists needing streams, memory estimates. Use when LiveView memory grows or you need to add temporary_assigns.

majiayu000 Bundle

Review code with parallel agents — tests, security, Ecto, LiveView, Oban. Use after implementation to catch bugs and anti-patterns before committing.