Security

majiayu000 Bundle

Write an engineering RFC (Request for Comments) for a technical decision, architectural change, or significant implementation approach. Use when asked to write an RFC, document a technical proposal, create a design doc, write an architecture decision for review, or produce a technical specification for team feedback. Produces a complete RFC document covering problem statement, motivation, proposed solution, alternatives rejected, implementation plan, migration plan, security and performance implications, observability changes, rollout plan, and open questions.

majiayu000 Bundle

Canonical Suede shipping DAG: scout, multi-lens research, gap critic, lane plan with explicit file ownership, disjoint parallel build, dual-lens review, adversarial refute, integration gate, and release verification. Use for any nontrivial change to a repo that touches more than one file or surface and deserves roughly fifty agents of surgical, research-heavy fan-out. Halts on a blocking hazard (a real secret in a tracked file, a live process holding a target worktree) or a lane collision rather than plowing through. Reads production; never deploys. NOT FOR: high-volume, well-specified work that splits into independent worker-sized tasks (use suede-codex-fleet, which bills to the OpenAI subscription instead); findings-only review with no code change (use suede-code-review); CI and branch-protection wiring (use suede-ci-gate).

majiayu000 Bundle

System-wide structural audit of the entire PM knowledge system. Checks orphans, broken links, register coverage, schema violations across all decisions, and vault health metrics. Slower and deeper than /pm-review. Triggers on "/pm-audit", "system audit", "vault health", "find orphans", "check broken links".

majiayu000 Bundle

Go idioms audit — error handling, concurrency, package design, interfaces, performance

majiayu000 Bundle

Upgrade an existing website or app to premium quality without breaking functionality — audit the current design, identify generic/AI tells, then apply taste and system rules surgically. Use when the user wants to improve, modernize, polish, or "make better" an existing UI/codebase.

majiayu000 Bundle

Interact with atomCAD node networks programmatically. Query, edit, and replace CAD geometry nodes for atomic/molecular structure design. Use when working with atomCAD projects or when the user wants to manipulate node networks, create CSG shapes, or design atomic structures.

majiayu000 Bundle

Opt this repo into codeArbiter — scaffold the root-level .codearbiter/ state store.

majiayu000 Bundle

Safety guardrails for destructive commands. Warns before rm -rf, DROP TABLE, force-push, git reset --hard, kubectl delete, and similar destructive operations. User can override each warning. Use when touching prod, debugging live systems, or working in a shared environment. Use when asked to "be careful", "safety mode", "prod mode", or "careful mode".

majiayu000 Bundle

Cryptographic compliance verification. Sign security tool output into verifiable CPOEs (JWT-VC), verify vendor proofs via trust.txt, detect drift with diff, and assess third-party risk. Use when the user mentions compliance proofs, CPOE, trust.txt, SCITT, vendor assessment, GRC evidence, or compliance drift.

majiayu000 Bundle

Binary exploitation (pwn) techniques for CTF challenges. Use when exploiting buffer overflows, format strings, heap vulnerabilities, race conditions, kernel bugs, ROP chains, ret2libc, shellcode, GOT overwrite, use-after-free, seccomp bypass, or sandbox escape.

majiayu000 Bundle

Security policy for iOS apps. Enforces OWASP Top 10, Mobile Top 10, and CWE Top 25 mitigations.

majiayu000 Bundle

User pairing, authentication, and trust management

majiayu000 Bundle

Network/infrastructure penetration testing with AD attacks

majiayu000 Bundle

United Arab Emirates Governance, Risk & Compliance advisor — a jurisdiction-first compliance router. In the UAE, WHERE an organization sits determines its law: mainland (Federal PDPL, Decree-Law 45/2021 — executive regulations still pending), DIFC (DP Law No. 5 of 2020 as amended 2025, with a private right of action), ADGM (DP Regulations 2021), CBUAE-licensed financial institutions (consumer-data residency, outsourcing approvals), healthcare (ICT Health Law data localization), and government/CNI (UAE IA Regulation, Cyber Security Council; Dubai ISR, ADHICS). Use for any UAE / Dubai / Abu Dhabi / Emirates compliance question: UAE data protection, DIFC or ADGM privacy, free-zone vs mainland obligations, health-data residency, CBUAE cyber and outsourcing rules, market entry ("expanding to the UAE"), breach notification, gap assessments, and mapping UAE requirements to ISO 27001 / NIST CSF / SOC 2. Trigger for any UAE privacy, cybersecurity, or regulatory question even if no framework is named.

majiayu000 Bundle

Sign, verify, and track fix-marker regressions over time using a deterministic Ed25519 witness manifest. Works in any project — clone the toolkit, run init, register fixes, regen on each release.

majiayu000 Bundle

X9.150 Secure Payment QR Code specification reference — OpenAPI schemas, field constraints, EMVCo TLV tags, JWS security, payment lifecycle

majiayu000 Bundle

Comprehensive macOS development environment health check. Detects brew drift, orphaned packages, security issues, version mismatches, and deferred cleanup readiness.

majiayu000 Bundle

Semantic code research across GitHub repositories for finding implementations, patterns, and conducting PR/security reviews.

majiayu000 Bundle

PowerShell 7 best practices, performance patterns, and cross-platform development. Use when writing PowerShell scripts, modules, functions, or tests. Covers advanced functions, error handling, collections, security, module development, Pester testing, and PSScriptAnalyzer. Triggers on "PowerShell", "pwsh", "ps1", "Pester", "PSScriptAnalyzer", "PowerShell module".

majiayu000 Bundle

Audit BTCPay Server configuration. Checks store settings, webhook health, payment notifications, and API connectivity. Use when: running BTCPay as payment processor, diagnosing webhook issues, or verifying setup. Keywords: btcpay, btcpayserver, greenfield, payment processor.

majiayu000 Bundle

Comprehensive health audit for design documentation. Use when performing thorough quality checks, preparing for releases, or ensuring documentation compliance.

majiayu000 Bundle

Execute approved task specifications sequentially with TDD, comprehensive testing, and validation. This skill should be used for implementing tasks from approved specs with full audit trail.

majiayu000 Bundle

Overview: This guide outlines best practices for using Firebase on Apple platforms with Swift and on web/Node platforms with TypeScript. It covers how to set up the SDKs, organize code, handle data ef

majiayu000 Bundle

Use when tests are failing, test quality issues were identified, or user wants to fix/improve specific tests

majiayu000 Bundle

Automatically add or update documentation following the Fractal Docs Protocol. 自动添加或更新符合分形文档协议的文档。 Use when: - Creating new source files (add [IN]/[OUT]/[POS] headers) - Creating new folders (add .folder.md) - Modifying existing files (update headers and .folder.md) - Running documentation audit - User mentions "fractal", "doc protocol", "add headers", "补全文档"

majiayu000 Bundle

Audit funnel performance. Use when: finding drop-off points, conversion gaps, or stage bottlenecks.

majiayu000 Bundle

iPhoneユーザー向けのUX監査を実行し、問題点と改善案をレポートする。「UX監査して」「iOS UXチェック」「画面を監査」などのリクエストで使用する。

majiayu000 Bundle

Audit landing page for conversion optimization including headline-ad alignment, promise-delivery consistency, trust signals, and friction points. Use when diagnosing low landing page CTR, optimizing funnels, or reviewing pages before launch.

majiayu000 Bundle

Apply the MITRE ATT&CK framework for threat intelligence and detection. Provides a universal taxonomy of adversary tactics, techniques, and procedures (TTPs). Use when mapping threats, building detections, or assessing defensive coverage.

majiayu000 Bundle

Multi-tenant architecture patterns including org_id claim management, JWT token structure with organization context, database isolation strategies for MongoDB and PostgreSQL, theme switching per organization, tenant provisioning workflows, data isolation patterns, and cross-tenant security. Activate for multi-tenancy implementation, tenant isolation, and organization-scoped data access.

majiayu000 Bundle

Expert technical advisor with deep reasoning for architecture decisions, code analysis, and engineering guidance. Masters complex tradeoffs, system design, security architecture, performance optimization, and engineering best practices. Use when making critical architecture decisions, after implementing significant work, when debugging complex issues, encountering unfamiliar patterns, facing security/performance concerns, or evaluating multi-system tradeoffs. Provides comprehensive analysis with clear recommendations and rationale.

majiayu000 Bundle

OWASP Top 10 security vulnerabilities with detection and remediation patterns. Use when conducting security audits, implementing secure coding practices, or reviewing code for common security vulnerabilities.

majiayu000 Bundle

パスワードレス認証（Passwordless Authentication）機能の開発・修正を行う際に使用。FIDO2/WebAuthn, Passkey, FIDO-UAF実装時に役立つ。

majiayu000 Bundle

Two-phase workflow that generates explicit YAML plan before execution, with approval gates and checkpointing. Use for complex multi-file changes, refactoring, bug fixes with dependencies, or any task where mistakes are costly. Achieves 90% first-pass success rate vs ad-hoc changes. Provides audit trail, rollback capability, and explicit approval points. Triggers on "refactor", "multi-step", "plan then execute", "complex changes", "safe refactoring".

majiayu000 Bundle

MANDATORY when touching auth tables, tenant isolation, RLS policies, or multi-tenant database code - enforces Row Level Security best practices and catches common bypass vulnerabilities

majiayu000 Bundle

Performs a fast, focused code review checking for common issues, security vulnerabilities, and best practices without over-engineering. Optimized for cost-efficiency by targeting specific concerns rather than broad exploration.